Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 6,933 published records · 23 KEV · 6,933 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

6,933 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit5588.0%
High2,11831%
Med2,24432%
Low2403.5%
None90.13%
Legacy00.00%
Unscored1,76425%

Matching records by UTC month

May 266,933

Signal coverage

KEV-listed: 23
With a forecast: 6,933
Unknown date: 0
Unscored severity: 1,764

Share of cohort: KEV 0.33% · forecast 100% · unscored 25%.

Showing 801–820 of 6,933By severity band: Critical · 9.0–10.0 558, High · 7.0–8.9 2,118, Medium · 4.0–6.9 2,244, Low · 0.1–3.9 240, None · scored 0.0 9, Legacy · v2 only 0, Unscored · no CNA metric 1,764

UnscoredPublished 28 May 2026, 16:35 WIB

CVE-2026-46126

RDMA/mana: Fix mana_destroy_wq_obj() cleanup in mana_ib_create_qp_rss()

In the Linux kernel, the following vulnerability has been resolved: RDMA/mana: Fix mana_destroy_wq_obj() cleanup in mana_ib_create_qp_rss() Sashiko points out there are two bugs here in the error unwind flow, both related to how the WQ table is unwound. First there is a double i-- on the first failure path due to th…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-05-28T09:35:41.364Z. Updated 2026-06-14T17:56:23.136Z.

CVSS—KEVNot listedEPSSPresentUpdated15 Jun 2026, 00:56 WIB

Official record

HighPublished 28 May 2026, 16:35 WIB

CVE-2026-46125

wifi: mac80211: remove station if connection prep fails

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: remove station if connection prep fails If connection preparation fails for MLO connections, then the interface is completely reset to non-MLD. In this case, we must not keep the station since it's related to the link of the vif being…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Showing 801 to 820 of 6933.First page Next page

Published 2026-05-28T09:35:39.809Z. Updated 2026-10-19T19:36:51.538Z.

CVSS8.8v3.1KEVNot listedEPSSPresentUpdated20 Oct 2026, 02:36 WIB

Official record

HighPublished 28 May 2026, 16:35 WIB

CVE-2026-46124

isofs: validate block number from NFS file handle in isofs_export_iget

In the Linux kernel, the following vulnerability has been resolved: isofs: validate block number from NFS file handle in isofs_export_iget isofs_fh_to_dentry() and isofs_fh_to_parent() pass an attacker- controlled block number (ifid->block or ifid->parent_block) from the NFS file handle to isofs_export_iget(), which …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-05-28T09:35:38.887Z. Updated 2026-10-19T19:36:51.382Z.

CVSS7.5v3.1KEVNot listedEPSSPresentUpdated20 Oct 2026, 02:36 WIB

Official record

HighPublished 28 May 2026, 16:35 WIB

CVE-2026-46123

Bluetooth: virtio_bt: clamp rx length before skb_put

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: virtio_bt: clamp rx length before skb_put virtbt_rx_work() calls skb_put(skb, len) where len comes directly from virtqueue_get_buf() with no validation against the buffer we posted to the device. The RX skb is allocated in virtbt_add_inbuf…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.7 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-05-28T09:35:38.003Z. Updated 2026-08-05T12:29:52.762Z.

CVSS7.7v3.1KEVNot listedEPSSPresentUpdated05 Aug 2026, 19:29 WIB

Official record

UnscoredPublished 28 May 2026, 16:35 WIB

CVE-2026-46122

wifi: b43: enforce bounds check on firmware key index in b43_rx()

In the Linux kernel, the following vulnerability has been resolved: wifi: b43: enforce bounds check on firmware key index in b43_rx() The firmware-controlled key index in b43_rx() can exceed the dev->key[] array size (58 entries). The existing B43_WARN_ON is non-enforcing in production builds, allowing an out-of-boun…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-05-28T09:35:37.141Z. Updated 2026-10-15T01:20:39.214Z.

CVSS—KEVNot listedEPSSPresentUpdated15 Oct 2026, 08:20 WIB

Official record

UnscoredPublished 28 May 2026, 16:35 WIB

CVE-2026-46121

mm/damon/sysfs-schemes: protect memcg_path kfree() with damon_sysfs_lock

In the Linux kernel, the following vulnerability has been resolved: mm/damon/sysfs-schemes: protect memcg_path kfree() with damon_sysfs_lock Patch series "mm/damon/sysfs-schemes: fix use-after-free for [memcg_]path". Reads of 'memcg_path' and 'path' files in DAMON sysfs interface could race with their writes, result…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-05-28T09:35:36.292Z. Updated 2026-06-14T17:55:59.503Z.

CVSS—KEVNot listedEPSSPresentUpdated15 Jun 2026, 00:55 WIB

Official record

HighPublished 28 May 2026, 16:35 WIB

CVE-2026-46120

ip6_gre: Use cached t->net in ip6erspan_changelink().

In the Linux kernel, the following vulnerability has been resolved: ip6_gre: Use cached t->net in ip6erspan_changelink(). After commit 5e72ce3e3980 ("net: ipv6: Use link netns in newlink() of rtnl_link_ops"), ip6erspan_newlink() correctly resolves the per-netns ip6gre hash via link_net. ip6erspan_changelink() was not…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-05-28T09:35:35.385Z. Updated 2026-10-19T19:36:51.221Z.

CVSS7.8v3.1KEVNot listedEPSSPresentUpdated20 Oct 2026, 02:36 WIB

Official record

CritPublished 28 May 2026, 16:35 WIB

CVE-2026-46119

libceph: Fix slab-out-of-bounds access in auth message processing

In the Linux kernel, the following vulnerability has been resolved: libceph: Fix slab-out-of-bounds access in auth message processing If a (potentially corrupted) message of type CEPH_MSG_AUTH_REPLY contains a positive value in its result field, it is treated as an error code by ceph_handle_auth_reply() and returned …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-05-28T09:35:34.543Z. Updated 2026-10-19T19:26:44.844Z.

CVSS9.1v3.1KEVNot listedEPSSPresentUpdated20 Oct 2026, 02:26 WIB

Official record

UnscoredPublished 28 May 2026, 16:35 WIB

CVE-2026-46118

pseries/papr-hvpipe: Fix null ptr deref in papr_hvpipe_dev_create_handle()

In the Linux kernel, the following vulnerability has been resolved: pseries/papr-hvpipe: Fix null ptr deref in papr_hvpipe_dev_create_handle() commit 6d3789d347a7 ("papr-hvpipe: convert papr_hvpipe_dev_create_handle() to FD_PREPARE()"), changed the create handle to FD_PREPARE(), but it caused kernel null-ptr-deref be…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-05-28T09:35:33.635Z. Updated 2026-10-15T10:07:24.840Z.

CVSS—KEVNot listedEPSSPresentUpdated15 Oct 2026, 17:07 WIB

Official record

HighPublished 28 May 2026, 16:35 WIB

CVE-2026-46117

RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss()

In the Linux kernel, the following vulnerability has been resolved: RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() Sashiko points out that the user can specify WQs sharing the same CQ as a part of the uAPI and this will trigger the WARN_ON() then go on to corrupt the kernel. Just reject it o…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-05-28T09:35:32.344Z. Updated 2026-10-19T19:26:44.688Z.

CVSS7.8v3.1KEVNot listedEPSSPresentUpdated20 Oct 2026, 02:26 WIB

Official record

HighPublished 28 May 2026, 16:35 WIB

CVE-2026-46116

xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete

In the Linux kernel, the following vulnerability has been resolved: xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete KASAN reproduces a slab-use-after-free in __xfrm_state_delete()'s hlist_del_rcu calls under syzkaller load on linux-6.12.y stable (reproduced on 6.12.47, also reachable via the same cod…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-05-28T09:35:30.689Z. Updated 2026-10-19T19:26:44.530Z.

CVSS7.8v3.1KEVNot listedEPSSPresentUpdated20 Oct 2026, 02:26 WIB

Official record

CritPublished 28 May 2026, 16:35 WIB

CVE-2026-46115

block: add pgmap check to biovec_phys_mergeable

In the Linux kernel, the following vulnerability has been resolved: block: add pgmap check to biovec_phys_mergeable biovec_phys_mergeable() is used by the request merge, DMA mapping, and integrity merge paths to decide if two physically contiguous bvec segments can be coalesced into one. It currently has no check for…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-05-28T09:35:26.735Z. Updated 2026-10-19T19:26:44.371Z.

CVSS9.8v3.1KEVNot listedEPSSPresentUpdated20 Oct 2026, 02:26 WIB

Official record

HighPublished 28 May 2026, 16:35 WIB

CVE-2026-46114

RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads

In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads atomic_write_reply() at drivers/infiniband/sw/rxe/rxe_resp.c unconditionally dereferences 8 bytes at payload_addr(pkt): value = *(u64 *)payload_addr(pkt); check_rkey() previously accepted an ATO…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-05-28T09:35:24.638Z. Updated 2026-10-19T19:26:44.201Z.

CVSS7.5v3.1KEVNot listedEPSSPresentUpdated20 Oct 2026, 02:26 WIB

Official record

HighPublished 28 May 2026, 16:35 WIB

CVE-2026-46113

KVM: x86: Fix shadow paging use-after-free due to unexpected GFN

In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Fix shadow paging use-after-free due to unexpected GFN The shadow MMU computes GFNs for direct shadow pages using sp->gfn plus the SPTE index. This assumption breaks for shadow paging if the guest page tables are modified between VM entries…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-05-28T09:35:23.035Z. Updated 2026-10-19T19:26:44.053Z.

CVSS8.8v3.1KEVNot listedEPSSPresentUpdated20 Oct 2026, 02:26 WIB

Official record

HighPublished 28 May 2026, 16:35 WIB

CVE-2026-46112

RDMA/hns: Fix unlocked call to hns_roce_qp_remove()

In the Linux kernel, the following vulnerability has been resolved: RDMA/hns: Fix unlocked call to hns_roce_qp_remove() Sashiko points out that hns_roce_qp_remove() requires the caller to hold locks. The error flow in hns_roce_create_qp_common() doesn't hold those locks for the error unwind so it risks corrupting me…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-05-28T09:35:20.879Z. Updated 2026-08-05T12:29:44.058Z.

CVSS7.8v3.1KEVNot listedEPSSPresentUpdated05 Aug 2026, 19:29 WIB

Official record

HighPublished 28 May 2026, 16:35 WIB

CVE-2026-46111

Bluetooth: hci_conn: fix potential UAF in create_big_sync

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_conn: fix potential UAF in create_big_sync Add hci_conn_valid() check in create_big_sync() to detect stale connections before proceeding with BIG creation. Handle the resulting -ECANCELED in create_big_complete() and re-validate the co…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-05-28T09:35:19.970Z. Updated 2026-10-19T19:26:43.906Z.

CVSS7.8v3.1KEVNot listedEPSSPresentUpdated20 Oct 2026, 02:26 WIB

Official record

HighPublished 28 May 2026, 16:35 WIB

CVE-2026-46110

net: stmmac: Prevent NULL deref when RX memory exhausted

In the Linux kernel, the following vulnerability has been resolved: net: stmmac: Prevent NULL deref when RX memory exhausted The CPU receives frames from the MAC through conventional DMA: the CPU allocates buffers for the MAC, then the MAC fills them and returns ownership to the CPU. For each hardware RX queue, the C…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-05-28T09:35:18.359Z. Updated 2026-10-15T01:20:33.839Z.

CVSS7.5v3.1KEVNot listedEPSSPresentUpdated15 Oct 2026, 08:20 WIB

Official record

UnscoredPublished 28 May 2026, 16:35 WIB

CVE-2026-46109

usb: ulpi: fix memory leak on ulpi_register() error paths

In the Linux kernel, the following vulnerability has been resolved: usb: ulpi: fix memory leak on ulpi_register() error paths Commit 01af542392b5 ("usb: ulpi: fix double free in ulpi_register_interface() error path") removed kfree(ulpi) from ulpi_register_interface() to fix a double-free when device_register() fails.…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-05-28T09:35:16.409Z. Updated 2026-06-14T17:55:07.015Z.

CVSS—KEVNot listedEPSSPresentUpdated15 Jun 2026, 00:55 WIB

Official record

UnscoredPublished 28 May 2026, 16:35 WIB

CVE-2026-46108

ipmi:si: Return state to normal if message allocation fails

In the Linux kernel, the following vulnerability has been resolved: ipmi:si: Return state to normal if message allocation fails There were places where nothing would get started if a message allocation failed, so the driver needs to return to normal state.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-05-28T09:35:14.978Z. Updated 2026-06-14T17:55:01.962Z.

CVSS—KEVNot listedEPSSPresentUpdated15 Jun 2026, 00:55 WIB

Official record

HighPublished 28 May 2026, 16:35 WIB

CVE-2026-46107

dm-thin: fix metadata refcount underflow

In the Linux kernel, the following vulnerability has been resolved: dm-thin: fix metadata refcount underflow There's a bug in dm-thin in the function rebalance_children. If the internal btree node has one entry, the code tries to copy all btree entries from the node's child to the node itself and then decrement the c…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-05-28T09:35:13.051Z. Updated 2026-10-19T19:26:43.751Z.

CVSS7.8v3.1KEVNot listedEPSSPresentUpdated20 Oct 2026, 02:26 WIB

Official record