Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 12,259 published records · 20 KEV · 12,259 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

12,259 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit1,45512%
High4,59737%
Med3,35727%
Low3142.6%
None50.04%
Legacy00.00%
Unscored2,53121%

Matching records by UTC month

Aug 2612,259

Signal coverage

KEV-listed: 20
With a forecast: 12,259
Unknown date: 0
Unscored severity: 2,531

Share of cohort: KEV 0.16% · forecast 100% · unscored 21%.

Showing 6861–6880 of 12,259By severity band: Critical · 9.0–10.0 1,455, High · 7.0–8.9 4,597, Medium · 4.0–6.9 3,357, Low · 0.1–3.9 314, None · scored 0.0 5, Legacy · v2 only 0, Unscored · no CNA metric 2,531

UnscoredPublished 15 Aug 2026, 12:57 WIB

CVE-2026-72468

xprtrdma: Initialize re_id before removal registration

In the Linux kernel, the following vulnerability has been resolved: xprtrdma: Initialize re_id before removal registration rpcrdma_create_id() registers ep->re_rn with the rpcrdma ib_client before returning the new rdma_cm_id to rpcrdma_ep_create(). However rpcrdma_ep_create() currently stores that pointer in ep->re_…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-15T05:57:11.171Z. Updated 2026-08-17T05:15:13.672Z.

CVSS—KEVNot listedEPSSPresentUpdated17 Aug 2026, 12:15 WIB

Official record

UnscoredPublished 15 Aug 2026, 12:57 WIB

CVE-2026-72467

xprtrdma: Check frwr_wp_create() during connect

In the Linux kernel, the following vulnerability has been resolved: xprtrdma: Check frwr_wp_create() during connect frwr_wp_create() creates the singleton Memory Region used to encode padding for Write chunks whose payload length is not XDR-aligned. Its failure paths return a negative errno and leave ep->re_write_pad…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Showing 6861 to 6880 of 12259.First page Next page

Published 2026-08-15T05:57:10.499Z. Updated 2026-08-17T05:15:12.570Z.

CVSS—KEVNot listedEPSSPresentUpdated17 Aug 2026, 12:15 WIB

Official record

CritPublished 15 Aug 2026, 12:57 WIB

CVE-2026-72466

xprtrdma: Fix bcall rep leak and unbounded peek

In the Linux kernel, the following vulnerability has been resolved: xprtrdma: Fix bcall rep leak and unbounded peek rpcrdma_is_bcall() decodes a reply's first words to decide whether the frame is a backchannel call. Two issues in that decode path let a short or malformed reply leak the receive buffer and drain the Re…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-15T05:57:09.847Z. Updated 2026-10-16T18:55:25.296Z.

CVSS9.8v3.1KEVNot listedEPSSPresentUpdated17 Oct 2026, 01:55 WIB

Official record

HighPublished 15 Aug 2026, 12:57 WIB

CVE-2026-72465

xprtrdma: Sanitize the reply credit grant after parsing

In the Linux kernel, the following vulnerability has been resolved: xprtrdma: Sanitize the reply credit grant after parsing The out_norqst exit in rpcrdma_reply_handler() branches away before the credit clamp, so a reply that matches no pending request reaches out_post carrying the raw credit value parsed from the wi…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-15T05:57:08.767Z. Updated 2026-08-17T05:44:31.793Z.

CVSS7.5v3.1KEVNot listedEPSSPresentUpdated17 Aug 2026, 12:44 WIB

Official record

HighPublished 15 Aug 2026, 12:57 WIB

CVE-2026-72464

xprtrdma: Repost Receive buffers for malformed replies

In the Linux kernel, the following vulnerability has been resolved: xprtrdma: Repost Receive buffers for malformed replies rpcrdma_wc_receive() decrements the transport's Receive count for every completion before it dispatches a successful Receive to rpcrdma_reply_handler(). The handler must post a replacement Receiv…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-15T05:57:08.080Z. Updated 2026-10-16T18:55:25.140Z.

CVSS7.5v3.1KEVNot listedEPSSPresentUpdated17 Oct 2026, 01:55 WIB

Official record

CritPublished 15 Aug 2026, 12:57 WIB

CVE-2026-72463

xfrm: Fix dev use-after-free in xfrm async resumption

In the Linux kernel, the following vulnerability has been resolved: xfrm: Fix dev use-after-free in xfrm async resumption xfrm async resumption hold skb->dev refcnt until after transport_finish. However, xfrm_rcv_cb may modify skb->dev to tunnel dev without taking device reference, such as vti_rcv_cb. The subsequent …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-15T05:57:07.413Z. Updated 2026-10-21T12:44:58.359Z.

CVSS9.8v3.1KEVNot listedEPSSPresentUpdated21 Oct 2026, 19:44 WIB

Official record

HighPublished 15 Aug 2026, 12:57 WIB

CVE-2026-72462

apparmor: fix race in unix socket mediation when peer_path is used

In the Linux kernel, the following vulnerability has been resolved: apparmor: fix race in unix socket mediation when peer_path is used The holding a reference to the peer_sk is not enough to ensure access to the peer sk path. Accessing the path outside of the state lock allows for a race with unix_release_sock(). Fix…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-15T05:57:06.705Z. Updated 2026-08-17T05:44:28.507Z.

CVSS8.8v3.1KEVNot listedEPSSPresentUpdated17 Aug 2026, 12:44 WIB

Official record

HighPublished 15 Aug 2026, 12:57 WIB

CVE-2026-72461

apparmor: fix refcount leak when updating the sk_ctx

In the Linux kernel, the following vulnerability has been resolved: apparmor: fix refcount leak when updating the sk_ctx Currently update_sk_ctx() transfers the plabel reference, unfortunately it is also unconditionally put in the caller. Ideally we would make the caller conditionally put the reference based on wheth…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-15T05:57:06.042Z. Updated 2026-08-17T05:44:27.397Z.

CVSS7.8v3.1KEVNot listedEPSSPresentUpdated17 Aug 2026, 12:44 WIB

Official record

HighPublished 15 Aug 2026, 12:57 WIB

CVE-2026-72460

apparmor: check label build before no_new_privs test

In the Linux kernel, the following vulnerability has been resolved: apparmor: check label build before no_new_privs test aa_change_profile() builds a replacement label with fn_label_build_in_scope() before the no_new_privs subset check. The build helper can fail and return NULL or an ERR_PTR, but the result was passe…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-15T05:57:05.404Z. Updated 2026-08-17T05:44:26.306Z.

CVSS7.1v3.1KEVNot listedEPSSPresentUpdated17 Aug 2026, 12:44 WIB

Official record

HighPublished 15 Aug 2026, 12:57 WIB

CVE-2026-72459

apparmor: aa_label_alloc use aa_label_free on alloc failure

In the Linux kernel, the following vulnerability has been resolved: apparmor: aa_label_alloc use aa_label_free on alloc failure aa_label_alloc() allocates a secid before allocating or taking the label proxy. If the later proxy step fails, the error path only freed the label memory, leaking any resources initialized b…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-15T05:57:04.794Z. Updated 2026-08-17T05:44:25.217Z.

CVSS7.8v3.1KEVNot listedEPSSPresentUpdated17 Aug 2026, 12:44 WIB

Official record

UnscoredPublished 15 Aug 2026, 12:57 WIB

CVE-2026-72458

apparmor: fix NULL pointer dereference in unpack_pdb

In the Linux kernel, the following vulnerability has been resolved: apparmor: fix NULL pointer dereference in unpack_pdb pdb->dfa could be NULL if unpack_dfa fails, causing a NULL pointer dereference.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-15T05:57:04.179Z. Updated 2026-08-17T05:15:02.544Z.

CVSS—KEVNot listedEPSSPresentUpdated17 Aug 2026, 12:15 WIB

Official record

UnscoredPublished 15 Aug 2026, 12:57 WIB

CVE-2026-72457

apparmor: fail policy unpack on accept2 allocation failure

In the Linux kernel, the following vulnerability has been resolved: apparmor: fail policy unpack on accept2 allocation failure unpack_pdb() may need to allocate a missing ACCEPT2 table for older policy data. If that allocation failed, it set an error message but jumped to the success path, returning a policydb with t…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-15T05:57:03.536Z. Updated 2026-08-17T05:15:01.418Z.

CVSS—KEVNot listedEPSSPresentUpdated17 Aug 2026, 12:15 WIB

Official record

UnscoredPublished 15 Aug 2026, 12:57 WIB

CVE-2026-72456

apparmor: release exe file resources on path failure

In the Linux kernel, the following vulnerability has been resolved: apparmor: release exe file resources on path failure get_current_exe_path() takes both an exe_file reference and a path reference before resolving the path name. If aa_path_name() failed, it returned immediately and leaked both references. Route the…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-15T05:57:02.864Z. Updated 2026-08-17T05:15:00.310Z.

CVSS—KEVNot listedEPSSPresentUpdated17 Aug 2026, 12:15 WIB

Official record

HighPublished 15 Aug 2026, 12:57 WIB

CVE-2026-72455

apparmor: fix uninitialised pointer passed to audit_log_untrustedstring()

In the Linux kernel, the following vulnerability has been resolved: apparmor: fix uninitialised pointer passed to audit_log_untrustedstring() Commit 4a134723f9f1 ("apparmor: move check for aa_null file to cover all cases") intrdouced a small bug, where path_name() may pass a potentially uninitialized *name to aa_audi…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-15T05:57:02.234Z. Updated 2026-08-17T05:44:24.111Z.

CVSS7.1v3.1KEVNot listedEPSSPresentUpdated17 Aug 2026, 12:44 WIB

Official record

HighPublished 15 Aug 2026, 12:57 WIB

CVE-2026-72454

i3c: mipi-i3c-hci: Fix race in i3c_hci_addr_to_dev()

In the Linux kernel, the following vulnerability has been resolved: i3c: mipi-i3c-hci: Fix race in i3c_hci_addr_to_dev() i3c_hci_addr_to_dev() walks bus->devs.i3c, which is protected by bus.lock (rwsem). However, it is invoked from the MIPI I3C HCI IRQ handler, which cannot take bus.lock. This allows concurrent dev…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-15T05:57:01.558Z. Updated 2026-10-15T10:08:44.758Z.

CVSS7.8v3.1KEVNot listedEPSSPresentUpdated15 Oct 2026, 17:08 WIB

Official record

UnscoredPublished 15 Aug 2026, 12:57 WIB

CVE-2026-72453

regcache: Do not overwrite error code when finalizing cache after error

In the Linux kernel, the following vulnerability has been resolved: regcache: Do not overwrite error code when finalizing cache after error During regcache initialization, if an error occurs in the cache_ops->populate callback, and if cache operations include an exit callback, the error code from populate() is overwr…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-15T05:57:00.921Z. Updated 2026-10-26T15:12:58.356Z.

CVSS—KEVNot listedEPSSPresentUpdated26 Oct 2026, 22:12 WIB

Official record

HighPublished 15 Aug 2026, 12:57 WIB

CVE-2026-72452

drm/i915: clear CRTC color blob pointers after dropping refs

In the Linux kernel, the following vulnerability has been resolved: drm/i915: clear CRTC color blob pointers after dropping refs intel_crtc_put_color_blobs() drops the CRTC color blob references, but leaves the corresponding pointers unchanged. This can matter in intel_crtc_prepare_cleared_state(), which frees the o…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-15T05:57:00.234Z. Updated 2026-10-16T18:55:24.968Z.

CVSS7.8v3.1KEVNot listedEPSSPresentUpdated17 Oct 2026, 01:55 WIB

Official record

CritPublished 15 Aug 2026, 12:56 WIB

CVE-2026-72451

xfrm: Fix xfrm state cache insertion race

In the Linux kernel, the following vulnerability has been resolved: xfrm: Fix xfrm state cache insertion race The xfrm input state cache insertion code checks the validity of the state before acquiring the global xfrm_state_lock. Thus it's possible for someone else to kill the state after it passed the validity chec…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-15T05:56:59.561Z. Updated 2026-08-17T05:44:20.831Z.

CVSS9.8v3.1KEVNot listedEPSSPresentUpdated17 Aug 2026, 12:44 WIB

Official record

HighPublished 15 Aug 2026, 12:56 WIB

CVE-2026-72450

xfrm: validate selector family and prefixlen during match

In the Linux kernel, the following vulnerability has been resolved: xfrm: validate selector family and prefixlen during match syzbot reported a shift-out-of-bounds in xfrm_selector_match() due to AF_UNSPEC selector with large prefixlen (e.g. 128) matched against IPv4 flow (when XFRM_STATE_AF_UNSPEC is set). Fix this…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-15T05:56:58.939Z. Updated 2026-10-16T18:55:24.828Z.

CVSS7.8v3.1KEVNot listedEPSSPresentUpdated17 Oct 2026, 01:55 WIB

Official record

HighPublished 15 Aug 2026, 12:56 WIB

CVE-2026-72449

drm/amdkfd: fix list_del corruption in kfd_criu_resume_svm

In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: fix list_del corruption in kfd_criu_resume_svm The cleanup tail of kfd_criu_resume_svm() walks svms->criu_svm_metadata_list and kfree()s each struct criu_svm_metadata without removing it from the list. The list head is left pointing at fr…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-15T05:56:58.313Z. Updated 2026-10-16T18:55:24.681Z.

CVSS7.8v3.1KEVNot listedEPSSPresentUpdated17 Oct 2026, 01:55 WIB

Official record