Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 5,813 published records · 14 KEV · 5,813 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

5,813 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit4587.9%
High1,71830%
Med2,45642%
Low2003.4%
None20.03%
Legacy00.00%
Unscored97917%

Matching records by UTC month

Apr 265,813

Signal coverage

KEV-listed: 14
With a forecast: 5,813
Unknown date: 0
Unscored severity: 979

Share of cohort: KEV 0.24% · forecast 100% · unscored 17%.

Showing 941–960 of 5,813By severity band: Critical · 9.0–10.0 458, High · 7.0–8.9 1,718, Medium · 4.0–6.9 2,456, Low · 0.1–3.9 200, None · scored 0.0 2, Legacy · v2 only 0, Unscored · no CNA metric 979

HighPublished 24 Apr 2026, 21:44 WIB

CVE-2026-31635

rxrpc: fix oversized RESPONSE authenticator length check

In the Linux kernel, the following vulnerability has been resolved: rxrpc: fix oversized RESPONSE authenticator length check rxgk_verify_response() decodes auth_len from the packet and is supposed to verify that it fits in the remaining bytes. The existing check is inverted, so oversized RESPONSE authenticators are a…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-24T14:44:49.963Z. Updated 2026-08-05T12:23:59.642Z.

CVSS7.5v3.1KEVNot listedEPSSPresentUpdated05 Aug 2026, 19:23 WIB

Official record

UnscoredPublished 24 Apr 2026, 21:44 WIB

CVE-2026-31634

rxrpc: fix reference count leak in rxrpc_server_keyring()

In the Linux kernel, the following vulnerability has been resolved: rxrpc: fix reference count leak in rxrpc_server_keyring() This patch fixes a reference count leak in rxrpc_server_keyring() by checking if rx->securities is already set.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Showing 941 to 960 of 5813.First page Next page

Published 2026-04-24T14:44:49.307Z. Updated 2026-10-15T01:17:24.353Z.

CVSS—KEVNot listedEPSSPresentUpdated15 Oct 2026, 08:17 WIB

Official record

CritPublished 24 Apr 2026, 21:44 WIB

CVE-2026-31633

rxrpc: Fix integer overflow in rxgk_verify_response()

In the Linux kernel, the following vulnerability has been resolved: rxrpc: Fix integer overflow in rxgk_verify_response() In rxgk_verify_response(), there's a potential integer overflow due to rounding up token_len before checking it, thereby allowing the length check to be bypassed. Fix this by checking the unround…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-24T14:44:48.621Z. Updated 2026-10-19T18:56:00.901Z.

CVSS9.8v3.1KEVNot listedEPSSPresentUpdated20 Oct 2026, 01:56 WIB

Official record

UnscoredPublished 24 Apr 2026, 21:44 WIB

CVE-2026-31632

rxrpc: Fix leak of rxgk context in rxgk_verify_response()

In the Linux kernel, the following vulnerability has been resolved: rxrpc: Fix leak of rxgk context in rxgk_verify_response() Fix rxgk_verify_response() to clean up the rxgk context it creates.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-24T14:44:47.969Z. Updated 2026-05-11T22:12:34.136Z.

CVSS—KEVNot listedEPSSPresentUpdated12 May 2026, 05:12 WIB

Official record

HighPublished 24 Apr 2026, 21:44 WIB

CVE-2026-31631

rxrpc: Fix buffer overread in rxgk_do_verify_authenticator()

In the Linux kernel, the following vulnerability has been resolved: rxrpc: Fix buffer overread in rxgk_do_verify_authenticator() Fix rxgk_do_verify_authenticator() to check the buffer size before checking the nonce.

Excerpt language: en.

Severity high: primary CNA CVSS 8.2 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-24T14:44:47.305Z. Updated 2026-10-19T18:56:00.756Z.

CVSS8.2v3.1KEVNot listedEPSSPresentUpdated20 Oct 2026, 01:56 WIB

Official record

HighPublished 24 Apr 2026, 21:44 WIB

CVE-2026-31630

rxrpc: proc: size address buffers for %pISpc output

In the Linux kernel, the following vulnerability has been resolved: rxrpc: proc: size address buffers for %pISpc output The AF_RXRPC procfs helpers format local and remote socket addresses into fixed 50-byte stack buffers with "%pISpc". That is too small for the longest current-tree IPv6-with-port form the formatter…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-24T14:44:46.606Z. Updated 2026-10-21T12:39:36.441Z.

CVSS7.8v3.1KEVNot listedEPSSPresentUpdated21 Oct 2026, 19:39 WIB

Official record

HighPublished 24 Apr 2026, 21:42 WIB

CVE-2026-31629

nfc: llcp: add missing return after LLCP_CLOSED checks

In the Linux kernel, the following vulnerability has been resolved: nfc: llcp: add missing return after LLCP_CLOSED checks In nfc_llcp_recv_hdlc() and nfc_llcp_recv_disc(), when the socket state is LLCP_CLOSED, the code correctly calls release_sock() and nfc_llcp_sock_put() but fails to return. Execution falls throug…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-24T14:42:49.849Z. Updated 2026-10-15T01:17:21.139Z.

CVSS8.8v3.1KEVNot listedEPSSPresentUpdated15 Oct 2026, 08:17 WIB

Official record

UnscoredPublished 24 Apr 2026, 21:42 WIB

CVE-2026-31628

x86/CPU: Fix FPDSS on Zen1

In the Linux kernel, the following vulnerability has been resolved: x86/CPU: Fix FPDSS on Zen1 Zen1's hardware divider can leave, under certain circumstances, partial results from previous operations. Those results can be leaked by another, attacker thread. Fix that with a chicken bit.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-24T14:42:49.181Z. Updated 2026-10-15T01:17:19.544Z.

CVSS—KEVNot listedEPSSPresentUpdated15 Oct 2026, 08:17 WIB

Official record

HighPublished 24 Apr 2026, 21:42 WIB

CVE-2026-31627

i2c: s3c24xx: check the size of the SMBUS message before using it

In the Linux kernel, the following vulnerability has been resolved: i2c: s3c24xx: check the size of the SMBUS message before using it The first byte of an i2c SMBUS message is the size, and it should be verified to ensure that it is in the range of 0..I2C_SMBUS_BLOCK_MAX before processing it. This is the same logic …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-24T14:42:48.342Z. Updated 2026-08-05T12:23:54.379Z.

CVSS7.8v3.1KEVNot listedEPSSPresentUpdated05 Aug 2026, 19:23 WIB

Official record

HighPublished 24 Apr 2026, 21:42 WIB

CVE-2026-31626

staging: rtl8723bs: initialize le_tmp64 in rtw_BIP_verify()

In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: initialize le_tmp64 in rtw_BIP_verify() Initialize le_tmp64 to zero in rtw_BIP_verify() to prevent using uninitialized data. Smatch warns that only 6 bytes are copied to this 8-byte (u64) variable, leaving the last two bytes unin…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-24T14:42:47.493Z. Updated 2026-08-05T12:23:53.335Z.

CVSS7.1v3.1KEVNot listedEPSSPresentUpdated05 Aug 2026, 19:23 WIB

Official record

UnscoredPublished 24 Apr 2026, 21:42 WIB

CVE-2026-31625

HID: alps: fix NULL pointer dereference in alps_raw_event()

In the Linux kernel, the following vulnerability has been resolved: HID: alps: fix NULL pointer dereference in alps_raw_event() Commit ecfa6f34492c ("HID: Add HID_CLAIMED_INPUT guards in raw_event callbacks missing them") attempted to fix up the HID drivers that had missed the previous fix that was done in 2ff5baa9b5…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-24T14:42:42.481Z. Updated 2026-10-15T01:17:17.626Z.

CVSS—KEVNot listedEPSSPresentUpdated15 Oct 2026, 08:17 WIB

Official record

UnscoredPublished 24 Apr 2026, 21:42 WIB

CVE-2026-31624

HID: core: clamp report_size in s32ton() to avoid undefined shift

In the Linux kernel, the following vulnerability has been resolved: HID: core: clamp report_size in s32ton() to avoid undefined shift s32ton() shifts by n-1 where n is the field's report_size, a value that comes directly from a HID device. The HID parser bounds report_size only to <= 256, so a broken HID device can …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-24T14:42:41.655Z. Updated 2026-10-15T01:17:16.412Z.

CVSS—KEVNot listedEPSSPresentUpdated15 Oct 2026, 08:17 WIB

Official record

UnscoredPublished 24 Apr 2026, 21:42 WIB

CVE-2026-31623

net: usb: cdc-phonet: fix skb frags[] overflow in rx_complete()

In the Linux kernel, the following vulnerability has been resolved: net: usb: cdc-phonet: fix skb frags[] overflow in rx_complete() A malicious USB device claiming to be a CDC Phonet modem can overflow the skb_shared_info->frags[] array by sending an unbounded sequence of full-page bulk transfers. Drop the skb and i…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-24T14:42:40.566Z. Updated 2026-06-14T17:43:10.837Z.

CVSS—KEVNot listedEPSSPresentUpdated15 Jun 2026, 00:43 WIB

Official record

HighPublished 24 Apr 2026, 21:42 WIB

CVE-2026-31622

NFC: digital: Bounds check NFC-A cascade depth in SDD response handler

In the Linux kernel, the following vulnerability has been resolved: NFC: digital: Bounds check NFC-A cascade depth in SDD response handler The NFC-A anti-collision cascade in digital_in_recv_sdd_res() appends 3 or 4 bytes to target->nfcid1 on each round, but the number of cascade rounds is controlled entirely by the …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-24T14:42:39.916Z. Updated 2026-10-15T01:17:15.197Z.

CVSS8.8v3.1KEVNot listedEPSSPresentUpdated15 Oct 2026, 08:17 WIB

Official record

UnscoredPublished 24 Apr 2026, 21:42 WIB

CVE-2026-31621

bnge: return after auxiliary_device_uninit() in error path

In the Linux kernel, the following vulnerability has been resolved: bnge: return after auxiliary_device_uninit() in error path When auxiliary_device_add() fails, the error block calls auxiliary_device_uninit() but does not return. The uninit drops the last reference and synchronously runs bnge_aux_dev_release(), whi…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-24T14:42:39.274Z. Updated 2026-06-14T17:43:07.914Z.

CVSS—KEVNot listedEPSSPresentUpdated15 Jun 2026, 00:43 WIB

Official record

UnscoredPublished 24 Apr 2026, 21:42 WIB

CVE-2026-31620

ALSA: usx2y: us144mkii: fix NULL deref on missing interface 0

In the Linux kernel, the following vulnerability has been resolved: ALSA: usx2y: us144mkii: fix NULL deref on missing interface 0 A malicious USB device with the TASCAM US-144MKII device id can have a configuration containing bInterfaceNumber=1 but no interface 0. USB configuration descriptors are not required to as…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-24T14:42:38.607Z. Updated 2026-06-14T17:43:06.553Z.

CVSS—KEVNot listedEPSSPresentUpdated15 Jun 2026, 00:43 WIB

Official record

UnscoredPublished 24 Apr 2026, 21:42 WIB

CVE-2026-31619

ALSA: fireworks: bound device-supplied status before string array lookup

In the Linux kernel, the following vulnerability has been resolved: ALSA: fireworks: bound device-supplied status before string array lookup The status field in an EFW response is a 32-bit value supplied by the firewire device. efr_status_names[] has 17 entries so a status value outside that range goes off into the …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-24T14:42:37.944Z. Updated 2026-06-14T17:43:05.168Z.

CVSS—KEVNot listedEPSSPresentUpdated15 Jun 2026, 00:43 WIB

Official record

UnscoredPublished 24 Apr 2026, 21:42 WIB

CVE-2026-31618

fbdev: tdfxfb: avoid divide-by-zero on FBIOPUT_VSCREENINFO

In the Linux kernel, the following vulnerability has been resolved: fbdev: tdfxfb: avoid divide-by-zero on FBIOPUT_VSCREENINFO Much like commit 19f953e74356 ("fbdev: fb_pm2fb: Avoid potential divide by zero error"), we also need to prevent that same crash from happening in the udlfb driver as it uses pixclock directl…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-24T14:42:37.173Z. Updated 2026-06-14T17:43:03.888Z.

CVSS—KEVNot listedEPSSPresentUpdated15 Jun 2026, 00:43 WIB

Official record

UnscoredPublished 24 Apr 2026, 21:42 WIB

CVE-2026-31617

usb: gadget: f_ncm: validate minimum block_len in ncm_unwrap_ntb()

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: f_ncm: validate minimum block_len in ncm_unwrap_ntb() The block_len read from the host-supplied NTB header is checked against ntb_max but has no lower bound. When block_len is smaller than opts->ndp_size, the bounds check of: ndp_index …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-24T14:42:36.191Z. Updated 2026-10-15T01:17:13.982Z.

CVSS—KEVNot listedEPSSPresentUpdated15 Oct 2026, 08:17 WIB

Official record

UnscoredPublished 24 Apr 2026, 21:42 WIB

CVE-2026-31616

usb: gadget: f_phonet: fix skb frags[] overflow in pn_rx_complete()

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: f_phonet: fix skb frags[] overflow in pn_rx_complete() A broken/bored/mean USB host can overflow the skb_shared_info->frags[] array on a Linux gadget exposing a Phonet function by sending an unbounded sequence of full-page OUT transfers.…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-24T14:42:35.480Z. Updated 2026-06-14T17:43:01.212Z.

CVSS—KEVNot listedEPSSPresentUpdated15 Jun 2026, 00:43 WIB

Official record