Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 12,259 published records · 20 KEV · 12,259 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

12,259 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit1,45512%
High4,59737%
Med3,35727%
Low3142.6%
None50.04%
Legacy00.00%
Unscored2,53121%

Matching records by UTC month

Aug 2612,259

Signal coverage

KEV-listed: 20
With a forecast: 12,259
Unknown date: 0
Unscored severity: 2,531

Share of cohort: KEV 0.16% · forecast 100% · unscored 21%.

Showing 6761–6780 of 12,259By severity band: Critical · 9.0–10.0 1,455, High · 7.0–8.9 4,597, Medium · 4.0–6.9 3,357, Low · 0.1–3.9 314, None · scored 0.0 5, Legacy · v2 only 0, Unscored · no CNA metric 2,531

HighPublished 15 Aug 2026, 12:58 WIB

CVE-2026-74321

btrfs: fix invalid pointer dereference in __btrfs_run_delayed_refs()

In the Linux kernel, the following vulnerability has been resolved: btrfs: fix invalid pointer dereference in __btrfs_run_delayed_refs() In the beginning of the loop, we try to obtain a locked delayed ref head, if 'locked_ref' is currently NULL, by calling btrfs_select_ref_head(), which can return an error pointer. I…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-15T05:58:17.485Z. Updated 2026-10-16T18:55:32.917Z.

CVSS7.5v3.1KEVNot listedEPSSPresentUpdated17 Oct 2026, 01:55 WIB

Official record

UnscoredPublished 15 Aug 2026, 12:58 WIB

CVE-2026-74320

fbdev: sm501fb: Fix buffer errors in OF binding code

In the Linux kernel, the following vulnerability has been resolved: fbdev: sm501fb: Fix buffer errors in OF binding code The code that gets the frame buffer mode from OF has 'use after free', 'buffer overrun' and memory leaks. info->edid_data isn't free if the probe functions fail or if pd->def_mode is set. If both…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Showing 6761 to 6780 of 12259.First page Next page

Published 2026-08-15T05:58:16.805Z. Updated 2026-08-17T05:17:10.332Z.

CVSS—KEVNot listedEPSSPresentUpdated17 Aug 2026, 12:17 WIB

Official record

UnscoredPublished 15 Aug 2026, 12:58 WIB

CVE-2026-74319

btrfs: zoned: fix deadlock waiting for ticket during data relocation

In the Linux kernel, the following vulnerability has been resolved: btrfs: zoned: fix deadlock waiting for ticket during data relocation When performing data relocation on a zoned filesystem, BTRFS can deadlock in handle_reserve_tickets(). The relocation process is waiting on a space reservation ticket that can never…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-15T05:58:16.142Z. Updated 2026-08-17T05:17:09.243Z.

CVSS—KEVNot listedEPSSPresentUpdated17 Aug 2026, 12:17 WIB

Official record

UnscoredPublished 15 Aug 2026, 12:58 WIB

CVE-2026-74318

btrfs: fix deadlock cloning inline extent when using flushoncommit

In the Linux kernel, the following vulnerability has been resolved: btrfs: fix deadlock cloning inline extent when using flushoncommit In commit b48c980b6a7e ("btrfs: fix deadlock between reflink and transaction commit when using flushoncommit") a deadlock was fixed between reflinks and transaction commits when the f…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-15T05:58:15.499Z. Updated 2026-10-21T12:45:21.412Z.

CVSS—KEVNot listedEPSSPresentUpdated21 Oct 2026, 19:45 WIB

Official record

HighPublished 15 Aug 2026, 12:58 WIB

CVE-2026-74317

ixgbe: do not configure xps for XDP queues

In the Linux kernel, the following vulnerability has been resolved: ixgbe: do not configure xps for XDP queues netif_set_xps_queue() should not be called for an XDP Tx queue, since such queues are not netdev-exposed. On systems with number of CPUs >=64, on E610 adapter, netdev is configured with maximum number queue …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-15T05:58:14.832Z. Updated 2026-10-21T12:45:20.279Z.

CVSS7.8v3.1KEVNot listedEPSSPresentUpdated21 Oct 2026, 19:45 WIB

Official record

HighPublished 15 Aug 2026, 12:58 WIB

CVE-2026-74316

NFSD: Handle layout stid in nfsd4_drop_revoked_stid()

In the Linux kernel, the following vulnerability has been resolved: NFSD: Handle layout stid in nfsd4_drop_revoked_stid() nfsd4_drop_revoked_stid() has no SC_TYPE_LAYOUT case, so when a client sends FREE_STATEID for an admin-revoked layout stid, the default branch releases cl_lock and returns without unhashing or rel…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-15T05:58:14.165Z. Updated 2026-10-16T18:55:32.624Z.

CVSS7.5v3.1KEVNot listedEPSSPresentUpdated17 Oct 2026, 01:55 WIB

Official record

CritPublished 15 Aug 2026, 12:58 WIB

CVE-2026-74315

lockd: Avoid hashing uninitialized bytes in nlm4svc_lookup_file()

In the Linux kernel, the following vulnerability has been resolved: lockd: Avoid hashing uninitialized bytes in nlm4svc_lookup_file() file_hash() digests the first LOCKD_FH_HASH_SIZE bytes of nfs_fh.data when bucketing nlm_files[], independent of fh.size. Commit 3de744ee4e45 ("lockd: Use xdrgen XDR functions for the …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-15T05:58:13.504Z. Updated 2026-08-17T05:45:48.282Z.

CVSS9.8v3.1KEVNot listedEPSSPresentUpdated17 Aug 2026, 12:45 WIB

Official record

HighPublished 15 Aug 2026, 12:58 WIB

CVE-2026-74314

bpf: Cancel special fields on map value recycle

In the Linux kernel, the following vulnerability has been resolved: bpf: Cancel special fields on map value recycle Map update and delete paths currently call bpf_obj_free_fields() when a value is being replaced or recycled. That makes field destruction depend on the context of the update/delete operation. For tracin…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-15T05:58:12.766Z. Updated 2026-10-16T18:55:32.490Z.

CVSS7.8v3.1KEVNot listedEPSSPresentUpdated17 Oct 2026, 01:55 WIB

Official record

HighPublished 15 Aug 2026, 12:58 WIB

CVE-2026-74313

vduse: hold vduse_lock across IDR lookup in open path

In the Linux kernel, the following vulnerability has been resolved: vduse: hold vduse_lock across IDR lookup in open path vduse_dev_open() looks up struct vduse_dev through the IDR and then acquires dev->lock only after vduse_lock has been dropped. This leaves a window where a concurrent VDUSE_DESTROY_DEV can remove…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-15T05:58:12.058Z. Updated 2026-10-16T18:55:32.347Z.

CVSS8.8v3.1KEVNot listedEPSSPresentUpdated17 Oct 2026, 01:55 WIB

Official record

HighPublished 15 Aug 2026, 12:58 WIB

CVE-2026-74312

vhost/vdpa: validate virtqueue index in mmap and fault paths

In the Linux kernel, the following vulnerability has been resolved: vhost/vdpa: validate virtqueue index in mmap and fault paths vhost_vdpa_mmap() and vhost_vdpa_fault() use vma->vm_pgoff as a virtqueue index for get_vq_notification(), but they do not validate that the index is smaller than v->nvqs. The ioctl path a…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-15T05:58:11.395Z. Updated 2026-10-16T18:55:32.188Z.

CVSS7.8v3.1KEVNot listedEPSSPresentUpdated17 Oct 2026, 01:55 WIB

Official record

HighPublished 15 Aug 2026, 12:58 WIB

CVE-2026-74311

virtio: rtc: tear down old virtqueues before restore

In the Linux kernel, the following vulnerability has been resolved: virtio: rtc: tear down old virtqueues before restore virtio_device_restore() resets the device and restores the negotiated features before calling ->restore(). viortc_freeze() intentionally leaves the existing virtqueues in place so the alarm queue c…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-15T05:58:10.711Z. Updated 2026-08-17T05:45:43.827Z.

CVSS7.8v3.1KEVNot listedEPSSPresentUpdated17 Aug 2026, 12:45 WIB

Official record

CritPublished 15 Aug 2026, 12:58 WIB

CVE-2026-74310

vhost/net: complete zerocopy ubufs only once

In the Linux kernel, the following vulnerability has been resolved: vhost/net: complete zerocopy ubufs only once vhost-net initializes one ubuf_info per outstanding zerocopy TX descriptor and hands it to the backend socket. The networking stack may then clone a zerocopy skb before all skb references are released. F…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-15T05:58:10.043Z. Updated 2026-10-16T18:55:32.036Z.

CVSS9.3v3.1KEVNot listedEPSSPresentUpdated17 Oct 2026, 01:55 WIB

Official record

CritPublished 15 Aug 2026, 12:58 WIB

CVE-2026-74309

vdpa/octeon_ep: fix IRQ-to-ring mapping in interrupt handler

In the Linux kernel, the following vulnerability has been resolved: vdpa/octeon_ep: fix IRQ-to-ring mapping in interrupt handler Look up the IRQ index in oct_hw->irqs instead of assuming irq - irqs[0]. This supports non-contiguous IRQ numbers and avoids incorrect ring indexing when irqs[0] is not the base.

Excerpt language: en.

Severity critical: primary CNA CVSS 10 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-15T05:58:09.366Z. Updated 2026-08-17T05:45:41.596Z.

CVSS10v3.1KEVNot listedEPSSPresentUpdated17 Aug 2026, 12:45 WIB

Official record

UnscoredPublished 15 Aug 2026, 12:58 WIB

CVE-2026-74308

ext4: fix kernel BUG in ext4_write_inline_data_end

In the Linux kernel, the following vulnerability has been resolved: ext4: fix kernel BUG in ext4_write_inline_data_end When the data=journal mount option is used, the ext4_journalled_write_end() function incorrectly calls ext4_write_inline_data_end() without checking if the EXT4_STATE_MAY_INLINE_DATA flag is still se…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-15T05:58:08.682Z. Updated 2026-08-17T05:16:57.145Z.

CVSS—KEVNot listedEPSSPresentUpdated17 Aug 2026, 12:16 WIB

Official record

UnscoredPublished 15 Aug 2026, 12:58 WIB

CVE-2026-74307

ext4: validate donor file superblock early in EXT4_IOC_MOVE_EXT

In the Linux kernel, the following vulnerability has been resolved: ext4: validate donor file superblock early in EXT4_IOC_MOVE_EXT Reject the EXT4_IOC_MOVE_EXT ioctl early if the donor file does not belong to the same superblock as the original file. Currently, this validation is performed inside ext4_move_extents(…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-15T05:58:07.969Z. Updated 2026-10-21T12:45:19.203Z.

CVSS—KEVNot listedEPSSPresentUpdated21 Oct 2026, 19:45 WIB

Official record

HighPublished 15 Aug 2026, 12:58 WIB

CVE-2026-74306

vfio/qat: fix f_pos race in qat_vf_resume_write()

In the Linux kernel, the following vulnerability has been resolved: vfio/qat: fix f_pos race in qat_vf_resume_write() qat_vf_resume_write() checks filp->f_pos before taking migf->lock, but copies into the migration-state buffer after taking the lock and re-reading the shared file position. Two concurrent writers cou…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-15T05:58:07.313Z. Updated 2026-08-17T05:45:40.501Z.

CVSS7.8v3.1KEVNot listedEPSSPresentUpdated17 Aug 2026, 12:45 WIB

Official record

HighPublished 15 Aug 2026, 12:58 WIB

CVE-2026-74305

bpf: Tighten cgroup storage cookie checks for prog arrays

In the Linux kernel, the following vulnerability has been resolved: bpf: Tighten cgroup storage cookie checks for prog arrays The fix in commit abad3d0bad72 ("bpf: Fix oob access in cgroup local storage") is still incomplete. The prog-array compatibility check treats a program with no cgroup storage as compatible wit…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-15T05:58:06.654Z. Updated 2026-10-16T18:55:31.883Z.

CVSS7.8v3.1KEVNot listedEPSSPresentUpdated17 Oct 2026, 01:55 WIB

Official record

UnscoredPublished 15 Aug 2026, 12:58 WIB

CVE-2026-74304

Bluetooth: hci_qca: fix NULL pointer dereference in qca_setup() for non-serdev device

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_qca: fix NULL pointer dereference in qca_setup() for non-serdev device hu->serdev is NULL for hci_uart attached via non-serdev paths, but qca_setup() unconditionally calls serdev_device_get_drvdata(hu->serdev) and dereferences the resu…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-15T05:58:05.981Z. Updated 2026-09-25T14:44:24.813Z.

CVSS—KEVNot listedEPSSPresentUpdated25 Sep 2026, 21:44 WIB

Official record

UnscoredPublished 15 Aug 2026, 12:58 WIB

CVE-2026-74303

Bluetooth: hci_qca: fix NULL pointer dereference in qca_dmp_hdr() for non-serdev device

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_qca: fix NULL pointer dereference in qca_dmp_hdr() for non-serdev device hu->serdev is NULL for hci_uart attached via non-serdev paths, but qca_dmp_hdr() unconditionally dereferences hu->serdev->dev.driver->name, causing a NULL pointer…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-15T05:58:05.321Z. Updated 2026-08-17T05:16:50.701Z.

CVSS—KEVNot listedEPSSPresentUpdated17 Aug 2026, 12:16 WIB

Official record

HighPublished 15 Aug 2026, 12:58 WIB

CVE-2026-74302

Bluetooth: hci_core: Fix UAF in hci_unregister_dev()

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_core: Fix UAF in hci_unregister_dev() hci_unregister_dev() does not disable cmd_timer and ncmd_timer before the hci_dev structure is freed. If a timeout fires during device teardown, the callback dereferences freed memory (including th…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-15T05:58:04.638Z. Updated 2026-10-21T12:45:17.382Z.

CVSS7.8v3.1KEVNot listedEPSSPresentUpdated21 Oct 2026, 19:45 WIB

Official record