Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 12,259 published records · 20 KEV · 12,259 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

12,259 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit1,45512%
High4,59737%
Med3,35727%
Low3142.6%
None50.04%
Legacy00.00%
Unscored2,53121%

Matching records by UTC month

Aug 2612,259

Signal coverage

KEV-listed: 20
With a forecast: 12,259
Unknown date: 0
Unscored severity: 2,531

Share of cohort: KEV 0.16% · forecast 100% · unscored 21%.

Showing 6681–6700 of 12,259By severity band: Critical · 9.0–10.0 1,455, High · 7.0–8.9 4,597, Medium · 4.0–6.9 3,357, Low · 0.1–3.9 314, None · scored 0.0 5, Legacy · v2 only 0, Unscored · no CNA metric 2,531

CritPublished 15 Aug 2026, 12:59 WIB

CVE-2026-74401

dlm: fix add msg handle in send_queue ordered

In the Linux kernel, the following vulnerability has been resolved: dlm: fix add msg handle in send_queue ordered In a benchmark scenario triggering a lot of requests that triggers a lot of DLM messages on the network it can be that the mh->seq is not ordered according the oldest seq number. This ordering is required…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-15T05:59:12.099Z. Updated 2026-10-16T19:05:42.033Z.

CVSS9.8v3.1KEVNot listedEPSSPresentUpdated17 Oct 2026, 02:05 WIB

Official record

UnscoredPublished 15 Aug 2026, 12:59 WIB

CVE-2026-74400

bpf: fix crash in bpf_[set|remove]_dentry_xattr for negative dentries

In the Linux kernel, the following vulnerability has been resolved: bpf: fix crash in bpf_[set|remove]_dentry_xattr for negative dentries bpf_set_dentry_xattr and bpf_remove_dentry_xattr BPF kfuncs attempt to lock the inode of the supplied dentry without checking if it is NULL. If a negative dentry is passed (e.g. fr…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Showing 6681 to 6700 of 12259.First page Next page

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-15T05:59:11.450Z. Updated 2026-08-17T05:18:40.094Z.

CVSS—KEVNot listedEPSSPresentUpdated17 Aug 2026, 12:18 WIB

Official record

UnscoredPublished 15 Aug 2026, 12:59 WIB

CVE-2026-74399

evm: terminate and bound the evm_xattrs read buffer

In the Linux kernel, the following vulnerability has been resolved: evm: terminate and bound the evm_xattrs read buffer evm_read_xattrs() allocates size + 1 bytes, fills them from the list of enabled xattrs, and then passes strlen(temp) to simple_read_from_buffer(). When no configured xattrs are enabled, the fill loo…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-15T05:59:10.791Z. Updated 2026-08-17T05:18:39.008Z.

CVSS—KEVNot listedEPSSPresentUpdated17 Aug 2026, 12:18 WIB

Official record

CritPublished 15 Aug 2026, 12:59 WIB

CVE-2026-74398

ipv6: addrconf: bail out of dad_failure when state is no longer POSTDAD

In the Linux kernel, the following vulnerability has been resolved: ipv6: addrconf: bail out of dad_failure when state is no longer POSTDAD addrconf_dad_failure() transitions ifp->state from DAD to POSTDAD via addrconf_dad_end(), which drops ifp->lock on return. The lock is re-acquired after net_info_ratelimited(). …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-15T05:59:10.113Z. Updated 2026-10-16T19:05:41.331Z.

CVSS9.8v3.1KEVNot listedEPSSPresentUpdated17 Oct 2026, 02:05 WIB

Official record

HighPublished 15 Aug 2026, 12:59 WIB

CVE-2026-74397

IB/mlx5: Fix transport-domain rollback and initialize lb mutex earlier

In the Linux kernel, the following vulnerability has been resolved: IB/mlx5: Fix transport-domain rollback and initialize lb mutex earlier mlx5_ib_alloc_transport_domain() allocates a transport domain and then may fail in mlx5_ib_enable_lb(). In that case, the allocated TD is leaked. Fix this by deallocating the TD …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-15T05:59:09.329Z. Updated 2026-10-16T19:05:41.192Z.

CVSS7.8v3.1KEVNot listedEPSSPresentUpdated17 Oct 2026, 02:05 WIB

Official record

HighPublished 15 Aug 2026, 12:59 WIB

CVE-2026-74396

RDMA/mlx5: Fix UMR XLT cleanup on ODP populate failure

In the Linux kernel, the following vulnerability has been resolved: RDMA/mlx5: Fix UMR XLT cleanup on ODP populate failure mlx5r_umr_update_xlt() allocates and DMA maps an XLT buffer with mlx5r_umr_create_xlt(). The buffer is released by the common cleanup path through mlx5r_umr_unmap_free_xlt(). After mlx5_odp_popu…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-15T05:59:08.694Z. Updated 2026-10-16T19:05:41.026Z.

CVSS7.5v3.1KEVNot listedEPSSPresentUpdated17 Oct 2026, 02:05 WIB

Official record

UnscoredPublished 15 Aug 2026, 12:59 WIB

CVE-2026-74395

RDMA/mlx5: Fix devx subscribe-event unwind NULL dereference

In the Linux kernel, the following vulnerability has been resolved: RDMA/mlx5: Fix devx subscribe-event unwind NULL dereference MLX5_IB_METHOD_DEVX_SUBSCRIBE_EVENT() links event_sub into sub_list before initializing the fields used by the shared error path. If eventfd_ctx_fdget() then fails, the unwind path derefere…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-15T05:59:07.798Z. Updated 2026-08-17T05:18:34.634Z.

CVSS—KEVNot listedEPSSPresentUpdated17 Aug 2026, 12:18 WIB

Official record

CritPublished 15 Aug 2026, 12:59 WIB

CVE-2026-74394

RDMA/srpt: fix integer overflow in immediate data length check

In the Linux kernel, the following vulnerability has been resolved: RDMA/srpt: fix integer overflow in immediate data length check imm_buf->len is a user-controlled uint32_t received from the network. Adding it to imm_data_offset without overflow checking allows a malicious initiator to send len=0xFFFFFFFF, causing r…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-15T05:59:07.144Z. Updated 2026-10-16T19:05:40.869Z.

CVSS9.8v3.1KEVNot listedEPSSPresentUpdated17 Oct 2026, 02:05 WIB

Official record

UnscoredPublished 15 Aug 2026, 12:59 WIB

CVE-2026-74393

drm/syncobj: Fix memory leak in drm_syncobj_find_fence()

In the Linux kernel, the following vulnerability has been resolved: drm/syncobj: Fix memory leak in drm_syncobj_find_fence() Commit 18226ba52159 ("drm/syncobj: reject invalid flags in drm_syncobj_find_fence") forgot to take into account the fact that drm_syncobj_find() takes a reference to syncobj and returns early w…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-15T05:59:06.470Z. Updated 2026-08-17T05:18:32.271Z.

CVSS—KEVNot listedEPSSPresentUpdated17 Aug 2026, 12:18 WIB

Official record

UnscoredPublished 15 Aug 2026, 12:59 WIB

CVE-2026-74392

dm: limit target bio polling to one shot

In the Linux kernel, the following vulnerability has been resolved: dm: limit target bio polling to one shot dm_poll_bio() is the ->poll_bio() callback for a stacked dm device. The caller only knows about the dm queue, so it may decide to do a spinning poll if it thinks a single queue is being polled. Passing those f…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-15T05:59:05.787Z. Updated 2026-08-17T05:18:31.175Z.

CVSS—KEVNot listedEPSSPresentUpdated17 Aug 2026, 12:18 WIB

Official record

UnscoredPublished 15 Aug 2026, 12:59 WIB

CVE-2026-74391

tracing: Bound synthetic-field strings with seq_buf

In the Linux kernel, the following vulnerability has been resolved: tracing: Bound synthetic-field strings with seq_buf The synthetic field helpers build a prefixed synthetic variable name and a generated hist command in fixed MAX_FILTER_STR_VAL buffers. The current code appends those strings with raw strcat(), so lo…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-15T05:59:05.127Z. Updated 2026-08-17T05:18:30.085Z.

CVSS—KEVNot listedEPSSPresentUpdated17 Aug 2026, 12:18 WIB

Official record

HighPublished 15 Aug 2026, 12:59 WIB

CVE-2026-74390

RDMA/irdma: Fix out-of-bounds write in irdma_copy_user_pgaddrs

In the Linux kernel, the following vulnerability has been resolved: RDMA/irdma: Fix out-of-bounds write in irdma_copy_user_pgaddrs The irdma_copy_user_pgaddrs function loops through all of the umem DMA blocks to populate the PBLEs and will stop when either the last DMA block is reached or palloc->total_cnt is reached…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-15T05:59:04.479Z. Updated 2026-10-16T19:05:40.715Z.

CVSS7.8v3.1KEVNot listedEPSSPresentUpdated17 Oct 2026, 02:05 WIB

Official record

UnscoredPublished 15 Aug 2026, 12:59 WIB

CVE-2026-74389

RDMA/hns: Fix log flood after cmd_mbox failure

In the Linux kernel, the following vulnerability has been resolved: RDMA/hns: Fix log flood after cmd_mbox failure hns_roce_cmd_mbox() is the command interface between driver and hardware. When hardware is abnormal, the unlimited error printings after hns_roce_cmd_mbox() failure will cause log flood and even system c…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-15T05:59:03.786Z. Updated 2026-10-21T12:45:37.231Z.

CVSS—KEVNot listedEPSSPresentUpdated21 Oct 2026, 19:45 WIB

Official record

HighPublished 15 Aug 2026, 12:59 WIB

CVE-2026-74388

ALSA: seq: oss: Fix UAF at handling events with embedded SysEx data

In the Linux kernel, the following vulnerability has been resolved: ALSA: seq: oss: Fix UAF at handling events with embedded SysEx data The OSS sequencer processes the input MIDI bytes into a sequencer event to be dispatched later (in snd_seq_oss_midi_putc() called from snd_seq_oss_process_event()). When it's a SysE…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-15T05:59:03.147Z. Updated 2026-10-21T12:45:36.081Z.

CVSS7.8v3.1KEVNot listedEPSSPresentUpdated21 Oct 2026, 19:45 WIB

Official record

HighPublished 15 Aug 2026, 12:59 WIB

CVE-2026-74387

ALSA: seq: midi: Serialize output teardown with event_input

In the Linux kernel, the following vulnerability has been resolved: ALSA: seq: midi: Serialize output teardown with event_input event_process_midi() borrows msynth->output_rfile.output and then passes the substream to dump_midi() and snd_rawmidi_kernel_write() without synchronizing with the output open/close transiti…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-15T05:59:02.457Z. Updated 2026-10-16T18:55:36.992Z.

CVSS7.8v3.1KEVNot listedEPSSPresentUpdated17 Oct 2026, 01:55 WIB

Official record

UnscoredPublished 15 Aug 2026, 12:59 WIB

CVE-2026-74386

nvmet-tcp: fix page fragment cache leak in error path

In the Linux kernel, the following vulnerability has been resolved: nvmet-tcp: fix page fragment cache leak in error path In nvmet_tcp_alloc_queue(), when a connection is closed during the allocation process (e.g., nvmet_tcp_set_queue_sock() returns -ENOTCONN), the error handling jumps to out_destroy_sq and then to o…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-15T05:59:01.786Z. Updated 2026-10-21T12:45:34.958Z.

CVSS—KEVNot listedEPSSPresentUpdated21 Oct 2026, 19:45 WIB

Official record

HighPublished 15 Aug 2026, 12:59 WIB

CVE-2026-74385

nvmet-tcp: check return value of nvmet_tcp_set_queue_sock

In the Linux kernel, the following vulnerability has been resolved: nvmet-tcp: check return value of nvmet_tcp_set_queue_sock The return value of nvmet_tcp_set_queue_sock() is currently ignored in nvmet_tcp_tls_handshake_done(). If it fails (e.g., due to the socket not being in TCP_ESTABLISHED state), the socket call…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-15T05:59:01.113Z. Updated 2026-10-21T12:45:33.852Z.

CVSS7.5v3.1KEVNot listedEPSSPresentUpdated21 Oct 2026, 19:45 WIB

Official record

CritPublished 15 Aug 2026, 12:59 WIB

CVE-2026-74384

nvme-multipath: fix flex array size in struct nvme_ns_head

In the Linux kernel, the following vulnerability has been resolved: nvme-multipath: fix flex array size in struct nvme_ns_head struct nvme_ns_head contains a flexible array member, current_path[], which is indexed using the NUMA node ID: head->current_path[numa_node_id()] The structure is currently allocated as: siz…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-15T05:59:00.445Z. Updated 2026-10-16T18:55:36.724Z.

CVSS9.8v3.1KEVNot listedEPSSPresentUpdated17 Oct 2026, 01:55 WIB

Official record

HighPublished 15 Aug 2026, 12:58 WIB

CVE-2026-74383

nvme-pci: fix out-of-bounds access in nvme_setup_descriptor_pools

In the Linux kernel, the following vulnerability has been resolved: nvme-pci: fix out-of-bounds access in nvme_setup_descriptor_pools nvme_setup_descriptor_pools() indexes dev->descriptor_pools[] using the numa_node forwarded from hctx->numa_node by its single caller, nvme_init_hctx_common(). On a non-NUMA kernel hc…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.4 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-15T05:58:59.767Z. Updated 2026-08-17T05:46:33.114Z.

CVSS8.4v3.1KEVNot listedEPSSPresentUpdated17 Aug 2026, 12:46 WIB

Official record

UnscoredPublished 15 Aug 2026, 12:58 WIB

CVE-2026-74382

net/sched: cls_bpf: prevent unbounded recursion in offload rollback

In the Linux kernel, the following vulnerability has been resolved: net/sched: cls_bpf: prevent unbounded recursion in offload rollback Quan Sun reported [1] a stack overflow in cls_bpf_offload_cmd(). Reproducer on netdevsim: add a skip_sw cls_bpf filter, set the bpf_tc_accept debugfs knob to 0, then `tc filter repl…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-15T05:58:59.106Z. Updated 2026-08-17T05:18:20.179Z.

CVSS—KEVNot listedEPSSPresentUpdated17 Aug 2026, 12:18 WIB

Official record