Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 12,259 published records · 20 KEV · 12,259 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

12,259 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit1,45512%
High4,59737%
Med3,35727%
Low3142.6%
None50.04%
Legacy00.00%
Unscored2,53121%

Matching records by UTC month

Aug 2612,259

Signal coverage

KEV-listed: 20
With a forecast: 12,259
Unknown date: 0
Unscored severity: 2,531

Share of cohort: KEV 0.16% · forecast 100% · unscored 21%.

Showing 801–820 of 12,259By severity band: Critical · 9.0–10.0 1,455, High · 7.0–8.9 4,597, Medium · 4.0–6.9 3,357, Low · 0.1–3.9 314, None · scored 0.0 5, Legacy · v2 only 0, Unscored · no CNA metric 2,531

UnscoredPublished 28 Aug 2026, 13:53 WIB

CVE-2026-80695

hwmon: (sht3x) Fix unaligned accesses

In the Linux kernel, the following vulnerability has been resolved: hwmon: (sht3x) Fix unaligned accesses Sashiko reports: In sht3x_update_client(), the 16-bit temperature and humidity values are extracted from a stack-allocated byte array using be16_to_cpup(). The pointers passed to this function are calculated as …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-28T06:53:01.037Z. Updated 2026-10-21T12:46:56.124Z.

CVSS—KEVNot listedEPSSPresentUpdated21 Oct 2026, 19:46 WIB

Official record

CritPublished 28 Aug 2026, 13:53 WIB

CVE-2026-80694

net: ethernet: mtk_eth_soc: pass eth to mtk_handle_irq_rx in poll_controller

In the Linux kernel, the following vulnerability has been resolved: net: ethernet: mtk_eth_soc: pass eth to mtk_handle_irq_rx in poll_controller mtk_handle_irq_rx expects a struct mtk_eth * (matching the request_irq cookie), but mtk_poll_controller incorrectly passed the net_device *. Calling ndo_poll_controller with…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Showing 801 to 820 of 12259.First page Next page

Published 2026-08-28T06:53:00.442Z. Updated 2026-10-21T12:46:55.044Z.

CVSS9.8v3.1KEVNot listedEPSSPresentUpdated21 Oct 2026, 19:46 WIB

Official record

CritPublished 28 Aug 2026, 13:52 WIB

CVE-2026-80693

idpf: bound interrupt-vector register fill to the allocated array

In the Linux kernel, the following vulnerability has been resolved: idpf: bound interrupt-vector register fill to the allocated array idpf_get_reg_intr_vecs() fills the caller-allocated reg_vals[] array from the VIRTCHNL2_OP_ALLOC_VECTORS reply in adapter->req_vec_chunks, bounding its inner loop only by the per-chunk…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-28T06:52:56.131Z. Updated 2026-10-21T12:46:53.892Z.

CVSS9.3v3.1KEVNot listedEPSSPresentUpdated21 Oct 2026, 19:46 WIB

Official record

HighPublished 28 Aug 2026, 13:52 WIB

CVE-2026-80692

Bluetooth: hci_sync: hold conn in hci_connect_acl/le_sync() callbacks

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_sync: hold conn in hci_connect_acl/le_sync() callbacks There is theoretical UAF if the conn is freed while the hci_sync task is running. Hold refcount to avoid that.

Excerpt language: en.

Severity high: primary CNA CVSS 8.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-28T06:52:55.529Z. Updated 2026-10-21T12:46:52.785Z.

CVSS8.8v3.1KEVNot listedEPSSPresentUpdated21 Oct 2026, 19:46 WIB

Official record

HighPublished 28 Aug 2026, 13:52 WIB

CVE-2026-80691

scsi: target: iblock: Fix wrong PR ops NULL check for PREEMPT/RELEASE

In the Linux kernel, the following vulnerability has been resolved: scsi: target: iblock: Fix wrong PR ops NULL check for PREEMPT/RELEASE In the iblock_execute_pr_out() function, PRO_PREEMPT, PRO_PREEMPT_AND_ABORT, and PRO_RELEASE all perform callback capability checks through ops->pr_clear. The error check allows un…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-28T06:52:54.933Z. Updated 2026-10-16T19:26:33.427Z.

CVSS7.5v3.1KEVNot listedEPSSPresentUpdated17 Oct 2026, 02:26 WIB

Official record

UnscoredPublished 28 Aug 2026, 13:52 WIB

CVE-2026-80690

scsi: ufs: core: Initialize hba->rpmbs list in ufshcd

In the Linux kernel, the following vulnerability has been resolved: scsi: ufs: core: Initialize hba->rpmbs list in ufshcd Initialize the hba->rpmbs list in ufshcd_alloc_host() to prevent NULL pointer dereference in the device teardown path if ufs_rpmb_probe() fails.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-28T06:52:54.325Z. Updated 2026-08-28T06:52:54.325Z.

CVSS—KEVNot listedEPSSPresentUpdated28 Aug 2026, 13:52 WIB

Official record

UnscoredPublished 28 Aug 2026, 13:52 WIB

CVE-2026-80689

tracing/mmiotrace: Add NULL check for mmio_trace_array in logging functions

In the Linux kernel, the following vulnerability has been resolved: tracing/mmiotrace: Add NULL check for mmio_trace_array in logging functions mmio_trace_rw() and mmio_trace_mapping() retrieve mmio_trace_array into tr and pass it to __trace_mmiotrace_rw() and __trace_mmiotrace_map(). If these functions are invoked w…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-28T06:52:53.724Z. Updated 2026-09-14T11:58:50.409Z.

CVSS—KEVNot listedEPSSPresentUpdated14 Sep 2026, 18:58 WIB

Official record

UnscoredPublished 28 Aug 2026, 13:52 WIB

CVE-2026-80688

riscv: drop __init from vec_check_unaligned_access_speed_all_cpus

In the Linux kernel, the following vulnerability has been resolved: riscv: drop __init from vec_check_unaligned_access_speed_all_cpus This function runs within a kthread and need not necessarily finish before system finishes boot and free_initmem() unmaps the .init.text section. This function makes calls to SBI for p…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-28T06:52:53.126Z. Updated 2026-08-28T06:52:53.126Z.

CVSS—KEVNot listedEPSSPresentUpdated28 Aug 2026, 13:52 WIB

Official record

UnscoredPublished 28 Aug 2026, 13:52 WIB

CVE-2026-80687

iommufd/viommu: Release the igroup lock on the vdevice_size error path

In the Linux kernel, the following vulnerability has been resolved: iommufd/viommu: Release the igroup lock on the vdevice_size error path iommufd_vdevice_alloc_ioctl() takes idev->igroup->lock, then validates the driver's vdevice_size against the core structure size with a WARN_ON_ONCE. On failure that guard jumps t…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-28T06:52:52.512Z. Updated 2026-08-28T06:52:52.512Z.

CVSS—KEVNot listedEPSSPresentUpdated28 Aug 2026, 13:52 WIB

Official record

UnscoredPublished 28 Aug 2026, 13:52 WIB

CVE-2026-80686

mm: migrate_device: fix pte_pfn/pte_dirty called on non-present PTE

In the Linux kernel, the following vulnerability has been resolved: mm: migrate_device: fix pte_pfn/pte_dirty called on non-present PTE pte_pfn() and pte_dirty() have undefined behaviour when called on a non-present PTE. In migrate_vma_collect_pmd(), these functions may be invoked on non-present entries (e.g., device…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-28T06:52:51.924Z. Updated 2026-08-28T06:52:51.924Z.

CVSS—KEVNot listedEPSSPresentUpdated28 Aug 2026, 13:52 WIB

Official record

HighPublished 28 Aug 2026, 13:52 WIB

CVE-2026-80685

mm/util: don't read __page_2 for order-1 folios in snapshot_page()

In the Linux kernel, the following vulnerability has been resolved: mm/util: don't read __page_2 for order-1 folios in snapshot_page() snapshot_page() currently reads __page_2 after checking nr_pages > 1, but it should only do so when nr_pages > 2. If an order-1 folio is allocated at the end of a vmemmap section, __…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-28T06:52:51.305Z. Updated 2026-09-21T13:14:10.006Z.

CVSS7.1v3.1KEVNot listedEPSSPresentUpdated21 Sep 2026, 20:14 WIB

Official record

CritPublished 28 Aug 2026, 13:52 WIB

CVE-2026-80684

KVM: s390: pci: Fix NULL dereference on AIBV allocation failure

In the Linux kernel, the following vulnerability has been resolved: KVM: s390: pci: Fix NULL dereference on AIBV allocation failure The airq_iv_create() can return NULL on failure, but the return value was never checked. If it fails, zdev->aibv will be NULL and fail when dereferenced in kvm_zpci_set_airq(). Add a NUL…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-28T06:52:50.703Z. Updated 2026-10-16T19:26:33.268Z.

CVSS9.3v3.1KEVNot listedEPSSPresentUpdated17 Oct 2026, 02:26 WIB

Official record

HighPublished 28 Aug 2026, 13:52 WIB

CVE-2026-80683

Bluetooth: SCO: give the socket its own sco_conn reference

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: SCO: give the socket its own sco_conn reference sco_conn_del() drops a reference it does not own. It takes one transient reference via sco_conn_hold_unless_zero() and releases it with the sco_conn_put() that follows sco_sock_hold(); the ad…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-28T06:52:50.099Z. Updated 2026-10-16T19:26:33.090Z.

CVSS8.8v3.1KEVNot listedEPSSPresentUpdated17 Oct 2026, 02:26 WIB

Official record

HighPublished 28 Aug 2026, 13:52 WIB

CVE-2026-80682

riscv/mm: use physical alignment for vmemmap_start_pfn

In the Linux kernel, the following vulnerability has been resolved: riscv/mm: use physical alignment for vmemmap_start_pfn RISC-V computes vmemmap_start_pfn by rounding phys_ram_base down to VMEMMAP_ADDR_ALIGN. That alignment must therefore be expressed in the physical-address domain. Commit 476849b0fba4 ("riscv/mm…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-28T06:52:49.498Z. Updated 2026-08-29T06:22:09.064Z.

CVSS7.8v3.1KEVNot listedEPSSPresentUpdated29 Aug 2026, 13:22 WIB

Official record

CritPublished 28 Aug 2026, 13:52 WIB

CVE-2026-80681

vxlan: re-fetch eth header after route_shortcircuit()

In the Linux kernel, the following vulnerability has been resolved: vxlan: re-fetch eth header after route_shortcircuit() Before route_shortcircuit(), the eth header pointer is cached from eth_hdr(skb). Inside route_shortcircuit(), pskb_may_pull() can be called, which may reallocate skb->head. In this case, returni…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-28T06:52:48.896Z. Updated 2026-10-16T19:26:32.921Z.

CVSS9.8v3.1KEVNot listedEPSSPresentUpdated17 Oct 2026, 02:26 WIB

Official record

HighPublished 28 Aug 2026, 13:52 WIB

CVE-2026-80680

i2c: amd-mp2: Unregister callback on adapter add failure

In the Linux kernel, the following vulnerability has been resolved: i2c: amd-mp2: Unregister callback on adapter add failure amd_mp2_register_cb() stores the platform I2C context in the MP2 PCI driver's callback table before the adapter is registered. If i2c_add_adapter() fails, probe returns and devres frees the con…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-28T06:52:48.300Z. Updated 2026-08-29T06:22:06.613Z.

CVSS7.8v3.1KEVNot listedEPSSPresentUpdated29 Aug 2026, 13:22 WIB

Official record

UnscoredPublished 28 Aug 2026, 13:52 WIB

CVE-2026-80679

s390/dasd: Fix potential NULL pointer dereference

In the Linux kernel, the following vulnerability has been resolved: s390/dasd: Fix potential NULL pointer dereference dasd_release_space() checks the implementation of the is_ese() discipline function before calling it to determine if a given device is an ESE DASD. The current usage of the logical AND operator will …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-28T06:52:47.682Z. Updated 2026-08-28T06:52:47.682Z.

CVSS—KEVNot listedEPSSPresentUpdated28 Aug 2026, 13:52 WIB

Official record

HighPublished 28 Aug 2026, 13:52 WIB

CVE-2026-80678

i2c: imx: Fix slave registration race and error handling

In the Linux kernel, the following vulnerability has been resolved: i2c: imx: Fix slave registration race and error handling In i2c_imx_reg_slave(), the slave pointer was assigned before pm_runtime_resume_and_get(). If pm_runtime_resume_and_get() failed, the error path returned without clearing i2c_imx->slave, leavi…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.4 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-28T06:52:47.077Z. Updated 2026-10-16T19:26:32.757Z.

CVSS8.4v3.1KEVNot listedEPSSPresentUpdated17 Oct 2026, 02:26 WIB

Official record

HighPublished 28 Aug 2026, 13:49 WIB

CVE-2026-80677

driver core: use READ_ONCE() for dev->driver in dev_has_sync_state()

In the Linux kernel, the following vulnerability has been resolved: driver core: use READ_ONCE() for dev->driver in dev_has_sync_state() dev_has_sync_state() reads dev->driver twice without holding device_lock() -- once for the NULL check and once to dereference ->sync_state. Some callers only hold device_links_write…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-28T06:49:15.507Z. Updated 2026-10-16T19:26:32.494Z.

CVSS7.8v3.1KEVNot listedEPSSPresentUpdated17 Oct 2026, 02:26 WIB

Official record

UnscoredPublished 28 Aug 2026, 13:49 WIB

CVE-2026-80676

Drivers: hv: vmbus: use generic driver_override infrastructure

In the Linux kernel, the following vulnerability has been resolved: Drivers: hv: vmbus: use generic driver_override infrastructure When a driver is probed through __driver_attach(), the bus' match() callback is called without the device lock held, thus accessing the driver_override field without a lock, which can cau…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-28T06:49:14.747Z. Updated 2026-10-21T12:46:51.475Z.

CVSS—KEVNot listedEPSSPresentUpdated21 Oct 2026, 19:46 WIB

Official record