Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 16,156 published records · 20 KEV · 16,156 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

16,156 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit1,2247.6%
High5,34833%
Med5,51434%
Low5143.2%
None00.00%
Legacy00.00%
Unscored3,55622%

Matching records by UTC month

Oct 2616,156

Signal coverage

KEV-listed: 20
With a forecast: 16,156
Unknown date: 0
Unscored severity: 3,556

Share of cohort: KEV 0.12% · forecast 100% · unscored 22%.

Showing 781–800 of 16,156By severity band: Critical · 9.0–10.0 1,224, High · 7.0–8.9 5,348, Medium · 4.0–6.9 5,514, Low · 0.1–3.9 514, None · scored 0.0 0, Legacy · v2 only 0, Unscored · no CNA metric 3,556

UnscoredPublished 28 Oct 2026, 17:35 WIB

CVE-2026-99164

spi: imx: fix slab corruption from undersized DMA bounce buffers

In the Linux kernel, the following vulnerability has been resolved: spi: imx: fix slab corruption from undersized DMA bounce buffers Since commit faa8e404ad8e ("spi: imx: support dynamic burst length for ECSPI DMA mode"), the driver allocates its private DMA TX/RX buffers with kzalloc(dma_len), where dma_len is only …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-28T10:35:16.694Z. Updated 2026-10-28T10:35:16.694Z.

CVSS—KEVNot listedEPSSPresentUpdated28 Oct 2026, 17:35 WIB

Official record

UnscoredPublished 28 Oct 2026, 17:35 WIB

CVE-2026-99163

tracing/histograms: Reject non-stacktrace fields for synthetic stacktrace fields

In the Linux kernel, the following vulnerability has been resolved: tracing/histograms: Reject non-stacktrace fields for synthetic stacktrace fields In check_synth_field(), when a synthetic event field is a stacktrace (field->is_stack) and the histogram field is not a "long[" stacktrace array, validation falls throug…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Showing 781 to 800 of 16156.First page Next page

Published 2026-10-28T10:35:15.577Z. Updated 2026-10-28T10:35:15.577Z.

CVSS—KEVNot listedEPSSPresentUpdated28 Oct 2026, 17:35 WIB

Official record

UnscoredPublished 28 Oct 2026, 17:35 WIB

CVE-2026-99162

gpio: shared: fix use-after-free bug when adding shared proxies

In the Linux kernel, the following vulnerability has been resolved: gpio: shared: fix use-after-free bug when adding shared proxies The GPIO lookup table can stay alive for longer than the kobject whose name string's address we're assigning to lookup->dev_id. Fix a potential UAF by duplicating the string.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-28T10:35:14.755Z. Updated 2026-10-28T10:35:14.755Z.

CVSS—KEVNot listedEPSSPresentUpdated28 Oct 2026, 17:35 WIB

Official record

UnscoredPublished 28 Oct 2026, 17:35 WIB

CVE-2026-99161

i2c: viai2c-wmt: Fix clock leak in wmt_i2c_probe()

In the Linux kernel, the following vulnerability has been resolved: i2c: viai2c-wmt: Fix clock leak in wmt_i2c_probe() In wmt_i2c_probe(), i2c->clk is acquired using of_clk_get(). If any subsequent operation fails or when the module is unloaded, the clock reference count is never decremented via clk_put(), leading to…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-28T10:35:13.970Z. Updated 2026-10-28T10:35:13.970Z.

CVSS—KEVNot listedEPSSPresentUpdated28 Oct 2026, 17:35 WIB

Official record

UnscoredPublished 28 Oct 2026, 17:35 WIB

CVE-2026-99160

ring-buffer: Do not show buffer_meta for CPUs without a buffer

In the Linux kernel, the following vulnerability has been resolved: ring-buffer: Do not show buffer_meta for CPUs without a buffer The per_cpu/cpuN/buffer_meta files are created for every possible CPU, but buffer->buffers[cpu] is only allocated once that CPU comes online. Reading the file of a CPU that never came onl…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-28T10:35:13.341Z. Updated 2026-10-28T10:35:13.341Z.

CVSS—KEVNot listedEPSSPresentUpdated28 Oct 2026, 17:35 WIB

Official record

UnscoredPublished 28 Oct 2026, 17:35 WIB

CVE-2026-99159

ring-buffer: Fix the sub-buffer array base in rb_meta_subbuf_idx()

In the Linux kernel, the following vulnerability has been resolved: ring-buffer: Fix the sub-buffer array base in rb_meta_subbuf_idx() On a persistent ring buffer, rb_meta_subbuf_idx() can return an index one sub-buffer too high. rb_setup_ids_meta_page() then fills subbuf_ids[] shifted by one and leaves subbuf_ids[0…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-28T10:35:12.520Z. Updated 2026-10-28T10:35:12.520Z.

CVSS—KEVNot listedEPSSPresentUpdated28 Oct 2026, 17:35 WIB

Official record

UnscoredPublished 28 Oct 2026, 17:35 WIB

CVE-2026-99158

ring-buffer: Fix false warning in ring_buffer_map_get_reader()

In the Linux kernel, the following vulnerability has been resolved: ring-buffer: Fix false warning in ring_buffer_map_get_reader() The mmap reader can warn when it catches up with a writer that is still committing events. rb_get_reader_page() returns NULL in this case, but ring_buffer_map_get_reader() treats that res…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-28T10:35:11.848Z. Updated 2026-10-28T10:35:11.848Z.

CVSS—KEVNot listedEPSSPresentUpdated28 Oct 2026, 17:35 WIB

Official record

UnscoredPublished 28 Oct 2026, 17:35 WIB

CVE-2026-99157

scsi: bsg: Pass reply_len to bsg_setup_queue() to fit UFS ARPMB replies

In the Linux kernel, the following vulnerability has been resolved: scsi: bsg: Pass reply_len to bsg_setup_queue() to fit UFS ARPMB replies bsg-lib allocates a 96-byte (SCSI_SENSE_BUFFERSIZE) reply buffer per job, but struct ufs_rpmb_reply is 104 bytes: a 40-byte struct ufs_bsg_reply followed by a 64-byte EHS. When a…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-28T10:35:11.192Z. Updated 2026-10-28T10:35:11.192Z.

CVSS—KEVNot listedEPSSPresentUpdated28 Oct 2026, 17:35 WIB

Official record

UnscoredPublished 28 Oct 2026, 17:35 WIB

CVE-2026-99156

scsi: st: Fix use-after-free race between st_remove() and st_open()

In the Linux kernel, the following vulnerability has been resolved: scsi: st: Fix use-after-free race between st_remove() and st_open() st_remove() drops the probe reference on the scsi_tape with kref_put() and only afterwards removes its index from st_index_idr. If that was the last reference, scsi_tape_release() fr…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-28T10:35:10.493Z. Updated 2026-10-28T10:35:10.493Z.

CVSS—KEVNot listedEPSSPresentUpdated28 Oct 2026, 17:35 WIB

Official record

UnscoredPublished 28 Oct 2026, 17:35 WIB

CVE-2026-99155

scsi: xen/scsifront: Check for a NULL shadow entry on a backend response

In the Linux kernel, the following vulnerability has been resolved: scsi: xen/scsifront: Check for a NULL shadow entry on a backend response scsifront_do_response() validates the rqid in a backend response against VSCSIIF_MAX_REQS before using it to index info->shadow[], but then dereferences the entry to test ->infl…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-28T10:35:09.733Z. Updated 2026-10-28T10:35:09.733Z.

CVSS—KEVNot listedEPSSPresentUpdated28 Oct 2026, 17:35 WIB

Official record

UnscoredPublished 28 Oct 2026, 17:35 WIB

CVE-2026-99154

scsi: libiscsi: Reject a negative task index from parse_pdu_itt

In the Linux kernel, the following vulnerability has been resolved: scsi: libiscsi: Reject a negative task index from parse_pdu_itt A transport that implements parse_pdu_itt hands libiscsi an index taken from the PDU, and both lookups bound it from above only: if (i >= session->cmds_max) i and cmds_max are bo…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-28T10:35:08.968Z. Updated 2026-10-28T10:35:08.968Z.

CVSS—KEVNot listedEPSSPresentUpdated28 Oct 2026, 17:35 WIB

Official record

UnscoredPublished 28 Oct 2026, 17:35 WIB

CVE-2026-99153

scsi: libiscsi: Validate the ITT reflected in a Reject PDU

In the Linux kernel, the following vulnerability has been resolved: scsi: libiscsi: Validate the ITT reflected in a Reject PDU A Reject PDU carries a copy of the header it rejects, and iscsi_handle_reject() takes the ITT out of that copy to find the task to clean up: memcpy(&rejected_pdu, data, sizeof(struct i…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-28T10:35:08.287Z. Updated 2026-10-28T10:35:08.287Z.

CVSS—KEVNot listedEPSSPresentUpdated28 Oct 2026, 17:35 WIB

Official record

UnscoredPublished 28 Oct 2026, 17:35 WIB

CVE-2026-99152

scsi: libiscsi: Validate the task named by a management response

In the Linux kernel, the following vulnerability has been resolved: scsi: libiscsi: Validate the task named by a management response __iscsi_complete_pdu() fetches the task for five response types from one place and checks only that the index resolved: case ISCSI_OP_LOGOUT_RSP: case ISCSI_OP_LOGIN_RSP: …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-28T10:35:07.622Z. Updated 2026-10-28T10:35:07.622Z.

CVSS—KEVNot listedEPSSPresentUpdated28 Oct 2026, 17:35 WIB

Official record

UnscoredPublished 28 Oct 2026, 17:35 WIB

CVE-2026-99151

drm/amd/display: Fix NULL sink dereference in USB4 bandwidth functions

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Fix NULL sink dereference in USB4 bandwidth functions allocate_usb4_bandwidth_for_stream() and allocate_usb4_bandwidth() both use ASSERT(stream->sink) before dereferencing stream->sink->link. ASSERT is compiled out in production buil…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-28T10:35:06.866Z. Updated 2026-10-28T10:35:06.866Z.

CVSS—KEVNot listedEPSSPresentUpdated28 Oct 2026, 17:35 WIB

Official record

UnscoredPublished 28 Oct 2026, 17:35 WIB

CVE-2026-99150

drm/amdgpu: don't drop the runtime PM reference twice in amdgpu_gpr

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: don't drop the runtime PM reference twice in amdgpu_gpr amdgpu_debugfs_gpr_read() drops its runtime PM reference right after reading the wave registers. When copying them to userspace fails, it jumps to the err label, which drops the refe…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-28T10:35:05.753Z. Updated 2026-10-28T10:35:05.753Z.

CVSS—KEVNot listedEPSSPresentUpdated28 Oct 2026, 17:35 WIB

Official record

UnscoredPublished 28 Oct 2026, 17:35 WIB

CVE-2026-99149

drm/amdgpu: fix GEM object leak on ENOMEM in userptr ioctl

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: fix GEM object leak on ENOMEM in userptr ioctl When amdgpu_hmm_range_alloc() fails amdgpu_gem_userptr_ioctl() returns -ENOMEM right away and skips the cleanup every other error path goes through. The GEM object, the bo->parent reference o…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-28T10:35:05.015Z. Updated 2026-10-28T10:35:05.015Z.

CVSS—KEVNot listedEPSSPresentUpdated28 Oct 2026, 17:35 WIB

Official record

UnscoredPublished 28 Oct 2026, 17:35 WIB

CVE-2026-99148

drm/amdgpu: keep the eviction fence until the last handle is closed

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: keep the eviction fence until the last handle is closed amdgpu_gem_object_close() detaches the user queue eviction fence from the BO before it checks bo_va->ref_count, so closing any handle of a BO removes the fence, even when the file st…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-28T10:35:04.360Z. Updated 2026-10-28T10:35:04.360Z.

CVSS—KEVNot listedEPSSPresentUpdated28 Oct 2026, 17:35 WIB

Official record

UnscoredPublished 28 Oct 2026, 17:35 WIB

CVE-2026-99147

drm/exec: don't immediately add prelocked obj to array of locked objs

In the Linux kernel, the following vulnerability has been resolved: drm/exec: don't immediately add prelocked obj to array of locked objs When a contention is detected the drm_exec object grabs a reference to the contended object, unlocks all other objects and pre-locks the contended one before anything else. The pr…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-28T10:35:03.580Z. Updated 2026-10-28T10:35:03.580Z.

CVSS—KEVNot listedEPSSPresentUpdated28 Oct 2026, 17:35 WIB

Official record

UnscoredPublished 28 Oct 2026, 17:35 WIB

CVE-2026-99146

drm/i915/dmc: Add sanity check for DMC load address

In the Linux kernel, the following vulnerability has been resolved: drm/i915/dmc: Add sanity check for DMC load address For DMC firmware header version 3, the firmware load address is stored in dmc_info->start_mmioaddr and later used by dmc_load_program(). Unlike the MMIO address table, the firmware load address is …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-28T10:35:02.847Z. Updated 2026-10-28T10:35:02.847Z.

CVSS—KEVNot listedEPSSPresentUpdated28 Oct 2026, 17:35 WIB

Official record

UnscoredPublished 28 Oct 2026, 17:35 WIB

CVE-2026-99145

drm/xe: Don't transfer shrinker pages for pinned bos on purgeable state change

In the Linux kernel, the following vulnerability has been resolved: drm/xe: Don't transfer shrinker pages for pinned bos on purgeable state change Pinned bos have their pages removed from the shrinker's shrinkable / purgeable counts on pin, and added back on unpin according to the bo's purgeable state at that time. …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-28T10:35:02.038Z. Updated 2026-10-28T10:35:02.038Z.

CVSS—KEVNot listedEPSSPresentUpdated28 Oct 2026, 17:35 WIB

Official record