Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 12,259 published records · 20 KEV · 12,259 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

12,259 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit1,45512%
High4,59737%
Med3,35727%
Low3142.6%
None50.04%
Legacy00.00%
Unscored2,53121%

Matching records by UTC month

Aug 2612,259

Signal coverage

KEV-listed: 20
With a forecast: 12,259
Unknown date: 0
Unscored severity: 2,531

Share of cohort: KEV 0.16% · forecast 100% · unscored 21%.

Showing 861–880 of 12,259By severity band: Critical · 9.0–10.0 1,455, High · 7.0–8.9 4,597, Medium · 4.0–6.9 3,357, Low · 0.1–3.9 314, None · scored 0.0 5, Legacy · v2 only 0, Unscored · no CNA metric 2,531

HighPublished 28 Aug 2026, 13:48 WIB

CVE-2026-80635

wifi: wcn36xx: fix OOB read from short trigger BA firmware response

In the Linux kernel, the following vulnerability has been resolved: wifi: wcn36xx: fix OOB read from short trigger BA firmware response The firmware response length is only checked against sizeof(*rsp) (20 bytes), but when candidate_cnt >= 1, a 22-byte candidate struct is read at buf + 20 without verifying the respon…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-28T06:48:49.637Z. Updated 2026-08-29T06:21:35.535Z.

CVSS8.8v3.1KEVNot listedEPSSPresentUpdated29 Aug 2026, 13:21 WIB

Official record

CritPublished 28 Aug 2026, 13:48 WIB

CVE-2026-80634

netfilter: flowtable: avoid num_encaps underflow on bridge VLAN untag

In the Linux kernel, the following vulnerability has been resolved: netfilter: flowtable: avoid num_encaps underflow on bridge VLAN untag The DEV_PATH_BR_VLAN_UNTAG case post-decrements info->num_encaps inside WARN_ON_ONCE(). num_encaps is u8, so if it's already 0 the decrement still happens and wraps it to 255. The …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Showing 861 to 880 of 12259.First page Next page

Severity critical: primary CNA CVSS 9.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-28T06:48:49.022Z. Updated 2026-10-21T12:46:41.589Z.

CVSS9.8v3.1KEVNot listedEPSSPresentUpdated21 Oct 2026, 19:46 WIB

Official record

HighPublished 28 Aug 2026, 13:48 WIB

CVE-2026-80633

iommufd: Take dma_resv lock before dma_buf_unpin() in release path

In the Linux kernel, the following vulnerability has been resolved: iommufd: Take dma_resv lock before dma_buf_unpin() in release path dma_buf_unpin() requires the caller to hold the exporter's dma_resv lock: void dma_buf_unpin(struct dma_buf_attachment *attach) { ... dma_resv_assert_held(dma…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-28T06:48:48.372Z. Updated 2026-08-29T06:21:32.731Z.

CVSS8.8v3.1KEVNot listedEPSSPresentUpdated29 Aug 2026, 13:21 WIB

Official record

UnscoredPublished 28 Aug 2026, 13:48 WIB

CVE-2026-80632

wifi: mt76: mt7996: Fix NULL pointer dereference in mt7996_init_tx_queues()

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7996: Fix NULL pointer dereference in mt7996_init_tx_queues() When MT76_NPU and CONFIG_NET_MEDIATEK_SOC_WED are enabled and mt76 detects properly the Airoha NPU SoC, mt7996_init_tx_queues() will dereference a NULL WED pointer. Fix the i…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-28T06:48:47.772Z. Updated 2026-08-28T06:48:47.772Z.

CVSS—KEVNot listedEPSSPresentUpdated28 Aug 2026, 13:48 WIB

Official record

HighPublished 28 Aug 2026, 13:48 WIB

CVE-2026-80631

btrfs: lzo: reject compressed segment that overflows the compressed input

In the Linux kernel, the following vulnerability has been resolved: btrfs: lzo: reject compressed segment that overflows the compressed input lzo_decompress_bio() validates each on-disk segment length seg_len only against the workspace cbuf size, not against the compressed input size (compressed_len, the total folio …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-28T06:48:47.166Z. Updated 2026-10-21T12:46:40.471Z.

CVSS7.5v3.1KEVNot listedEPSSPresentUpdated21 Oct 2026, 19:46 WIB

Official record

CritPublished 28 Aug 2026, 13:48 WIB

CVE-2026-80630

net/sched: sch_fq_codel: Do not call qdisc_tree_reduce_backlog during peek before restoring qlen

In the Linux kernel, the following vulnerability has been resolved: net/sched: sch_fq_codel: Do not call qdisc_tree_reduce_backlog during peek before restoring qlen Whenever fq_codel drops packets during peek, it calls qdisc_tree_reduce_backlog. An issue arises because it calls qdisc_tree_reduce_backlog before it rei…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-28T06:48:46.569Z. Updated 2026-10-16T19:26:31.257Z.

CVSS9.8v3.1KEVNot listedEPSSPresentUpdated17 Oct 2026, 02:26 WIB

Official record

UnscoredPublished 28 Aug 2026, 13:48 WIB

CVE-2026-80629

octeontx2-af: npc: Fix size of entry2cntr_map

In the Linux kernel, the following vulnerability has been resolved: octeontx2-af: npc: Fix size of entry2cntr_map KASAN prints below splat. This is caused by allocating counter for reserved mcam entry for cpt 2nd pass entry. But mcam->entry2cntr_map is not allocated for reserved entries. BUG: KASAN: slab-out-of-boun…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-28T06:48:45.976Z. Updated 2026-10-21T12:46:39.362Z.

CVSS—KEVNot listedEPSSPresentUpdated21 Oct 2026, 19:46 WIB

Official record

HighPublished 28 Aug 2026, 13:48 WIB

CVE-2026-80628

ALSA: seq: oss: Serialize readq reset state with q->lock

In the Linux kernel, the following vulnerability has been resolved: ALSA: seq: oss: Serialize readq reset state with q->lock snd_seq_oss_readq_clear() resets qlen, head, and tail without q->lock even though the normal reader and producer paths serialize the same ring state under that spinlock. A reset can therefore r…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-28T06:48:45.377Z. Updated 2026-10-21T12:46:38.235Z.

CVSS7.8v3.1KEVNot listedEPSSPresentUpdated21 Oct 2026, 19:46 WIB

Official record

UnscoredPublished 28 Aug 2026, 13:48 WIB

CVE-2026-80627

MIPS: mm: Fix out-of-bounds write in maar_res_walk()

In the Linux kernel, the following vulnerability has been resolved: MIPS: mm: Fix out-of-bounds write in maar_res_walk() maar_res_walk() uses wi->num_cfg as the index into the fixed-size wi->cfg array, but checks whether the array is full only after it has filled the selected entry. If walk_system_ram_range() reports…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-28T06:48:44.777Z. Updated 2026-08-28T06:48:44.777Z.

CVSS—KEVNot listedEPSSPresentUpdated28 Aug 2026, 13:48 WIB

Official record

UnscoredPublished 28 Aug 2026, 13:48 WIB

CVE-2026-80626

powerpc/perf: fix preempt count underflow in fsl_emb_pmu_del

In the Linux kernel, the following vulnerability has been resolved: powerpc/perf: fix preempt count underflow in fsl_emb_pmu_del fsl_emb_pmu_del() unconditionally calls put_cpu_var(cpu_hw_events) at the 'out:' label, but only calls the matching get_cpu_var() after the 'i < 0' early-return check. When event->hw.idx is…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-28T06:48:44.182Z. Updated 2026-08-28T06:48:44.182Z.

CVSS—KEVNot listedEPSSPresentUpdated28 Aug 2026, 13:48 WIB

Official record

UnscoredPublished 28 Aug 2026, 13:48 WIB

CVE-2026-80625

RDMA/hns: Fix memory leak of bonding resources

In the Linux kernel, the following vulnerability has been resolved: RDMA/hns: Fix memory leak of bonding resources In a corner case of concurrent driver removal and driver reset, bonding resource is first released in hns_roce_hw_v2_exit() during driver removal, and then is allocated again in hns_roce_register_device(…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-28T06:48:43.583Z. Updated 2026-08-28T06:48:43.583Z.

CVSS—KEVNot listedEPSSPresentUpdated28 Aug 2026, 13:48 WIB

Official record

UnscoredPublished 28 Aug 2026, 13:48 WIB

CVE-2026-80624

mfd: cs42l43: Sanity check firmware size

In the Linux kernel, the following vulnerability has been resolved: mfd: cs42l43: Sanity check firmware size Currently the code checks if a firmware was received, however it does not verify that the firmware size is larger than the firmware header. As the firmware pointer is dereferenced as a pointer to the header st…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-28T06:48:42.983Z. Updated 2026-08-28T06:48:42.983Z.

CVSS—KEVNot listedEPSSPresentUpdated28 Aug 2026, 13:48 WIB

Official record

UnscoredPublished 28 Aug 2026, 13:48 WIB

CVE-2026-80623

coresight: ete: Always save state on power down

In the Linux kernel, the following vulnerability has been resolved: coresight: ete: Always save state on power down System register ETMs and ETE are unlikely to be preserved on CPU power down. The ETE DT binding also never documented "arm,coresight-loses-context-with-cpu" so nobody would have legitimately been able t…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-28T06:48:42.371Z. Updated 2026-10-21T12:46:37.127Z.

CVSS—KEVNot listedEPSSPresentUpdated21 Oct 2026, 19:46 WIB

Official record

HighPublished 28 Aug 2026, 13:48 WIB

CVE-2026-80622

char: tlclk: fix use-after-free in tlclk_cleanup()

In the Linux kernel, the following vulnerability has been resolved: char: tlclk: fix use-after-free in tlclk_cleanup() This patch improves the module cleanup process in the tlclk driver to prevent potential use-after-free and race conditions. Currently, the file_operations structure does not specify the .owner field…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-28T06:48:41.744Z. Updated 2026-10-16T19:26:30.961Z.

CVSS7.8v3.1KEVNot listedEPSSPresentUpdated17 Oct 2026, 02:26 WIB

Official record

UnscoredPublished 28 Aug 2026, 13:48 WIB

CVE-2026-80621

PCI: dwc: Avoid dwc_pcie_rasdes_debugfs_deinit() NULL dereference when no RAS DES capability

In the Linux kernel, the following vulnerability has been resolved: PCI: dwc: Avoid dwc_pcie_rasdes_debugfs_deinit() NULL dereference when no RAS DES capability dwc_pcie_rasdes_debugfs_init() returns success when the controller has no RAS DES capability, leaving pci->debugfs->rasdes_info unset. The common debugfs tea…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-28T06:48:41.081Z. Updated 2026-08-28T06:48:41.081Z.

CVSS—KEVNot listedEPSSPresentUpdated28 Aug 2026, 13:48 WIB

Official record

UnscoredPublished 28 Aug 2026, 13:48 WIB

CVE-2026-80620

Revert "PCI/MSI: Unmap MSI-X region on error"

In the Linux kernel, the following vulnerability has been resolved: Revert "PCI/MSI: Unmap MSI-X region on error" This reverts commit 1a8d4c6ecb4c81261bcdf13556abd4a958eca202. Commit 1a8d4c6ecb4c ("PCI/MSI: Unmap MSI-X region on error") added an iounmap(dev->msix_base) on the error path of msix_capability_init() to …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-28T06:48:40.340Z. Updated 2026-08-28T06:48:40.340Z.

CVSS—KEVNot listedEPSSPresentUpdated28 Aug 2026, 13:48 WIB

Official record

HighPublished 28 Aug 2026, 13:48 WIB

CVE-2026-80619

apparmor: fix potential UAF in aa_replace_profiles

In the Linux kernel, the following vulnerability has been resolved: apparmor: fix potential UAF in aa_replace_profiles The function aa_replace_profiles was accessing udata->size after calling aa_put_loaddata(udata), causing a potential UAF. Fixed this by saving the size to a local variable before dropping the refere…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-28T06:48:38.702Z. Updated 2026-08-29T06:21:26.537Z.

CVSS7.8v3.1KEVNot listedEPSSPresentUpdated29 Aug 2026, 13:21 WIB

Official record

UnscoredPublished 28 Aug 2026, 13:48 WIB

CVE-2026-80618

drm/amdkfd: Avoid double-unpin of DOORBELL/MMIO BOs on free

In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Avoid double-unpin of DOORBELL/MMIO BOs on free amdgpu_amdkfd_gpuvm_free_memory_of_gpu() unpinned DOORBELL and MMIO remap BOs (which are pinned at allocation time) before checking whether the BO is still mapped to the GPU. When the BO is …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-28T06:48:38.112Z. Updated 2026-08-28T06:48:38.112Z.

CVSS—KEVNot listedEPSSPresentUpdated28 Aug 2026, 13:48 WIB

Official record

CritPublished 28 Aug 2026, 13:48 WIB

CVE-2026-80617

net: airoha: fix foe_check_time allocation size

In the Linux kernel, the following vulnerability has been resolved: net: airoha: fix foe_check_time allocation size foe_check_time is declared as u16 pointer but was allocated with only ppe_num_entries bytes instead of ppe_num_entries * sizeof(u16). When airoha_ppe_foe_verify_entry() is called with hash >= ppe_num_e…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-28T06:48:37.508Z. Updated 2026-08-29T06:21:25.270Z.

CVSS9.8v3.1KEVNot listedEPSSPresentUpdated29 Aug 2026, 13:21 WIB

Official record

UnscoredPublished 28 Aug 2026, 13:48 WIB

CVE-2026-80616

ieee802154: Avoid calling WARN_ON() on -ENOMEM in cfg802154_switch_netns()

In the Linux kernel, the following vulnerability has been resolved: ieee802154: Avoid calling WARN_ON() on -ENOMEM in cfg802154_switch_netns() It's pointless to call WARN_ON() in case of an allocation failure in dev_change_net_namespace() and device_rename(), since it only leads to useless splats caused by deliberate…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-28T06:48:36.911Z. Updated 2026-10-21T12:46:36.045Z.

CVSS—KEVNot listedEPSSPresentUpdated21 Oct 2026, 19:46 WIB

Official record