Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 16,156 published records · 20 KEV · 16,156 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

16,156 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit1,2247.6%
High5,34833%
Med5,51434%
Low5143.2%
None00.00%
Legacy00.00%
Unscored3,55622%

Matching records by UTC month

Oct 2616,156

Signal coverage

KEV-listed: 20
With a forecast: 16,156
Unknown date: 0
Unscored severity: 3,556

Share of cohort: KEV 0.12% · forecast 100% · unscored 22%.

Showing 821–840 of 16,156By severity band: Critical · 9.0–10.0 1,224, High · 7.0–8.9 5,348, Medium · 4.0–6.9 5,514, Low · 0.1–3.9 514, None · scored 0.0 0, Legacy · v2 only 0, Unscored · no CNA metric 3,556

UnscoredPublished 28 Oct 2026, 17:34 WIB

CVE-2026-99124

s390/pci: Fix leak of uninitialized kernel data in SCLP report

In the Linux kernel, the following vulnerability has been resolved: s390/pci: Fix leak of uninitialized kernel data in SCLP report While report_error_write() checks that the provided buffer is at least as large as the header struct, but not that it is large enough to contain the report with the length claimed by repo…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-28T10:34:39.370Z. Updated 2026-10-28T10:34:39.370Z.

CVSS—KEVNot listedEPSSPresentUpdated28 Oct 2026, 17:34 WIB

Official record

UnscoredPublished 28 Oct 2026, 17:34 WIB

CVE-2026-99123

vsock/virtio: validate packet source for connected sockets

In the Linux kernel, the following vulnerability has been resolved: vsock/virtio: validate packet source for connected sockets virtio_transport_recv_pkt() looks up sockets first by the full source and destination tuple, then by destination only in the bound table. The fallback is needed for listening and connecting s…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Showing 821 to 840 of 16156.First page Next page

Published 2026-10-28T10:34:38.600Z. Updated 2026-10-28T10:34:38.600Z.

CVSS—KEVNot listedEPSSPresentUpdated28 Oct 2026, 17:34 WIB

Official record

UnscoredPublished 28 Oct 2026, 17:34 WIB

CVE-2026-99122

vsock/vmci: validate packet source for connected sockets

In the Linux kernel, the following vulnerability has been resolved: vsock/vmci: validate packet source for connected sockets vmci_transport_recv_stream_cb() looks up sockets first by the full source and destination tuple, then by destination only in the bound table. The fallback can select a non-listening socket with…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-28T10:34:37.859Z. Updated 2026-10-28T10:34:37.859Z.

CVSS—KEVNot listedEPSSPresentUpdated28 Oct 2026, 17:34 WIB

Official record

UnscoredPublished 28 Oct 2026, 17:34 WIB

CVE-2026-99121

ipv4: avoid divide by zero in fib_rebalance

In the Linux kernel, the following vulnerability has been resolved: ipv4: avoid divide by zero in fib_rebalance fib_rebalance() computes the total eligible nexthop weight in one pass and programs upper bounds in a second pass. A concurrent change to ignore_routes_with_linkdown can make the first pass return zero whil…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-28T10:34:37.082Z. Updated 2026-10-28T10:34:37.082Z.

CVSS—KEVNot listedEPSSPresentUpdated28 Oct 2026, 17:34 WIB

Official record

UnscoredPublished 28 Oct 2026, 17:34 WIB

CVE-2026-99120

KVM: x86/mmu: Cope with the SS bit being set in #NPF exit codes

In the Linux kernel, the following vulnerability has been resolved: KVM: x86/mmu: Cope with the SS bit being set in #NPF exit codes When running Hyper-V from Windows 11, KVM is seeing the SS bit set in nested page fault error codes produced for shadowed NPT. The AMD manual is unclear about when SS is set, including …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-28T10:34:36.224Z. Updated 2026-10-28T10:34:36.224Z.

CVSS—KEVNot listedEPSSPresentUpdated28 Oct 2026, 17:34 WIB

Official record

UnscoredPublished 28 Oct 2026, 17:34 WIB

CVE-2026-99119

drm/amdgpu/userq: actually validate userq BOs

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/userq: actually validate userq BOs This was supposed to loop over the individual evicted list, as the kernel and always_valid evicted lists were already handled in amdgpu_vm_validate. Without this, BOs that were created and evicted before…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-28T10:34:35.364Z. Updated 2026-10-28T10:34:35.364Z.

CVSS—KEVNot listedEPSSPresentUpdated28 Oct 2026, 17:34 WIB

Official record

UnscoredPublished 28 Oct 2026, 17:34 WIB

CVE-2026-99118

drm/i915/dmc: Harden DMC firmware payload parsing

In the Linux kernel, the following vulnerability has been resolved: drm/i915/dmc: Harden DMC firmware payload parsing Validate the conversion of the DMC firmware size from dwords to bytes using check_mul_overflow() before calculating the firmware payload size. Reject zero-length payloads and zero MMIO counts in the …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-28T10:34:34.627Z. Updated 2026-10-28T10:34:34.627Z.

CVSS—KEVNot listedEPSSPresentUpdated28 Oct 2026, 17:34 WIB

Official record

UnscoredPublished 28 Oct 2026, 17:34 WIB

CVE-2026-99117

net: bridge: mcast: don't truncate the port group walk on teardown

In the Linux kernel, the following vulnerability has been resolved: net: bridge: mcast: don't truncate the port group walk on teardown __br_multicast_disable_port_ctx() and br_multicast_del_port() walk port->mglist with hlist_for_each_entry_safe(). However, br_multicast_find_del_pg() can also delete other entries fro…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-28T10:34:33.874Z. Updated 2026-10-28T10:34:33.874Z.

CVSS—KEVNot listedEPSSPresentUpdated28 Oct 2026, 17:34 WIB

Official record

UnscoredPublished 28 Oct 2026, 17:34 WIB

CVE-2026-99116

net: psp: do not inherit the Rx association on clone

In the Linux kernel, the following vulnerability has been resolved: net: psp: do not inherit the Rx association on clone sk->psp_assoc sits past sk_dontcopy_end, so sock_copy() copies it into every socket accepted from a listener without taking a reference, while inet_sock_destruct() puts for every inet socket. psp_t…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-28T10:34:33.109Z. Updated 2026-10-28T10:34:33.109Z.

CVSS—KEVNot listedEPSSPresentUpdated28 Oct 2026, 17:34 WIB

Official record

UnscoredPublished 28 Oct 2026, 17:34 WIB

CVE-2026-99115

ksmbd: fill in FileSysIdentifier in FS_POSIX_INFORMATION

In the Linux kernel, the following vulnerability has been resolved: ksmbd: fill in FileSysIdentifier in FS_POSIX_INFORMATION smb2_get_info_filesystem() reports 56 bytes for FS_POSIX_INFORMATION, that is the whole of FILE_SYSTEM_POSIX_INFO, but never assigns FileSysIdentifier. Those eight bytes go to the client as th…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-28T10:34:32.347Z. Updated 2026-10-28T10:34:32.347Z.

CVSS—KEVNot listedEPSSPresentUpdated28 Oct 2026, 17:34 WIB

Official record

UnscoredPublished 28 Oct 2026, 17:34 WIB

CVE-2026-99114

ksmbd: initialize FileSystemControlFlags in FS_CONTROL_INFORMATION

In the Linux kernel, the following vulnerability has been resolved: ksmbd: initialize FileSystemControlFlags in FS_CONTROL_INFORMATION smb2_get_info_filesystem() reports 48 bytes for FS_CONTROL_INFORMATION, that is the whole of struct smb2_fs_control_info, but never assigns FileSystemControlFlags. Those four bytes g…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-28T10:34:31.576Z. Updated 2026-10-28T10:34:31.576Z.

CVSS—KEVNot listedEPSSPresentUpdated28 Oct 2026, 17:34 WIB

Official record

UnscoredPublished 28 Oct 2026, 17:34 WIB

CVE-2026-99113

ksmbd: zero the FS_OBJECT_ID_INFORMATION buffer before filling it in

In the Linux kernel, the following vulnerability has been resolved: ksmbd: zero the FS_OBJECT_ID_INFORMATION buffer before filling it in smb2_get_info_filesystem() reports 64 bytes for FS_OBJECT_ID_INFORMATION, that is the whole of struct object_id_info, but writes only 46 of them: - objid[] is 16 bytes, and when t…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-28T10:34:30.767Z. Updated 2026-10-28T10:34:30.767Z.

CVSS—KEVNot listedEPSSPresentUpdated28 Oct 2026, 17:34 WIB

Official record

UnscoredPublished 28 Oct 2026, 17:34 WIB

CVE-2026-99112

net/sched: cls_flower: validate mask pointer after nla_next()

In the Linux kernel, the following vulnerability has been resolved: net/sched: cls_flower: validate mask pointer after nla_next() fl_set_enc_opt() iterates the key's nested tunnel-option attributes with nla_for_each_attr() while advancing a single mask pointer via nla_next() at the bottom of each loop, so the mask cu…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-28T10:34:29.881Z. Updated 2026-10-28T10:34:29.881Z.

CVSS—KEVNot listedEPSSPresentUpdated28 Oct 2026, 17:34 WIB

Official record

UnscoredPublished 28 Oct 2026, 17:34 WIB

CVE-2026-99111

smb: client: fix data corruption with concurrent writes and O_TRUNC

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix data corruption with concurrent writes and O_TRUNC cifs_do_truncate() flushes dirty pages with filemap_write_and_wait() and truncates the file on the server, but in the old code both operations ran without holding i_rwsem or invalida…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-28T10:34:29.053Z. Updated 2026-10-28T10:34:29.053Z.

CVSS—KEVNot listedEPSSPresentUpdated28 Oct 2026, 17:34 WIB

Official record

UnscoredPublished 28 Oct 2026, 17:34 WIB

CVE-2026-99110

smb: client: fix heap overflow in cifs_do_set_acl()

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix heap overflow in cifs_do_set_acl() cifs_set_acl() validates ACL size using posix_acl_xattr_size(): 4 + (count * 8) // 4-byte header + 8 bytes per ACE cifs_do_set_acl() then calls posix_acl_to_cifs() to write the CIFS wire …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-28T10:34:28.239Z. Updated 2026-10-28T10:34:28.239Z.

CVSS—KEVNot listedEPSSPresentUpdated28 Oct 2026, 17:34 WIB

Official record

UnscoredPublished 28 Oct 2026, 17:34 WIB

CVE-2026-99109

smb: client: reject SetEA requests that do not fit the request buffer

In the Linux kernel, the following vulnerability has been resolved: smb: client: reject SetEA requests that do not fit the request buffer CIFSSMBSetEA() copies the caller's extended attribute value into the SMB request buffer without checking that it fits. The requirement is stated in the source but was never implem…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-28T10:34:27.507Z. Updated 2026-10-28T10:34:27.507Z.

CVSS—KEVNot listedEPSSPresentUpdated28 Oct 2026, 17:34 WIB

Official record

UnscoredPublished 28 Oct 2026, 17:34 WIB

CVE-2026-99108

ntfs: fix FITRIM range alignment

In the Linux kernel, the following vulnerability has been resolved: ntfs: fix FITRIM range alignment ntfs_trim_fs() aligns the start of a free extent up to the device discard granularity, but derives the discard length by aligning the original extent length down. When the free extent start is not discard-aligned, add…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-28T10:34:26.772Z. Updated 2026-10-28T10:34:26.772Z.

CVSS—KEVNot listedEPSSPresentUpdated28 Oct 2026, 17:34 WIB

Official record

UnscoredPublished 28 Oct 2026, 17:34 WIB

CVE-2026-99107

ntfs: fix incorrect MFT record pointer passed to ntfs_attr_record_resize

In the Linux kernel, the following vulnerability has been resolved: ntfs: fix incorrect MFT record pointer passed to ntfs_attr_record_resize ntfs_new_attr_flags() passes the wrong MFT record to ntfs_attr_record_resize(). When the attribute is in an extent record, ctx->mrec points to the extent but the function receiv…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-28T10:34:26.017Z. Updated 2026-10-28T10:34:26.017Z.

CVSS—KEVNot listedEPSSPresentUpdated28 Oct 2026, 17:34 WIB

Official record

UnscoredPublished 28 Oct 2026, 17:34 WIB

CVE-2026-99106

drm/amdgpu: free the userptr ranges when a CS fails after parser_bos

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: free the userptr ranges when a CS fails after parser_bos amdgpu_cs_parser_bos() allocates an HMM range for every userptr entry of the BO list and looks up the user pages. Those ranges are only freed when amdgpu_cs_parser_bos() itself fail…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-28T10:34:25.279Z. Updated 2026-10-28T10:34:25.279Z.

CVSS—KEVNot listedEPSSPresentUpdated28 Oct 2026, 17:34 WIB

Official record

UnscoredPublished 28 Oct 2026, 17:34 WIB

CVE-2026-99105

sched_ext: Fix stall when a task enqueued with SCX_ENQ_LAST lands back on its CPU's local DSQ

In the Linux kernel, the following vulnerability has been resolved: sched_ext: Fix stall when a task enqueued with SCX_ENQ_LAST lands back on its CPU's local DSQ With SCX_OPS_ENQ_LAST, the last runnable task on a CPU is passed to ops.enqueue() instead of being kept running. Exiting tasks without SCX_OPS_ENQ_EXITING, …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-28T10:34:24.456Z. Updated 2026-10-28T10:34:24.456Z.

CVSS—KEVNot listedEPSSPresentUpdated28 Oct 2026, 17:34 WIB

Official record