Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 6,933 published records · 23 KEV · 6,933 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

6,933 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit5588.0%
High2,11831%
Med2,24432%
Low2403.5%
None90.13%
Legacy00.00%
Unscored1,76425%

Matching records by UTC month

May 266,933

Signal coverage

KEV-listed: 23
With a forecast: 6,933
Unknown date: 0
Unscored severity: 1,764

Share of cohort: KEV 0.33% · forecast 100% · unscored 25%.

Showing 781–800 of 6,933By severity band: Critical · 9.0–10.0 558, High · 7.0–8.9 2,118, Medium · 4.0–6.9 2,244, Low · 0.1–3.9 240, None · scored 0.0 9, Legacy · v2 only 0, Unscored · no CNA metric 1,764

UnscoredPublished 28 May 2026, 16:36 WIB

CVE-2026-46146

ALSA: usb-audio: Avoid potential endless loop in convert_chmap_v3()

In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: Avoid potential endless loop in convert_chmap_v3() The convert_chmap_v3() has a loop with its increment size of cs_desc->wLength, but we forgot to validate cs_desc->wLength itself, which may lead to potential endless loop by a malfor…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-05-28T09:36:02.794Z. Updated 2026-10-15T01:20:47.967Z.

CVSS—KEVNot listedEPSSPresentUpdated15 Oct 2026, 08:20 WIB

Official record

HighPublished 28 May 2026, 16:36 WIB

CVE-2026-46145

RDMA/mana: Validate rx_hash_key_len

In the Linux kernel, the following vulnerability has been resolved: RDMA/mana: Validate rx_hash_key_len Sashiko points out that rx_hash_key_len comes from a uAPI structure and is blindly passed to memcpy, allowing the userspace to trash kernel memory. Bounds check it so the memcpy cannot overflow.

Excerpt language: en.

Severity high: primary CNA CVSS 7.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Showing 781 to 800 of 6933.First page Next page

Published 2026-05-28T09:36:01.805Z. Updated 2026-10-19T19:36:52.289Z.

CVSS7.8v3.1KEVNot listedEPSSPresentUpdated20 Oct 2026, 02:36 WIB

Official record

UnscoredPublished 28 May 2026, 16:36 WIB

CVE-2026-46144

RDMA/mana: Fix error unwind in mana_ib_create_qp_rss()

In the Linux kernel, the following vulnerability has been resolved: RDMA/mana: Fix error unwind in mana_ib_create_qp_rss() Sashiko points out that mana_ib_cfg_vport_steering() is leaked, the normal destroy path cleans it up.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-05-28T09:36:00.412Z. Updated 2026-06-14T17:57:49.375Z.

CVSS—KEVNot listedEPSSPresentUpdated15 Jun 2026, 00:57 WIB

Official record

UnscoredPublished 28 May 2026, 16:35 WIB

CVE-2026-46143

ASoC: qcom: q6apm-lpass-dai: Fix multiple graph opens

In the Linux kernel, the following vulnerability has been resolved: ASoC: qcom: q6apm-lpass-dai: Fix multiple graph opens As prepare can be called mulitple times, this can result in multiple graph opens for playback path. This will result in a memory leaks, fix this by adding a check before opening.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-05-28T09:35:59.117Z. Updated 2026-06-14T17:57:43.842Z.

CVSS—KEVNot listedEPSSPresentUpdated15 Jun 2026, 00:57 WIB

Official record

UnscoredPublished 28 May 2026, 16:35 WIB

CVE-2026-46142

net: libwx: fix VF illegal register access

In the Linux kernel, the following vulnerability has been resolved: net: libwx: fix VF illegal register access Register WX_CFG_PORT_ST is a PF restricted register. When a VF is initialized, attempting to read this register triggers an illegal register access, which lead to a system hang. When the device is VF, the b…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-05-28T09:35:57.837Z. Updated 2026-06-14T17:57:38.598Z.

CVSS—KEVNot listedEPSSPresentUpdated15 Jun 2026, 00:57 WIB

Official record

UnscoredPublished 28 May 2026, 16:35 WIB

CVE-2026-46141

powerpc/xive: fix kmemleak caused by incorrect chip_data lookup

In the Linux kernel, the following vulnerability has been resolved: powerpc/xive: fix kmemleak caused by incorrect chip_data lookup The kmemleak reports the following memory leak: Unreferenced object 0xc0000002a7fbc640 (size 64): comm "kworker/8:1", pid 540, jiffies 4294937872 hex dump (first 32 bytes): 01 0…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-05-28T09:35:56.940Z. Updated 2026-06-14T17:57:33.523Z.

CVSS—KEVNot listedEPSSPresentUpdated15 Jun 2026, 00:57 WIB

Official record

UnscoredPublished 28 May 2026, 16:35 WIB

CVE-2026-46140

Bluetooth: btmtk: validate WMT event SKB length before struct access

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btmtk: validate WMT event SKB length before struct access btmtk_usb_hci_wmt_sync() casts the WMT event response SKB data to struct btmtk_hci_wmt_evt (7 bytes) and struct btmtk_hci_wmt_evt_funcc (9 bytes) without first checking that the SKB…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-05-28T09:35:56.104Z. Updated 2026-07-04T11:50:42.029Z.

CVSS—KEVNot listedEPSSPresentUpdated04 Jul 2026, 18:50 WIB

Official record

UnscoredPublished 28 May 2026, 16:35 WIB

CVE-2026-46139

smb: client: use kzalloc to zero-initialize security descriptor buffer

In the Linux kernel, the following vulnerability has been resolved: smb: client: use kzalloc to zero-initialize security descriptor buffer Commit 62e7dd0a39c2d ("smb: common: change the data type of num_aces to le16") split struct smb_acl's __le32 num_aces field into __le16 num_aces and __le16 reserved. The reserved …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-05-28T09:35:55.234Z. Updated 2026-06-14T17:57:22.559Z.

CVSS—KEVNot listedEPSSPresentUpdated15 Jun 2026, 00:57 WIB

Official record

HighPublished 28 May 2026, 16:35 WIB

CVE-2026-46138

Bluetooth: hci_event: Fix OOB read and infinite loop in hci_le_create_big_complete_evt

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_event: Fix OOB read and infinite loop in hci_le_create_big_complete_evt hci_le_create_big_complete_evt() iterates over BT_BOUND connections for a BIG handle using a while loop, accessing ev->bis_handle[i++] on each iteration. However,…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-05-28T09:35:54.467Z. Updated 2026-10-19T19:36:52.126Z.

CVSS8.1v3.1KEVNot listedEPSSPresentUpdated20 Oct 2026, 02:36 WIB

Official record

CritPublished 28 May 2026, 16:35 WIB

CVE-2026-46137

mptcp: pm: ADD_ADDR rtx: fix potential data-race

In the Linux kernel, the following vulnerability has been resolved: mptcp: pm: ADD_ADDR rtx: fix potential data-race This mptcp_pm_add_timer() helper is executed as a timer callback in softirq context. To avoid any data races, the socket lock needs to be held with bh_lock_sock(). If the socket is in use, retry again…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-05-28T09:35:53.628Z. Updated 2026-10-19T19:36:51.963Z.

CVSS9.8v3.1KEVNot listedEPSSPresentUpdated20 Oct 2026, 02:36 WIB

Official record

UnscoredPublished 28 May 2026, 16:35 WIB

CVE-2026-46136

wifi: mt76: mt7921: fix a potential clc buffer length underflow

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7921: fix a potential clc buffer length underflow The buf_len is used to limit the iterations for retrieving the country power setting and may underflow under certain conditions due to changes in the power table in CLC. This underflow …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-05-28T09:35:52.004Z. Updated 2026-10-15T01:20:45.666Z.

CVSS—KEVNot listedEPSSPresentUpdated15 Oct 2026, 08:20 WIB

Official record

CritPublished 28 May 2026, 16:35 WIB

CVE-2026-46135

nvmet-tcp: fix race between ICReq handling and queue teardown

In the Linux kernel, the following vulnerability has been resolved: nvmet-tcp: fix race between ICReq handling and queue teardown nvmet_tcp_handle_icreq() updates queue->state after sending an Initialization Connection Response (ICResp), but it does so without serializing against target-side queue teardown. If an NV…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-05-28T09:35:49.828Z. Updated 2026-10-19T19:36:51.823Z.

CVSS9.8v3.1KEVNot listedEPSSPresentUpdated20 Oct 2026, 02:36 WIB

Official record

UnscoredPublished 28 May 2026, 16:35 WIB

CVE-2026-46134

platform/chrome: cros_ec_typec: Init mutex in Thunderbolt registration

In the Linux kernel, the following vulnerability has been resolved: platform/chrome: cros_ec_typec: Init mutex in Thunderbolt registration cros_typec_register_thunderbolt() missed initializing the `adata->lock` mutex. This leads to a NULL dereference when the mutex is later acquired (e.g. in cros_typec_altmode_work(…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-05-28T09:35:48.624Z. Updated 2026-06-14T17:56:59.651Z.

CVSS—KEVNot listedEPSSPresentUpdated15 Jun 2026, 00:56 WIB

Official record

HighPublished 28 May 2026, 16:35 WIB

CVE-2026-46133

RDMA/rxe: Reject unknown opcodes before ICRC processing

In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Reject unknown opcodes before ICRC processing Even after applying commit 7244491dab34 ("RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv"), a single unauthenticated UDP packet can still trigger panic. That patch handled pay…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-05-28T09:35:47.819Z. Updated 2026-10-19T19:36:51.685Z.

CVSS7.5v3.1KEVNot listedEPSSPresentUpdated20 Oct 2026, 02:36 WIB

Official record

UnscoredPublished 28 May 2026, 16:35 WIB

CVE-2026-46132

net: rtnetlink: zero ifla_vf_broadcast to avoid stack infoleak in rtnl_fill_vfinfo

In the Linux kernel, the following vulnerability has been resolved: net: rtnetlink: zero ifla_vf_broadcast to avoid stack infoleak in rtnl_fill_vfinfo rtnl_fill_vfinfo() declares struct ifla_vf_broadcast on the stack without initialisation: struct ifla_vf_broadcast vf_broadcast; The struct contains a single fixed …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-05-28T09:35:47.047Z. Updated 2026-10-15T01:20:44.498Z.

CVSS—KEVNot listedEPSSPresentUpdated15 Oct 2026, 08:20 WIB

Official record

UnscoredPublished 28 May 2026, 16:35 WIB

CVE-2026-46131

KVM: x86: check for nEPT/nNPT in slow flush hypercalls

In the Linux kernel, the following vulnerability has been resolved: KVM: x86: check for nEPT/nNPT in slow flush hypercalls Checking is_guest_mode(vcpu) is incorrect, because translate_nested_gpa() is only valid if an L2 guest is running *with nested EPT/NPT enabled*. Instead use the same condition as translate_nested…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-05-28T09:35:46.220Z. Updated 2026-06-14T17:56:46.141Z.

CVSS—KEVNot listedEPSSPresentUpdated15 Jun 2026, 00:56 WIB

Official record

UnscoredPublished 28 May 2026, 16:35 WIB

CVE-2026-46130

dm-verity-fec: fix reading parity bytes split across blocks (take 3)

In the Linux kernel, the following vulnerability has been resolved: dm-verity-fec: fix reading parity bytes split across blocks (take 3) fec_decode_bufs() assumes that the parity bytes of the first RS codeword it decodes are never split across parity blocks. This assumption is false. Consider v->fec->block_size == …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-05-28T09:35:45.387Z. Updated 2026-10-21T12:41:19.483Z.

CVSS—KEVNot listedEPSSPresentUpdated21 Oct 2026, 19:41 WIB

Official record

HighPublished 28 May 2026, 16:35 WIB

CVE-2026-46129

btrfs: fix double free in create_space_info() error path

In the Linux kernel, the following vulnerability has been resolved: btrfs: fix double free in create_space_info() error path When kobject_init_and_add() fails, the call chain is: create_space_info() -> btrfs_sysfs_add_space_info_type() -> kobject_init_and_add() -> failure -> kobject_put(&space_info->kobj) -> space_i…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-05-28T09:35:44.271Z. Updated 2026-08-05T12:29:55.996Z.

CVSS7.8v3.1KEVNot listedEPSSPresentUpdated05 Aug 2026, 19:29 WIB

Official record

UnscoredPublished 28 May 2026, 16:35 WIB

CVE-2026-46128

ipmi: Check event message buffer response for bad data

In the Linux kernel, the following vulnerability has been resolved: ipmi: Check event message buffer response for bad data The event message buffer response data size got checked later when processing, but check it right after the response comes back. It appears some BMCs may return an empty message instead of an er…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-05-28T09:35:43.326Z. Updated 2026-10-15T01:20:42.825Z.

CVSS—KEVNot listedEPSSPresentUpdated15 Oct 2026, 08:20 WIB

Official record

UnscoredPublished 28 May 2026, 16:35 WIB

CVE-2026-46127

RDMA/ocrdma: Don't NULL deref uctx on errors in ocrdma_copy_pd_uresp()

In the Linux kernel, the following vulnerability has been resolved: RDMA/ocrdma: Don't NULL deref uctx on errors in ocrdma_copy_pd_uresp() Sashiko points out that pd->uctx isn't initialized until late in the function so all these error flow references are NULL and will crash. Use the uctx that isn't NULL.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-05-28T09:35:42.368Z. Updated 2026-06-14T17:56:27.705Z.

CVSS—KEVNot listedEPSSPresentUpdated15 Jun 2026, 00:56 WIB

Official record