Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 16,156 published records · 20 KEV · 16,156 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

16,156 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit1,2247.6%
High5,34833%
Med5,51434%
Low5143.2%
None00.00%
Legacy00.00%
Unscored3,55622%

Matching records by UTC month

Oct 2616,156

Signal coverage

KEV-listed: 20
With a forecast: 16,156
Unknown date: 0
Unscored severity: 3,556

Share of cohort: KEV 0.12% · forecast 100% · unscored 22%.

Showing 741–760 of 16,156By severity band: Critical · 9.0–10.0 1,224, High · 7.0–8.9 5,348, Medium · 4.0–6.9 5,514, Low · 0.1–3.9 514, None · scored 0.0 0, Legacy · v2 only 0, Unscored · no CNA metric 3,556

UnscoredPublished 28 Oct 2026, 17:35 WIB

CVE-2026-99204

ocfs2/dlm: Protect the recovery list during debugfs reads

In the Linux kernel, the following vulnerability has been resolved: ocfs2/dlm: Protect the recovery list during debugfs reads Recovery participant records must remain alive while debug_state_print() walks reco.node_data and formats their fields. The formatter holds dlm->spinlock, but the recovery participant list is …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-28T10:35:58.336Z. Updated 2026-10-28T10:35:58.336Z.

CVSS—KEVNot listedEPSSPresentUpdated28 Oct 2026, 17:35 WIB

Official record

UnscoredPublished 28 Oct 2026, 17:35 WIB

CVE-2026-99203

pipe: preserve existing fasync readers on writer setup failure

In the Linux kernel, the following vulnerability has been resolved: pipe: preserve existing fasync readers on writer setup failure F_SETFL and FIOASYNC decide whether to invoke ->fasync() before pipe_fasync() takes pipe->mutex. Two enables of one O_RDWR FIFO can therefore both enter the callback. fasync_helper() all…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Showing 741 to 760 of 16156.First page Next page

Published 2026-10-28T10:35:57.589Z. Updated 2026-10-28T10:35:57.589Z.

CVSS—KEVNot listedEPSSPresentUpdated28 Oct 2026, 17:35 WIB

Official record

UnscoredPublished 28 Oct 2026, 17:35 WIB

CVE-2026-99202

scsi: libsas: Fix SMP IO deadlock during HA resume

In the Linux kernel, the following vulnerability has been resolved: scsi: libsas: Fix SMP IO deadlock during HA resume smp_execute_task_sg() calls pm_runtime_get_sync() on the host before issuing an SMP command. When that command is itself issued from the HA resume path, the get_sync() deadlocks: it waits for the ong…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-28T10:35:56.827Z. Updated 2026-10-28T10:35:56.827Z.

CVSS—KEVNot listedEPSSPresentUpdated28 Oct 2026, 17:35 WIB

Official record

UnscoredPublished 28 Oct 2026, 17:35 WIB

CVE-2026-99201

netlink: avoid hashing the network namespace pointer

In the Linux kernel, the following vulnerability has been resolved: netlink: avoid hashing the network namespace pointer The netlink rhashtable key includes a raw struct net pointer and a user-controlled port ID. Both /proc/net/netlink and socket diagnostics expose the table's bucket order. By binding and rebinding c…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-28T10:35:56.069Z. Updated 2026-10-28T10:35:56.069Z.

CVSS—KEVNot listedEPSSPresentUpdated28 Oct 2026, 17:35 WIB

Official record

UnscoredPublished 28 Oct 2026, 17:35 WIB

CVE-2026-99200

net: hisilicon: hisi_femac: Move setting of netops to fix crash

In the Linux kernel, the following vulnerability has been resolved: net: hisilicon: hisi_femac: Move setting of netops to fix crash hisi_femac_drv_probe() connects the PHY before dev->netdev_ops is assigned. phy_attach_direct() -> phy_link_topo_add_phy() reads dev->netdev_ops through netdev_need_ops_lock() since the …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-28T10:35:55.323Z. Updated 2026-10-28T10:35:55.323Z.

CVSS—KEVNot listedEPSSPresentUpdated28 Oct 2026, 17:35 WIB

Official record

UnscoredPublished 28 Oct 2026, 17:35 WIB

CVE-2026-99199

net: hisilicon: hip04_eth: Move setting of netops to fix crash

In the Linux kernel, the following vulnerability has been resolved: net: hisilicon: hip04_eth: Move setting of netops to fix crash hip04_mac_probe() calls of_phy_connect() before ndev->netdev_ops is assigned. phy_attach_direct() -> phy_link_topo_add_phy() reads dev->netdev_ops through netdev_need_ops_lock() since the…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-28T10:35:54.538Z. Updated 2026-10-28T10:35:54.538Z.

CVSS—KEVNot listedEPSSPresentUpdated28 Oct 2026, 17:35 WIB

Official record

UnscoredPublished 28 Oct 2026, 17:35 WIB

CVE-2026-99198

net: ethernet: actions: Move setting of netops to fix crash

In the Linux kernel, the following vulnerability has been resolved: net: ethernet: actions: Move setting of netops to fix crash owl_emac_probe() calls owl_emac_phy_init(), which connects the PHY, before netdev->netdev_ops is assigned. phy_attach_direct() -> phy_link_topo_add_phy() reads dev->netdev_ops through netdev…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-28T10:35:53.740Z. Updated 2026-10-28T10:35:53.740Z.

CVSS—KEVNot listedEPSSPresentUpdated28 Oct 2026, 17:35 WIB

Official record

UnscoredPublished 28 Oct 2026, 17:35 WIB

CVE-2026-99197

net: mv643xx: move setting of netops to fix crash

In the Linux kernel, the following vulnerability has been resolved: net: mv643xx: move setting of netops to fix crash mv643xx_eth_probe() connects the PHY before dev->netdev_ops is assigned. phy_attach_direct() -> phy_link_topo_add_phy() reads dev->netdev_ops through netdev_need_ops_lock() since the commit in questio…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-28T10:35:52.987Z. Updated 2026-10-28T10:35:52.987Z.

CVSS—KEVNot listedEPSSPresentUpdated28 Oct 2026, 17:35 WIB

Official record

UnscoredPublished 28 Oct 2026, 17:35 WIB

CVE-2026-99196

net: au1000: move setting of netops to fix crash

In the Linux kernel, the following vulnerability has been resolved: net: au1000: move setting of netops to fix crash au1000_probe() calls au1000_mii_probe(), which connects the PHY, before dev->netdev_ops is assigned. phy_attach_direct() -> phy_link_topo_add_phy() reads dev->netdev_ops through netdev_need_ops_lock() …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-28T10:35:52.223Z. Updated 2026-10-28T10:35:52.223Z.

CVSS—KEVNot listedEPSSPresentUpdated28 Oct 2026, 17:35 WIB

Official record

UnscoredPublished 28 Oct 2026, 17:35 WIB

CVE-2026-99195

net: ethoc: move setting of netops to fix crash

In the Linux kernel, the following vulnerability has been resolved: net: ethoc: move setting of netops to fix crash ethoc_probe() calls ethoc_mdio_probe(), which connects the PHY, before netdev->netdev_ops is assigned. phy_attach_direct() -> phy_link_topo_add_phy() reads dev->netdev_ops through netdev_need_ops_lock()…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-28T10:35:51.485Z. Updated 2026-10-28T10:35:51.485Z.

CVSS—KEVNot listedEPSSPresentUpdated28 Oct 2026, 17:35 WIB

Official record

UnscoredPublished 28 Oct 2026, 17:35 WIB

CVE-2026-99194

net: ethernet: aeroflex: move setting of netops to fix crash

In the Linux kernel, the following vulnerability has been resolved: net: ethernet: aeroflex: move setting of netops to fix crash greth_of_probe() calls greth_mdio_init(), which connects the PHY, before dev->netdev_ops is assigned. phy_attach_direct() -> phy_link_topo_add_phy() reads dev->netdev_ops through netdev_nee…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-28T10:35:50.670Z. Updated 2026-10-28T10:35:50.670Z.

CVSS—KEVNot listedEPSSPresentUpdated28 Oct 2026, 17:35 WIB

Official record

UnscoredPublished 28 Oct 2026, 17:35 WIB

CVE-2026-99193

net: ti: icssm-prueth: Move setting of netops to fix crash

In the Linux kernel, the following vulnerability has been resolved: net: ti: icssm-prueth: Move setting of netops to fix crash icssm_prueth_netdev_init() calls of_phy_get_and_connect() before ndev->netdev_ops is assigned. phy_attach_direct() -> phy_link_topo_add_phy() reads dev->netdev_ops through netdev_need_ops_loc…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-28T10:35:49.441Z. Updated 2026-10-28T10:35:49.441Z.

CVSS—KEVNot listedEPSSPresentUpdated28 Oct 2026, 17:35 WIB

Official record

UnscoredPublished 28 Oct 2026, 17:35 WIB

CVE-2026-99192

net: bcmgenet: unshare the skb before writing the control block

In the Linux kernel, the following vulnerability has been resolved: net: bcmgenet: unshare the skb before writing the control block bcmgenet stores first_cb, last_cb and bytes_sent in the skb control block and reads them back on completion to free the skb and credit BQL. ether_setup() leaves IFF_TX_SKB_SHARING set, s…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-28T10:35:48.686Z. Updated 2026-10-28T10:35:48.686Z.

CVSS—KEVNot listedEPSSPresentUpdated28 Oct 2026, 17:35 WIB

Official record

UnscoredPublished 28 Oct 2026, 17:35 WIB

CVE-2026-99191

calipso: keep BIG TCP payload_len in calipso_skbuff_setattr()

In the Linux kernel, the following vulnerability has been resolved: calipso: keep BIG TCP payload_len in calipso_skbuff_setattr() calipso_skbuff_setattr() adjusts payload_len by the length of the option it inserts or resizes: payload = ntohs(ip6_hdr->payload_len); ip6_hdr->payload_len = htons(payload + len_delta);…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-28T10:35:47.854Z. Updated 2026-10-28T10:35:47.854Z.

CVSS—KEVNot listedEPSSPresentUpdated28 Oct 2026, 17:35 WIB

Official record

UnscoredPublished 28 Oct 2026, 17:35 WIB

CVE-2026-99190

gpiolib: fix memory leak in gpiod_set_array_value_complex() on error paths

In the Linux kernel, the following vulnerability has been resolved: gpiolib: fix memory leak in gpiod_set_array_value_complex() on error paths A drive-by review by Sashiko reports that, after a failed call to gpiochip_set_multiple(), gpiod_set_array_value() returns abruptly, bypassing the freeing of possibly alloced …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-28T10:35:47.107Z. Updated 2026-10-28T10:35:47.107Z.

CVSS—KEVNot listedEPSSPresentUpdated28 Oct 2026, 17:35 WIB

Official record

UnscoredPublished 28 Oct 2026, 17:35 WIB

CVE-2026-99189

gpio: mxc: fix race between chained IRQ handler install and probe completion

In the Linux kernel, the following vulnerability has been resolved: gpio: mxc: fix race between chained IRQ handler install and probe completion mxc_update_irq_chained_handler() is called before the IRQ domain, the generic IRQ chip, and the port list entry are set up. If an interrupt arrives in that window: - mx3_g…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-28T10:35:46.366Z. Updated 2026-10-28T10:35:46.366Z.

CVSS—KEVNot listedEPSSPresentUpdated28 Oct 2026, 17:35 WIB

Official record

UnscoredPublished 28 Oct 2026, 17:35 WIB

CVE-2026-99188

net: stmmac: dwmac1000: clear the RGMII status interrupt

In the Linux kernel, the following vulnerability has been resolved: net: stmmac: dwmac1000: clear the RGMII status interrupt Since commit 2e2c878a3141 ("net: stmmac: remove SGMII/RGMII/SMII interrupt handling") nothing on the RGMII path reads GMAC_RGSMIIIS, so RGSMIIIS stays pending behind GMAC_INT_MASK from the firs…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-28T10:35:45.591Z. Updated 2026-10-28T10:35:45.591Z.

CVSS—KEVNot listedEPSSPresentUpdated28 Oct 2026, 17:35 WIB

Official record

UnscoredPublished 28 Oct 2026, 17:35 WIB

CVE-2026-99187

perf: Fix perf_pmu_migrate_context() leaving events behind

In the Linux kernel, the following vulnerability has been resolved: perf: Fix perf_pmu_migrate_context() leaving events behind __perf_pmu_remove() walks the group leaders of a CPU and PMU with perf_event_groups_for_cpu_pmu(), removing each one as it goes. perf_remove_from_context() takes the leader out of the groups …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-28T10:35:44.813Z. Updated 2026-10-28T10:35:44.813Z.

CVSS—KEVNot listedEPSSPresentUpdated28 Oct 2026, 17:35 WIB

Official record

UnscoredPublished 28 Oct 2026, 17:35 WIB

CVE-2026-99186

x86/insn-eval: Fix shadowed segment index in get_seg_reg_override_idx()

In the Linux kernel, the following vulnerability has been resolved: x86/insn-eval: Fix shadowed segment index in get_seg_reg_override_idx() Commit 45e1dccc0653 ("x86/insn: Simplify for_each_insn_prefix()") made for_each_insn_prefix() declare its own loop counter named idx. get_seg_reg_override_idx() keeps its result …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-28T10:35:44.049Z. Updated 2026-10-28T10:35:44.049Z.

CVSS—KEVNot listedEPSSPresentUpdated28 Oct 2026, 17:35 WIB

Official record

UnscoredPublished 28 Oct 2026, 17:35 WIB

CVE-2026-99185

firewire: core: fix race condition in split transaction handling

In the Linux kernel, the following vulnerability has been resolved: firewire: core: fix race condition in split transaction handling For a split transaction, either fw_core_handle_response() or split_transaction_timeout_callback() may manipulate the same transaction entry in the pending transaction list. The return v…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-28T10:35:43.282Z. Updated 2026-10-28T10:35:43.282Z.

CVSS—KEVNot listedEPSSPresentUpdated28 Oct 2026, 17:35 WIB

Official record