Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 6,933 published records · 23 KEV · 6,933 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

6,933 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit5588.0%
High2,11831%
Med2,24432%
Low2403.5%
None90.13%
Legacy00.00%
Unscored1,76425%

Matching records by UTC month

May 266,933

Signal coverage

KEV-listed: 23
With a forecast: 6,933
Unknown date: 0
Unscored severity: 1,764

Share of cohort: KEV 0.33% · forecast 100% · unscored 25%.

Showing 761–780 of 6,933By severity band: Critical · 9.0–10.0 558, High · 7.0–8.9 2,118, Medium · 4.0–6.9 2,244, Low · 0.1–3.9 240, None · scored 0.0 9, Legacy · v2 only 0, Unscored · no CNA metric 1,764

HighPublished 28 May 2026, 16:36 WIB

CVE-2026-46166

wifi: mac80211: use safe list iteration in radar detect work

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: use safe list iteration in radar detect work The call to ieee80211_dfs_cac_cancel can cause the iterated chanctx to be freed and removed from the list. Guard against this to avoid a slab-use-after-free error.

Excerpt language: en.

Severity high: primary CNA CVSS 8.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-05-28T09:36:21.675Z. Updated 2026-10-19T19:36:53.276Z.

CVSS8.8v3.1KEVNot listedEPSSPresentUpdated20 Oct 2026, 02:36 WIB

Official record

UnscoredPublished 28 May 2026, 16:36 WIB

CVE-2026-46165

openvswitch: vport: fix self-deadlock on release of tunnel ports

In the Linux kernel, the following vulnerability has been resolved: openvswitch: vport: fix self-deadlock on release of tunnel ports vports are used concurrently and protected by RCU, so netdev_put() must happen after the RCU grace period. So, either in an RCU call or after the synchronize_net(). The rtnl_delete_li…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Showing 761 to 780 of 6933.First page Next page

Published 2026-05-28T09:36:20.855Z. Updated 2026-10-15T01:20:57.991Z.

CVSS—KEVNot listedEPSSPresentUpdated15 Oct 2026, 08:20 WIB

Official record

HighPublished 28 May 2026, 16:36 WIB

CVE-2026-46164

btrfs: fix double free in create_space_info_sub_group() error path

In the Linux kernel, the following vulnerability has been resolved: btrfs: fix double free in create_space_info_sub_group() error path When kobject_init_and_add() fails, the call chain is: create_space_info_sub_group() -> btrfs_sysfs_add_space_info_type() -> kobject_init_and_add() -> failure -> kobject_put(&sub_grou…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-05-28T09:36:19.810Z. Updated 2026-08-05T12:30:08.949Z.

CVSS7v3.1KEVNot listedEPSSPresentUpdated05 Aug 2026, 19:30 WIB

Official record

UnscoredPublished 28 May 2026, 16:36 WIB

CVE-2026-46163

wifi: b43legacy: enforce bounds check on firmware key index in RX path

In the Linux kernel, the following vulnerability has been resolved: wifi: b43legacy: enforce bounds check on firmware key index in RX path Same fix as b43: the firmware-controlled key index in b43legacy_rx() can exceed dev->max_nr_keys. The existing B43legacy_WARN_ON is non-enforcing in production builds, allowing an…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-05-28T09:36:18.946Z. Updated 2026-10-15T01:20:55.170Z.

CVSS—KEVNot listedEPSSPresentUpdated15 Oct 2026, 08:20 WIB

Official record

UnscoredPublished 28 May 2026, 16:36 WIB

CVE-2026-46162

ice: fix double free in ice_sf_eth_activate() error path

In the Linux kernel, the following vulnerability has been resolved: ice: fix double free in ice_sf_eth_activate() error path When auxiliary_device_add() fails, ice_sf_eth_activate() jumps to aux_dev_uninit and calls auxiliary_device_uninit(&sf_dev->adev). The device release callback ice_sf_dev_release() frees sf_dev…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-05-28T09:36:17.479Z. Updated 2026-06-14T17:59:13.179Z.

CVSS—KEVNot listedEPSSPresentUpdated15 Jun 2026, 00:59 WIB

Official record

UnscoredPublished 28 May 2026, 16:36 WIB

CVE-2026-46161

md/raid10: fix divide-by-zero in setup_geo() with zero far_copies

In the Linux kernel, the following vulnerability has been resolved: md/raid10: fix divide-by-zero in setup_geo() with zero far_copies setup_geo() extracts near_copies (nc) and far_copies (fc) from the user-provided layout parameter without checking for zero. When fc=0 with the "improved" far set layout selected, 'geo…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-05-28T09:36:16.428Z. Updated 2026-10-15T01:20:53.911Z.

CVSS—KEVNot listedEPSSPresentUpdated15 Oct 2026, 08:20 WIB

Official record

UnscoredPublished 28 May 2026, 16:36 WIB

CVE-2026-46160

btrfs: fix missing last_unlink_trans update when removing a directory

In the Linux kernel, the following vulnerability has been resolved: btrfs: fix missing last_unlink_trans update when removing a directory When removing a directory we are not updating its last_unlink_trans field, which can result in incorrect fsync behaviour in case some one fsyncs the directory after it was removed …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-05-28T09:36:15.580Z. Updated 2026-06-19T11:59:43.255Z.

CVSS—KEVNot listedEPSSPresentUpdated19 Jun 2026, 18:59 WIB

Official record

UnscoredPublished 28 May 2026, 16:36 WIB

CVE-2026-46159

btrfs: fix btrfs_ioctl_space_info() slot_count TOCTOU which can lead to info-leak

In the Linux kernel, the following vulnerability has been resolved: btrfs: fix btrfs_ioctl_space_info() slot_count TOCTOU which can lead to info-leak btrfs_ioctl_space_info() has a TOCTOU race between two passes over the block group RAID type lists. The first pass counts entries to determine the allocation size, then…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-05-28T09:36:14.676Z. Updated 2026-10-15T01:20:52.767Z.

CVSS—KEVNot listedEPSSPresentUpdated15 Oct 2026, 08:20 WIB

Official record

UnscoredPublished 28 May 2026, 16:36 WIB

CVE-2026-46158

mptcp: pm: ADD_ADDR rtx: always decrease sk refcount

In the Linux kernel, the following vulnerability has been resolved: mptcp: pm: ADD_ADDR rtx: always decrease sk refcount When an ADD_ADDR is retransmitted, the sk is held in sk_reset_timer(). It should then be released in all cases at the end. Some (unlikely) checks were returning directly instead of calling sock_pu…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-05-28T09:36:13.821Z. Updated 2026-09-14T11:58:23.714Z.

CVSS—KEVNot listedEPSSPresentUpdated14 Sep 2026, 18:58 WIB

Official record

HighPublished 28 May 2026, 16:36 WIB

CVE-2026-46157

ALSA: pcm: oss: Fix data race at accessing runtime.oss.trigger

In the Linux kernel, the following vulnerability has been resolved: ALSA: pcm: oss: Fix data race at accessing runtime.oss.trigger Currently the runtime.oss.trigger field may be accessed concurrently without protection, which may lead to the data race. And, in this case, it may lead to more severe problem because it…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-05-28T09:36:12.895Z. Updated 2026-10-21T12:41:21.547Z.

CVSS7.8v3.1KEVNot listedEPSSPresentUpdated21 Oct 2026, 19:41 WIB

Official record

UnscoredPublished 28 May 2026, 16:36 WIB

CVE-2026-46156

LoongArch: Fix potential ADE in loongson_gpu_fixup_dma_hang()

In the Linux kernel, the following vulnerability has been resolved: LoongArch: Fix potential ADE in loongson_gpu_fixup_dma_hang() The switch case in loongson_gpu_fixup_dma_hang() may not DC2 or DC3, and readl(crtc_reg) will access with random address, because the "device" is from "base+PCI_DEVICE_ID", "base" is from …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-05-28T09:36:12.075Z. Updated 2026-06-14T17:58:44.149Z.

CVSS—KEVNot listedEPSSPresentUpdated15 Jun 2026, 00:58 WIB

Official record

CritPublished 28 May 2026, 16:36 WIB

CVE-2026-46155

smb/client: fix out-of-bounds read in smb2_compound_op()

In the Linux kernel, the following vulnerability has been resolved: smb/client: fix out-of-bounds read in smb2_compound_op() If a server sends a truncated response but a large OutputBufferLength, and terminates the EA list early, check_wsl_eas() returns success without validating that the entire OutputBufferLength fi…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-05-28T09:36:11.092Z. Updated 2026-10-19T19:36:53.105Z.

CVSS9.1v3.1KEVNot listedEPSSPresentUpdated20 Oct 2026, 02:36 WIB

Official record

HighPublished 28 May 2026, 16:36 WIB

CVE-2026-46154

sched_ext: Read scx_root under scx_cgroup_ops_rwsem in cgroup setters

In the Linux kernel, the following vulnerability has been resolved: sched_ext: Read scx_root under scx_cgroup_ops_rwsem in cgroup setters scx_group_set_{weight,idle,bandwidth}() cache scx_root before acquiring scx_cgroup_ops_rwsem, so the pointer can be stale by the time the op runs. If the loaded scheduler is disabl…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-05-28T09:36:10.310Z. Updated 2026-08-05T12:30:05.703Z.

CVSS7v3.1KEVNot listedEPSSPresentUpdated05 Aug 2026, 19:30 WIB

Official record

UnscoredPublished 28 May 2026, 16:36 WIB

CVE-2026-46153

8021q: delete cleared egress QoS mappings

In the Linux kernel, the following vulnerability has been resolved: 8021q: delete cleared egress QoS mappings vlan_dev_set_egress_priority() currently keeps cleared egress priority mappings in the hash as tombstones. Repeated set/clear cycles with distinct skb priorities therefore accumulate mapping nodes until devic…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-05-28T09:36:09.415Z. Updated 2026-06-14T17:58:29.635Z.

CVSS—KEVNot listedEPSSPresentUpdated15 Jun 2026, 00:58 WIB

Official record

HighPublished 28 May 2026, 16:36 WIB

CVE-2026-46152

wifi: mac80211: drop stray 'static' from fast-RX rx_result

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: drop stray 'static' from fast-RX rx_result ieee80211_invoke_fast_rx() is documented as safe for parallel RX, but its per-invocation rx_result is declared static. Concurrent callers then share one instance and can overwrite each other'…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-05-28T09:36:08.211Z. Updated 2026-10-19T19:36:52.937Z.

CVSS8.8v3.1KEVNot listedEPSSPresentUpdated20 Oct 2026, 02:36 WIB

Official record

UnscoredPublished 28 May 2026, 16:36 WIB

CVE-2026-46151

usb: usblp: fix heap leak in IEEE 1284 device ID via short response

In the Linux kernel, the following vulnerability has been resolved: usb: usblp: fix heap leak in IEEE 1284 device ID via short response usblp_ctrl_msg() collapses the usb_control_msg() return value to 0/-errno, discarding the actual number of bytes transferred. A broken printer can complete the GET_DEVICE_ID control…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-05-28T09:36:07.397Z. Updated 2026-10-15T01:20:51.612Z.

CVSS—KEVNot listedEPSSPresentUpdated15 Oct 2026, 08:20 WIB

Official record

HighPublished 28 May 2026, 16:36 WIB

CVE-2026-46150

fanotify: fix false positive on permission events

In the Linux kernel, the following vulnerability has been resolved: fanotify: fix false positive on permission events fsnotify_get_mark_safe() may return false for a mark on an unrelated group, which results in bypassing the permission check. Fix by skipping over detached marks that are not in the current group.

Excerpt language: en.

Severity high: primary CNA CVSS 7.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-05-28T09:36:06.494Z. Updated 2026-10-19T19:36:52.765Z.

CVSS7.1v3.1KEVNot listedEPSSPresentUpdated20 Oct 2026, 02:36 WIB

Official record

HighPublished 28 May 2026, 16:36 WIB

CVE-2026-46149

scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show()

In the Linux kernel, the following vulnerability has been resolved: scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() target_tg_pt_gp_members_show() formats LUN paths with snprintf() into a 256-byte stack buffer, then will memcpy() cur_len bytes from that buffer. snprintf() returns the lengt…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-05-28T09:36:05.706Z. Updated 2026-10-19T19:36:52.452Z.

CVSS7.1v3.1KEVNot listedEPSSPresentUpdated20 Oct 2026, 02:36 WIB

Official record

UnscoredPublished 28 May 2026, 16:36 WIB

CVE-2026-46148

spi: microchip-core-qspi: control built-in cs manually

In the Linux kernel, the following vulnerability has been resolved: spi: microchip-core-qspi: control built-in cs manually The coreQSPI IP supports only a single chip select, which is automagically operated by the hardware - set low when the transmit buffer first gets written to and set high when the number of bytes …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-05-28T09:36:04.805Z. Updated 2026-10-21T12:41:20.581Z.

CVSS—KEVNot listedEPSSPresentUpdated21 Oct 2026, 19:41 WIB

Official record

UnscoredPublished 28 May 2026, 16:36 WIB

CVE-2026-46147

KVM: arm64: Fix pin leak and publication ordering in __pkvm_init_vcpu()

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Fix pin leak and publication ordering in __pkvm_init_vcpu() Two bugs exist in the vCPU initialisation path: 1. If a check fails after hyp_pin_shared_mem() succeeds, the cleanup path jumps to 'unlock' without calling unpin_host_vcpu() …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-05-28T09:36:03.892Z. Updated 2026-06-14T17:58:03.230Z.

CVSS—KEVNot listedEPSSPresentUpdated15 Jun 2026, 00:58 WIB

Official record