Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 12,259 published records · 20 KEV · 12,259 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

12,259 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit1,45512%
High4,59737%
Med3,35727%
Low3142.6%
None50.04%
Legacy00.00%
Unscored2,53121%

Matching records by UTC month

Aug 2612,259

Signal coverage

KEV-listed: 20
With a forecast: 12,259
Unknown date: 0
Unscored severity: 2,531

Share of cohort: KEV 0.16% · forecast 100% · unscored 21%.

Showing 6741–6760 of 12,259By severity band: Critical · 9.0–10.0 1,455, High · 7.0–8.9 4,597, Medium · 4.0–6.9 3,357, Low · 0.1–3.9 314, None · scored 0.0 5, Legacy · v2 only 0, Unscored · no CNA metric 2,531

HighPublished 15 Aug 2026, 12:58 WIB

CVE-2026-74341

wifi: wcn36xx: fix heap overflow from oversized firmware HAL response

In the Linux kernel, the following vulnerability has been resolved: wifi: wcn36xx: fix heap overflow from oversized firmware HAL response The firmware response dispatcher copies all synchronous HAL responses into the 4096-byte hal_buf without validating the response length. A response exceeding WCN36XX_HAL_BUF_SIZE c…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-15T05:58:31.238Z. Updated 2026-08-17T05:46:07.295Z.

CVSS8.8v3.1KEVNot listedEPSSPresentUpdated17 Aug 2026, 12:46 WIB

Official record

HighPublished 15 Aug 2026, 12:58 WIB

CVE-2026-74340

wifi: wcn36xx: fix OOB read from firmware count in PRINT_REG_INFO indication

In the Linux kernel, the following vulnerability has been resolved: wifi: wcn36xx: fix OOB read from firmware count in PRINT_REG_INFO indication The firmware-controlled rsp->count field is used as the loop bound for indexing into the flexible rsp->regs[] array without validation against the message length. A count ex…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Showing 6741 to 6760 of 12259.First page Next page

Severity high: primary CNA CVSS 8.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-15T05:58:30.558Z. Updated 2026-10-16T18:55:34.097Z.

CVSS8.1v3.1KEVNot listedEPSSPresentUpdated17 Oct 2026, 01:55 WIB

Official record

UnscoredPublished 15 Aug 2026, 12:58 WIB

CVE-2026-74339

ALSA: seq: Clear variable event pointer on read

In the Linux kernel, the following vulnerability has been resolved: ALSA: seq: Clear variable event pointer on read snd_seq_read() copies a queued variable-length event header to userspace before expanding the payload. Queued variable-length events use SNDRV_SEQ_EXT_CHAINED internally, and data.ext.ptr points at the …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-15T05:58:29.888Z. Updated 2026-08-17T05:17:31.258Z.

CVSS—KEVNot listedEPSSPresentUpdated17 Aug 2026, 12:17 WIB

Official record

HighPublished 15 Aug 2026, 12:58 WIB

CVE-2026-74338

bpf: Reject sleepable BPF_LSM_CGROUP programs at load time

In the Linux kernel, the following vulnerability has been resolved: bpf: Reject sleepable BPF_LSM_CGROUP programs at load time The cgroup shim runs under rcu_read_lock_dont_migrate(), so we should not attach any sleepable BPF programs there. Add support to the verifier to explicitly reject attempts to load sleepable …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-15T05:58:29.222Z. Updated 2026-10-21T12:45:22.525Z.

CVSS7.8v3.1KEVNot listedEPSSPresentUpdated21 Oct 2026, 19:45 WIB

Official record

UnscoredPublished 15 Aug 2026, 12:58 WIB

CVE-2026-74337

bpf: Fix NMI/tracepoint re-entry deadlock on lru locks

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix NMI/tracepoint re-entry deadlock on lru locks NMI and tracepoint BPF programs can re-enter the per-CPU or global LRU lock that bpf_lru_pop_free()/push_free() already hold on the same CPU, AA-deadlocking. Lockdep reports "inconsistent {INITIA…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-15T05:58:28.518Z. Updated 2026-08-17T05:17:29.070Z.

CVSS—KEVNot listedEPSSPresentUpdated17 Aug 2026, 12:17 WIB

Official record

UnscoredPublished 15 Aug 2026, 12:58 WIB

CVE-2026-74336

wifi: mac80211: bound S1G TIM PVB walk to the TIM element

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: bound S1G TIM PVB walk to the TIM element ieee80211_s1g_check_tim() parses the S1G Partial Virtual Bitmap (PVB) of a received TIM element. The TIM is handed in as the element payload: ieee802_11_parse_elems_full() stores elems->tim = …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-15T05:58:27.799Z. Updated 2026-10-15T10:08:55.597Z.

CVSS—KEVNot listedEPSSPresentUpdated15 Oct 2026, 17:08 WIB

Official record

UnscoredPublished 15 Aug 2026, 12:58 WIB

CVE-2026-74335

bpf: Fix NULL pointer dereference in bpf_task_from_vpid()

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix NULL pointer dereference in bpf_task_from_vpid() bpf_task_from_vpid() looks up a task in the pid namespace of the current task, via find_task_by_vpid(): find_task_by_vpid(vpid) find_task_by_pid_ns(vpid, task_active_pid_ns(current)) …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-15T05:58:27.148Z. Updated 2026-08-17T05:17:26.885Z.

CVSS—KEVNot listedEPSSPresentUpdated17 Aug 2026, 12:17 WIB

Official record

HighPublished 15 Aug 2026, 12:58 WIB

CVE-2026-74334

RDMA/nldev: Fix locking when accessing mr->pd

In the Linux kernel, the following vulnerability has been resolved: RDMA/nldev: Fix locking when accessing mr->pd Sashiko points out that, due to rereg_mr, the PD is actually variable and all the touches in nldev are racy. Use mr->device instead of mr->pd->device. Getting the PD restrack ID is more tricky. To avoid…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-15T05:58:26.455Z. Updated 2026-10-16T18:55:33.821Z.

CVSS7.8v3.1KEVNot listedEPSSPresentUpdated17 Oct 2026, 01:55 WIB

Official record

HighPublished 15 Aug 2026, 12:58 WIB

CVE-2026-74333

ASoC: amd: acp-sdw-legacy: Bound DAI link iteration

In the Linux kernel, the following vulnerability has been resolved: ASoC: amd: acp-sdw-legacy: Bound DAI link iteration create_sdw_dailinks() walks soc_dais until it finds an entry with initialised cleared, but soc_dais is allocated with exactly num_ends entries. If all entries are initialised, the loop reads past th…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.4 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-15T05:58:25.781Z. Updated 2026-10-16T18:55:33.681Z.

CVSS8.4v3.1KEVNot listedEPSSPresentUpdated17 Oct 2026, 01:55 WIB

Official record

HighPublished 15 Aug 2026, 12:58 WIB

CVE-2026-74332

ASoC: amd: acp-sdw-sof: Bound DAI link iteration

In the Linux kernel, the following vulnerability has been resolved: ASoC: amd: acp-sdw-sof: Bound DAI link iteration create_sdw_dailinks() walks sof_dais until it finds an entry with initialised cleared, but sof_dais is allocated with exactly num_ends entries. If all entries are initialised, the loop reads past the e…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.4 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-15T05:58:25.112Z. Updated 2026-10-16T18:55:33.526Z.

CVSS8.4v3.1KEVNot listedEPSSPresentUpdated17 Oct 2026, 01:55 WIB

Official record

UnscoredPublished 15 Aug 2026, 12:58 WIB

CVE-2026-74331

firmware_loader: Fix recursive lock in device_cache_fw_images()

In the Linux kernel, the following vulnerability has been resolved: firmware_loader: Fix recursive lock in device_cache_fw_images() A recursive locking deadlock can occur in the firmware loader's power management notification handler. During system suspend or hibernation preparation, fw_pm_notify() calls device_cach…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-15T05:58:24.420Z. Updated 2026-08-17T05:17:22.413Z.

CVSS—KEVNot listedEPSSPresentUpdated17 Aug 2026, 12:17 WIB

Official record

HighPublished 15 Aug 2026, 12:58 WIB

CVE-2026-74330

configfs: fix lockless traversals of ->s_children

In the Linux kernel, the following vulnerability has been resolved: configfs: fix lockless traversals of ->s_children Having the parent directory locked protects entries from removal by another thread, but it does *not* protect cursors from being moved around by lseek() - or freed, for that matter.

Excerpt language: en.

Severity high: primary CNA CVSS 7.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-15T05:58:23.722Z. Updated 2026-10-16T18:55:33.381Z.

CVSS7.8v3.1KEVNot listedEPSSPresentUpdated17 Oct 2026, 01:55 WIB

Official record

UnscoredPublished 15 Aug 2026, 12:58 WIB

CVE-2026-74329

watchdog: unregister PM notifier on watchdog unregister

In the Linux kernel, the following vulnerability has been resolved: watchdog: unregister PM notifier on watchdog unregister watchdog_register_device() registers wdd->pm_nb when WDOG_NO_PING_ON_SUSPEND is set, but watchdog_unregister_device() does not remove it. This leaves an embedded notifier block on the PM notifie…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-15T05:58:23.059Z. Updated 2026-08-17T05:17:20.223Z.

CVSS—KEVNot listedEPSSPresentUpdated17 Aug 2026, 12:17 WIB

Official record

HighPublished 15 Aug 2026, 12:58 WIB

CVE-2026-74328

iommufd: Destroy the pages content after detaching from dmabuf

In the Linux kernel, the following vulnerability has been resolved: iommufd: Destroy the pages content after detaching from dmabuf Sashiko points out this has gotten out of order, the mutex could still be in use through the dmabuf invalidation callbacks. Don't destroy any of the pages content until the dmabuf is full…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-15T05:58:22.371Z. Updated 2026-08-17T05:45:55.733Z.

CVSS8.8v3.1KEVNot listedEPSSPresentUpdated17 Aug 2026, 12:45 WIB

Official record

UnscoredPublished 15 Aug 2026, 12:58 WIB

CVE-2026-74327

vmalloc: fix NULL pointer dereference in is_vm_area_hugepages()

In the Linux kernel, the following vulnerability has been resolved: vmalloc: fix NULL pointer dereference in is_vm_area_hugepages() find_vm_area() can return NULL if the given address is not a valid vmalloc area. Check the return value before dereferencing it to avoid a kernel crash.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-15T05:58:21.665Z. Updated 2026-08-17T05:17:17.979Z.

CVSS—KEVNot listedEPSSPresentUpdated17 Aug 2026, 12:17 WIB

Official record

UnscoredPublished 15 Aug 2026, 12:58 WIB

CVE-2026-74326

wifi: mt76: mt7921: fix resource leak in probe error path

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7921: fix resource leak in probe error path When pcim_iomap_region() or devm_kmemdup() fail, the code returns directly without cleaning up previously allocated resources: - mt76_device allocated by mt76_alloc_device() - pci irq vect…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-15T05:58:20.933Z. Updated 2026-08-17T05:17:16.898Z.

CVSS—KEVNot listedEPSSPresentUpdated17 Aug 2026, 12:17 WIB

Official record

HighPublished 15 Aug 2026, 12:58 WIB

CVE-2026-74325

wifi: mt76: use kfree_rcu for offchannel link in mt76_put_vif_phy_link

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: use kfree_rcu for offchannel link in mt76_put_vif_phy_link mt76_put_vif_phy_link() frees the offchannel mlink with plain kfree() after rcu_assign_pointer(NULL). However, rcu_assign_pointer only prevents future RCU readers from obtaining t…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-15T05:58:20.236Z. Updated 2026-10-16T18:55:33.235Z.

CVSS7.8v3.1KEVNot listedEPSSPresentUpdated17 Oct 2026, 01:55 WIB

Official record

UnscoredPublished 15 Aug 2026, 12:58 WIB

CVE-2026-74324

wifi: mt76: mt7925: validate skb length in testmode query

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7925: validate skb length in testmode query In mt7925_tm_query(), the response skb from mt76_mcu_send_and_get_msg() is used in a memcpy without validating its length: memcpy(evt_resp, skb->data + 8, MT7925_EVT_RSP_LEN); where MT7925…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-15T05:58:19.518Z. Updated 2026-08-17T05:17:14.721Z.

CVSS—KEVNot listedEPSSPresentUpdated17 Aug 2026, 12:17 WIB

Official record

HighPublished 15 Aug 2026, 12:58 WIB

CVE-2026-74323

wifi: mt76: mt7996: Fix possible token leak in mt7996_tx_prepare_skb()

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7996: Fix possible token leak in mt7996_tx_prepare_skb() If link_conf or link_sta lookup fails in mt7996_tx_prepare_skb routine, mt7996 driver leaks an already allocated tx token. Fix the issue releasing the token in case of error.

Excerpt language: en.

Severity high: primary CNA CVSS 8.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-15T05:58:18.857Z. Updated 2026-10-16T18:55:33.088Z.

CVSS8.8v3.1KEVNot listedEPSSPresentUpdated17 Oct 2026, 01:55 WIB

Official record

UnscoredPublished 15 Aug 2026, 12:58 WIB

CVE-2026-74322

wifi: mt76: mt7996: Fix possible NULL pointer dereference in mt7996_mac_write_txwi_80211()

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7996: Fix possible NULL pointer dereference in mt7996_mac_write_txwi_80211() For injected frames (e.g. via radiotap), mac80211 can pass info->control.vif = NULL, as explicitly noted in struct ieee80211_tx_info. Check vif pointer before …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-15T05:58:18.167Z. Updated 2026-08-17T05:17:12.538Z.

CVSS—KEVNot listedEPSSPresentUpdated17 Aug 2026, 12:17 WIB

Official record