Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 16,156 published records · 20 KEV · 16,156 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

16,156 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit1,2247.6%
High5,34833%
Med5,51434%
Low5143.2%
None00.00%
Legacy00.00%
Unscored3,55622%

Matching records by UTC month

Oct 2616,156

Signal coverage

KEV-listed: 20
With a forecast: 16,156
Unknown date: 0
Unscored severity: 3,556

Share of cohort: KEV 0.12% · forecast 100% · unscored 22%.

Showing 761–780 of 16,156By severity band: Critical · 9.0–10.0 1,224, High · 7.0–8.9 5,348, Medium · 4.0–6.9 5,514, Low · 0.1–3.9 514, None · scored 0.0 0, Legacy · v2 only 0, Unscored · no CNA metric 3,556

UnscoredPublished 28 Oct 2026, 17:35 WIB

CVE-2026-99184

accel/rocket: search every core slot when a core is removed

In the Linux kernel, the following vulnerability has been resolved: accel/rocket: search every core slot when a core is removed rocket_remove() decrements rdev->num_cores for each core it removes, while find_core_for_dev() searches slots 0 to num_cores - 1. Unbinding the cores in the order they were bound therefore l…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-28T10:35:42.469Z. Updated 2026-10-28T10:35:42.469Z.

CVSS—KEVNot listedEPSSPresentUpdated28 Oct 2026, 17:35 WIB

Official record

UnscoredPublished 28 Oct 2026, 17:35 WIB

CVE-2026-99183

accel/rocket: search every core slot when looking up a scheduler

In the Linux kernel, the following vulnerability has been resolved: accel/rocket: search every core slot when looking up a scheduler sched_to_core() walks rdev->cores[] up to rdev->num_cores, and rocket_remove() decrements num_cores for every core it removes. Unbind a core that is not the last one and the cores behin…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Showing 761 to 780 of 16156.First page Next page

Published 2026-10-28T10:35:36.754Z. Updated 2026-10-28T10:35:36.754Z.

CVSS—KEVNot listedEPSSPresentUpdated28 Oct 2026, 17:35 WIB

Official record

UnscoredPublished 28 Oct 2026, 17:35 WIB

CVE-2026-99182

ASoC: SOF: ipc4-topology: Fix shift-out-of-bounds for aggregated ALH capture

In the Linux kernel, the following vulnerability has been resolved: ASoC: SOF: ipc4-topology: Fix shift-out-of-bounds for aggregated ALH capture When ch_count is smaller than blob->alh_cfg.device_count (e.g. a mono capture stream, such as a SmartMic, aggregated across multiple SDW links), step = ch_count / blob->alh_…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-28T10:35:35.193Z. Updated 2026-10-28T10:35:35.193Z.

CVSS—KEVNot listedEPSSPresentUpdated28 Oct 2026, 17:35 WIB

Official record

UnscoredPublished 28 Oct 2026, 17:35 WIB

CVE-2026-99181

autofs: ignore notification errors from a replaced pipe

In the Linux kernel, the following vulnerability has been resolved: autofs: ignore notification errors from a replaced pipe autofs_notify_daemon() takes a reference to the current notification pipe under wq_mutex, then drops the mutex before writing the request. The write can block while the daemon enters catatonic m…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-28T10:35:34.443Z. Updated 2026-10-28T10:35:34.443Z.

CVSS—KEVNot listedEPSSPresentUpdated28 Oct 2026, 17:35 WIB

Official record

UnscoredPublished 28 Oct 2026, 17:35 WIB

CVE-2026-99180

unicode: free the map after a grace period

In the Linux kernel, the following vulnerability has been resolved: unicode: free the map after a grace period generic_ci_d_hash() and generic_ci_d_compare() read sb->s_encoding and dereference the unicode map while a pathwalk in rcu mode holds nothing but rcu_read_lock(). The filesystems that use them, ext4, f2fs an…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-28T10:35:33.578Z. Updated 2026-10-28T10:35:33.578Z.

CVSS—KEVNot listedEPSSPresentUpdated28 Oct 2026, 17:35 WIB

Official record

UnscoredPublished 28 Oct 2026, 17:35 WIB

CVE-2026-99179

watch_queue: Fix note pool publication race in watch_queue_set_size()

In the Linux kernel, the following vulnerability has been resolved: watch_queue: Fix note pool publication race in watch_queue_set_size() There is a race between watch_queue_set_size() and post_one_notification(). watch_queue_set_size() publishes wqueue->notes, notes_bitmap, nr_pages and nr_notes with plain stores, a…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-28T10:35:32.734Z. Updated 2026-10-28T10:35:32.734Z.

CVSS—KEVNot listedEPSSPresentUpdated28 Oct 2026, 17:35 WIB

Official record

UnscoredPublished 28 Oct 2026, 17:35 WIB

CVE-2026-99178

x86/kvm: Don't consume async #PF flags on a kernel #PF in NMI context

In the Linux kernel, the following vulnerability has been resolved: x86/kvm: Don't consume async #PF flags on a kernel #PF in NMI context An async #PF "page not present" event arrives through the #PF vector, and its reason sits in the per-CPU apf_reason.flags until __kvm_handle_async_pf() reads and clears it. If an N…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-28T10:35:31.961Z. Updated 2026-10-28T10:35:31.961Z.

CVSS—KEVNot listedEPSSPresentUpdated28 Oct 2026, 17:35 WIB

Official record

UnscoredPublished 28 Oct 2026, 17:35 WIB

CVE-2026-99177

KVM: SEV: Fix page dirtying in sev_gmem_post_populate()

In the Linux kernel, the following vulnerability has been resolved: KVM: SEV: Fix page dirtying in sev_gmem_post_populate() set_page_dirty() requires that the caller holds some kind of lock to ensure that the page's mapping does not concurrently go away. That is not the case for a random page we got from get_user_pag…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-28T10:35:31.315Z. Updated 2026-10-28T10:35:31.315Z.

CVSS—KEVNot listedEPSSPresentUpdated28 Oct 2026, 17:35 WIB

Official record

UnscoredPublished 28 Oct 2026, 17:35 WIB

CVE-2026-99176

KVM: nVMX: Reset MMU back to the root MMU if loading L2 state fails for !VM-Entry

In the Linux kernel, the following vulnerability has been resolved: KVM: nVMX: Reset MMU back to the root MMU if loading L2 state fails for !VM-Entry Reset the vCPU's MMU pointer back to the root MMU if loading L2 state fails in the "not from VM-Entry" case, i.e. when emulating RSM or handling KVM_SET_NESTED_STATE. …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-28T10:35:30.615Z. Updated 2026-10-28T10:35:30.615Z.

CVSS—KEVNot listedEPSSPresentUpdated28 Oct 2026, 17:35 WIB

Official record

UnscoredPublished 28 Oct 2026, 17:35 WIB

CVE-2026-99175

fsnotify: prevent mark additions during connector teardown

In the Linux kernel, the following vulnerability has been resolved: fsnotify: prevent mark additions during connector teardown fsnotify_destroy_marks() keeps a reference to its current mark while it drops conn->lock to destroy the mark. This stabilizes the forward-walk cursor, but does not prevent a new mark from bei…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-28T10:35:29.760Z. Updated 2026-10-28T10:35:29.760Z.

CVSS—KEVNot listedEPSSPresentUpdated28 Oct 2026, 17:35 WIB

Official record

UnscoredPublished 28 Oct 2026, 17:35 WIB

CVE-2026-99174

ext4: free the sbi after a grace period

In the Linux kernel, the following vulnerability has been resolved: ext4: free the sbi after a grace period ext4_get_link() follows a symlink that keeps its target in a data block in rcu pathwalk mode with ext4_getblk(EXT4_GET_BLOCKS_CACHED_NOWAIT). That reads s_mount_state in the ASSERT() of ext4_getblk() and again …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-28T10:35:28.758Z. Updated 2026-10-28T10:35:28.758Z.

CVSS—KEVNot listedEPSSPresentUpdated28 Oct 2026, 17:35 WIB

Official record

UnscoredPublished 28 Oct 2026, 17:35 WIB

CVE-2026-99173

eventfs: Free the eventfs_inode after an rcu grace period too

In the Linux kernel, the following vulnerability has been resolved: eventfs: Free the eventfs_inode after an rcu grace period too tracefs_d_revalidate() reads ->is_freed of the eventfs_inode that dentry->d_fsdata points to, and ->d_revalidate() is called in rcu pathwalk mode with nothing but rcu_read_lock() held. The…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-28T10:35:28.017Z. Updated 2026-10-28T10:35:28.017Z.

CVSS—KEVNot listedEPSSPresentUpdated28 Oct 2026, 17:35 WIB

Official record

UnscoredPublished 28 Oct 2026, 17:35 WIB

CVE-2026-99172

ipc: drop the mqueue mount with kern_unmount() on setup failure

In the Linux kernel, the following vulnerability has been resolved: ipc: drop the mqueue mount with kern_unmount() on setup failure mq_init_ns() creates the mqueue mount with fc_mount_longterm(), so its ->mnt_ns is MNT_NS_INTERNAL. When setting up the mqueue or ipc sysctls or msg_init_ns() fails afterwards, create_ip…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-28T10:35:27.245Z. Updated 2026-10-28T10:35:27.245Z.

CVSS—KEVNot listedEPSSPresentUpdated28 Oct 2026, 17:35 WIB

Official record

UnscoredPublished 28 Oct 2026, 17:35 WIB

CVE-2026-99171

ntfs3: free the sbi after a grace period

In the Linux kernel, the following vulnerability has been resolved: ntfs3: free the sbi after a grace period If the "nocase" mount option ntfs3 uses custom hash and dentry compare functions. Both access ntfs3 superblock private information in rcu pathwalk. ntfs_put_super() and ntfs3_kill_sb() drop the info without an…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-28T10:35:26.598Z. Updated 2026-10-28T10:35:26.598Z.

CVSS—KEVNot listedEPSSPresentUpdated28 Oct 2026, 17:35 WIB

Official record

UnscoredPublished 28 Oct 2026, 17:35 WIB

CVE-2026-99170

namespace: a mount that copy_tree() leaves out can't take over a lock

In the Linux kernel, the following vulnerability has been resolved: namespace: a mount that copy_tree() leaves out can't take over a lock Since commit c62a4766937e ("move_mount: transfer MNT_LOCKED") a mount can be moved beneath a locked mount. The lock moves from the old cover to the new mount which takes over the j…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-28T10:35:25.923Z. Updated 2026-10-28T10:35:25.923Z.

CVSS—KEVNot listedEPSSPresentUpdated28 Oct 2026, 17:35 WIB

Official record

UnscoredPublished 28 Oct 2026, 17:35 WIB

CVE-2026-99169

futex: Fix mm reuse handling for FUT_OFF_MMSHARED

In the Linux kernel, the following vulnerability has been resolved: futex: Fix mm reuse handling for FUT_OFF_MMSHARED A FUT_OFF_MMSHARED futex is a shared futex that refers to an MM. It is possible for a process to wait on a shared futex with a different MM because a FUT_OFF_INODE waiter can be requeued onto a FUT_OF…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-28T10:35:20.170Z. Updated 2026-10-28T10:35:20.170Z.

CVSS—KEVNot listedEPSSPresentUpdated28 Oct 2026, 17:35 WIB

Official record

UnscoredPublished 28 Oct 2026, 17:35 WIB

CVE-2026-99168

mshv_vtl: Check per-CPU register page before mmap

In the Linux kernel, the following vulnerability has been resolved: mshv_vtl: Check per-CPU register page before mmap Register-page setup is optional for each CPU. If allocation or registration fails, mshv_vtl_configure_reg_page() warns and leaves that CPU's reg_page NULL, but initial context setup continues successf…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-28T10:35:19.539Z. Updated 2026-10-28T10:35:19.539Z.

CVSS—KEVNot listedEPSSPresentUpdated28 Oct 2026, 17:35 WIB

Official record

UnscoredPublished 28 Oct 2026, 17:35 WIB

CVE-2026-99167

net/sched: fix use-after-free in __tcf_action_put()

In the Linux kernel, the following vulnerability has been resolved: net/sched: fix use-after-free in __tcf_action_put() __tcf_action_put() decrements the reference count before decrementing the binding count. Another thread can free the action between these operations, causing the binding-count update to access freed…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-28T10:35:18.850Z. Updated 2026-10-28T10:35:18.850Z.

CVSS—KEVNot listedEPSSPresentUpdated28 Oct 2026, 17:35 WIB

Official record

UnscoredPublished 28 Oct 2026, 17:35 WIB

CVE-2026-99166

net: rds: fix uninitialized trans dereference in CM event handler

In the Linux kernel, the following vulnerability has been resolved: net: rds: fix uninitialized trans dereference in CM event handler rds_rdma_cm_event_handler_cmn() assigns trans only when the RDMA device is an InfiniBand CA (RDMA_NODE_IB_CA). On any other device type, e.g. an iWARP RNIC such as siw, trans stays un…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-28T10:35:18.050Z. Updated 2026-10-28T10:35:18.050Z.

CVSS—KEVNot listedEPSSPresentUpdated28 Oct 2026, 17:35 WIB

Official record

UnscoredPublished 28 Oct 2026, 17:35 WIB

CVE-2026-99165

sctp: revalidate output stream after association connect wait

In the Linux kernel, the following vulnerability has been resolved: sctp: revalidate output stream after association connect wait When message interleaving is enabled, the first send waits for association establishment before building its data chunks. The wait drops the socket lock, and handshake processing can redu…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-28T10:35:17.366Z. Updated 2026-10-28T10:35:17.366Z.

CVSS—KEVNot listedEPSSPresentUpdated28 Oct 2026, 17:35 WIB

Official record