Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 6,933 published records · 23 KEV · 6,933 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

6,933 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit5588.0%
High2,11831%
Med2,24432%
Low2403.5%
None90.13%
Legacy00.00%
Unscored1,76425%

Matching records by UTC month

May 266,933

Signal coverage

KEV-listed: 23
With a forecast: 6,933
Unknown date: 0
Unscored severity: 1,764

Share of cohort: KEV 0.33% · forecast 100% · unscored 25%.

Showing 741–760 of 6,933By severity band: Critical · 9.0–10.0 558, High · 7.0–8.9 2,118, Medium · 4.0–6.9 2,244, Low · 0.1–3.9 240, None · scored 0.0 9, Legacy · v2 only 0, Unscored · no CNA metric 1,764

UnscoredPublished 28 May 2026, 16:36 WIB

CVE-2026-46186

Bluetooth: virtio_bt: validate rx pkt_type header length

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: virtio_bt: validate rx pkt_type header length virtbt_rx_handle() reads the leading pkt_type byte from the RX skb and forwards the remainder to hci_recv_frame() for every event/ACL/SCO/ISO type, without checking that the remaining payload i…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-05-28T09:36:40.349Z. Updated 2026-06-14T18:01:09.675Z.

CVSS—KEVNot listedEPSSPresentUpdated15 Jun 2026, 01:01 WIB

Official record

CritPublished 28 May 2026, 16:36 WIB

CVE-2026-46185

smb/client: fix out-of-bounds read in symlink_data()

In the Linux kernel, the following vulnerability has been resolved: smb/client: fix out-of-bounds read in symlink_data() Since smb2_check_message() returns success without length validation for the symlink error response, in symlink_data() it is possible for iov->iov_len to be smaller than sizeof(struct smb2_err_rsp)…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Showing 741 to 760 of 6933.First page Next page

Published 2026-05-28T09:36:39.318Z. Updated 2026-10-19T19:36:54.280Z.

CVSS9.1v3.1KEVNot listedEPSSPresentUpdated20 Oct 2026, 02:36 WIB

Official record

UnscoredPublished 28 May 2026, 16:36 WIB

CVE-2026-46184

sound: ua101: fix division by zero at probe

In the Linux kernel, the following vulnerability has been resolved: sound: ua101: fix division by zero at probe Add a missing sanity check for bNrChannels in detect_usb_format() to prevent a division by zero in playback_urb_complete() and capture_urb_complete(). USB core does not validate class-specific descriptor f…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-05-28T09:36:38.134Z. Updated 2026-06-14T18:00:59.666Z.

CVSS—KEVNot listedEPSSPresentUpdated15 Jun 2026, 01:00 WIB

Official record

UnscoredPublished 28 May 2026, 16:36 WIB

CVE-2026-46183

mm/damon/sysfs-schemes: protect path kfree() with damon_sysfs_lock

In the Linux kernel, the following vulnerability has been resolved: mm/damon/sysfs-schemes: protect path kfree() with damon_sysfs_lock damon_sysfs_quot_goal->path can be read and written by users, via DAMON sysfs 'path' file. It can also be indirectly read, for the parameters {on,off}line committing to DAMON. The r…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-05-28T09:36:36.582Z. Updated 2026-06-14T18:00:54.954Z.

CVSS—KEVNot listedEPSSPresentUpdated15 Jun 2026, 01:00 WIB

Official record

UnscoredPublished 28 May 2026, 16:36 WIB

CVE-2026-46182

pseries/papr-hvpipe: Prevent kernel stack memory leak to userspace

In the Linux kernel, the following vulnerability has been resolved: pseries/papr-hvpipe: Prevent kernel stack memory leak to userspace The hdr variable is allocated on the stack and only hdr.version and hdr.flags are initialized explicitly. Because the struct papr_hvpipe_hdr contains reserved padding bytes (reserved[…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-05-28T09:36:35.528Z. Updated 2026-06-14T18:00:50.449Z.

CVSS—KEVNot listedEPSSPresentUpdated15 Jun 2026, 01:00 WIB

Official record

HighPublished 28 May 2026, 16:36 WIB

CVE-2026-46181

RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event()

In the Linux kernel, the following vulnerability has been resolved: RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() Sashiko points out the radix_tree itself is RCU safe, but nothing ever frees the mlx4_srq struct with RCU, and it isn't even accessed within the RCU critical section. It also will crash if an event is…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-05-28T09:36:34.706Z. Updated 2026-10-21T12:41:24.847Z.

CVSS7.8v3.1KEVNot listedEPSSPresentUpdated21 Oct 2026, 19:41 WIB

Official record

UnscoredPublished 28 May 2026, 16:36 WIB

CVE-2026-46180

wifi: brcmfmac: Fix potential use-after-free issue when stopping watchdog task

In the Linux kernel, the following vulnerability has been resolved: wifi: brcmfmac: Fix potential use-after-free issue when stopping watchdog task Watchdog task might end between send_sig() and kthread_stop() calls, what results in the use-after-free issue. Fix this by increasing watchdog task reference count before …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-05-28T09:36:33.904Z. Updated 2026-10-15T01:21:08.231Z.

CVSS—KEVNot listedEPSSPresentUpdated15 Oct 2026, 08:21 WIB

Official record

UnscoredPublished 28 May 2026, 16:36 WIB

CVE-2026-46179

ASoC: SOF: Don't allow pointer operations on unconfigured streams

In the Linux kernel, the following vulnerability has been resolved: ASoC: SOF: Don't allow pointer operations on unconfigured streams When reporting the pointer for a compressed stream we report the current I/O frame position by dividing the position by the number of channels multiplied by the number of container byt…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-05-28T09:36:33.062Z. Updated 2026-06-14T18:00:36.371Z.

CVSS—KEVNot listedEPSSPresentUpdated15 Jun 2026, 01:00 WIB

Official record

HighPublished 28 May 2026, 16:36 WIB

CVE-2026-46178

RDMA/mlx4: Fix resource leak on error in mlx4_ib_create_srq()

In the Linux kernel, the following vulnerability has been resolved: RDMA/mlx4: Fix resource leak on error in mlx4_ib_create_srq() Sashiko points out that mlx4_srq_alloc() was not undone during error unwind, add the missing call to mlx4_srq_free().

Excerpt language: en.

Severity high: primary CNA CVSS 7.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-05-28T09:36:32.222Z. Updated 2026-10-19T19:36:53.902Z.

CVSS7.8v3.1KEVNot listedEPSSPresentUpdated20 Oct 2026, 02:36 WIB

Official record

HighPublished 28 May 2026, 16:36 WIB

CVE-2026-46177

ipmi: Add limits to event and receive message requests

In the Linux kernel, the following vulnerability has been resolved: ipmi: Add limits to event and receive message requests The driver would just fetch events and receive messages until the BMC said it was done. To avoid issues with BMCs that never say they are done, add a limit of 10 fetches at a time. In addition,…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-05-28T09:36:31.286Z. Updated 2026-10-15T01:21:07.039Z.

CVSS7.5v3.1KEVNot listedEPSSPresentUpdated15 Oct 2026, 08:21 WIB

Official record

HighPublished 28 May 2026, 16:36 WIB

CVE-2026-46176

RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init()

In the Linux kernel, the following vulnerability has been resolved: RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() mlx5_ib_dev_res_srq_init() allocates two SRQs, s0 and s1. When ib_create_srq() fails for s1, the error branch destroys s0 but falls through and unconditionally assigns the freed s0 …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-05-28T09:36:30.398Z. Updated 2026-10-19T19:36:53.745Z.

CVSS7.8v3.1KEVNot listedEPSSPresentUpdated20 Oct 2026, 02:36 WIB

Official record

HighPublished 28 May 2026, 16:36 WIB

CVE-2026-46175

f2fs: fix fsck inconsistency caused by FGGC of node block

In the Linux kernel, the following vulnerability has been resolved: f2fs: fix fsck inconsistency caused by FGGC of node block During FGGC node block migration, fsck may incorrectly treat the migrated node block as fsync-written data. The reproduction scenario: root@vm:/mnt/f2fs# seq 1 2048 | xargs -n 1 ./test_sync /…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-05-28T09:36:29.522Z. Updated 2026-10-21T12:41:23.769Z.

CVSS7.1v3.1KEVNot listedEPSSPresentUpdated21 Oct 2026, 19:41 WIB

Official record

HighPublished 28 May 2026, 16:36 WIB

CVE-2026-46174

x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache

In the Linux kernel, the following vulnerability has been resolved: x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache Make sure resources are not improperly shared in the op cache and cause instruction corruption this way.

Excerpt language: en.

Severity high: primary CNA CVSS 8.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-05-28T09:36:28.703Z. Updated 2026-10-19T19:36:53.596Z.

CVSS8.8v3.1KEVNot listedEPSSPresentUpdated20 Oct 2026, 02:36 WIB

Official record

HighPublished 28 May 2026, 16:36 WIB

CVE-2026-46173

exit: prevent preemption of oopsing TASK_DEAD task

In the Linux kernel, the following vulnerability has been resolved: exit: prevent preemption of oopsing TASK_DEAD task When an already-exiting task oopses, make_task_dead() currently calls do_task_dead() with preemption enabled. That is forbidden: do_task_dead() calls __schedule(), which has a comment saying "WARNIN…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-05-28T09:36:27.892Z. Updated 2026-10-19T19:36:53.446Z.

CVSS7.8v3.1KEVNot listedEPSSPresentUpdated20 Oct 2026, 02:36 WIB

Official record

UnscoredPublished 28 May 2026, 16:36 WIB

CVE-2026-46172

ipv6: xfrm6: release dst on error in xfrm6_rcv_encap()

In the Linux kernel, the following vulnerability has been resolved: ipv6: xfrm6: release dst on error in xfrm6_rcv_encap() xfrm6_rcv_encap() performs an IPv6 route lookup when the skb does not already have a dst attached. ip6_route_input_lookup() returns a referenced dst entry even when the lookup resolves to an erro…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-05-28T09:36:26.926Z. Updated 2026-10-15T01:21:02.038Z.

CVSS—KEVNot listedEPSSPresentUpdated15 Oct 2026, 08:21 WIB

Official record

UnscoredPublished 28 May 2026, 16:36 WIB

CVE-2026-46171

riscv: kvm: fix vector context allocation leak

In the Linux kernel, the following vulnerability has been resolved: riscv: kvm: fix vector context allocation leak When the second kzalloc (host_context.vector.datap) fails in kvm_riscv_vcpu_alloc_vector_context, the first allocation (guest_context.vector.datap) is leaked. Free it before returning.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-05-28T09:36:25.966Z. Updated 2026-10-21T12:41:22.651Z.

CVSS—KEVNot listedEPSSPresentUpdated21 Oct 2026, 19:41 WIB

Official record

UnscoredPublished 28 May 2026, 16:36 WIB

CVE-2026-46170

mptcp: pm: ADD_ADDR rtx: free sk if last

In the Linux kernel, the following vulnerability has been resolved: mptcp: pm: ADD_ADDR rtx: free sk if last When an ADD_ADDR is retransmitted, the sk is held in sk_reset_timer(), and released at the end. If at that moment, it was the last reference being held, the sk would not be freed. sock_put() should then be ca…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-05-28T09:36:25.184Z. Updated 2026-09-14T11:58:24.772Z.

CVSS—KEVNot listedEPSSPresentUpdated14 Sep 2026, 18:58 WIB

Official record

UnscoredPublished 28 May 2026, 16:36 WIB

CVE-2026-46169

hfsplus: fix uninit-value by validating catalog record size

In the Linux kernel, the following vulnerability has been resolved: hfsplus: fix uninit-value by validating catalog record size Syzbot reported a KMSAN uninit-value issue in hfsplus_strcasecmp(). The root cause is that hfs_brec_read() doesn't validate that the on-disk record size matches the expected size for the rec…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-05-28T09:36:24.361Z. Updated 2026-06-19T11:59:47.129Z.

CVSS—KEVNot listedEPSSPresentUpdated19 Jun 2026, 18:59 WIB

Official record

UnscoredPublished 28 May 2026, 16:36 WIB

CVE-2026-46168

mptcp: fix scheduling with atomic in timestamp sockopt

In the Linux kernel, the following vulnerability has been resolved: mptcp: fix scheduling with atomic in timestamp sockopt Using lock_sock_fast() (atomic context) around sock_set_timestamp() and sock_set_timestamping() is unsafe, as both helpers can sleep. Replace lock_sock_fast() with sleepable lock_sock()/release_…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-05-28T09:36:23.394Z. Updated 2026-10-15T01:21:00.385Z.

CVSS—KEVNot listedEPSSPresentUpdated15 Oct 2026, 08:21 WIB

Official record

UnscoredPublished 28 May 2026, 16:36 WIB

CVE-2026-46167

usb: usblp: fix uninitialized heap leak via LPGETSTATUS ioctl

In the Linux kernel, the following vulnerability has been resolved: usb: usblp: fix uninitialized heap leak via LPGETSTATUS ioctl Just like in a previous problem in this driver, usblp_ctrl_msg() will collapse the usb_control_msg() return value to 0/-errno, discarding the actual number of bytes transferred. Ideally t…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-05-28T09:36:22.434Z. Updated 2026-10-15T01:20:59.172Z.

CVSS—KEVNot listedEPSSPresentUpdated15 Oct 2026, 08:20 WIB

Official record