Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 5,813 published records · 14 KEV · 5,813 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

5,813 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit4587.9%
High1,71830%
Med2,45642%
Low2003.4%
None20.03%
Legacy00.00%
Unscored97917%

Matching records by UTC month

Apr 265,813

Signal coverage

KEV-listed: 14
With a forecast: 5,813
Unknown date: 0
Unscored severity: 979

Share of cohort: KEV 0.24% · forecast 100% · unscored 17%.

Showing 961–980 of 5,813By severity band: Critical · 9.0–10.0 458, High · 7.0–8.9 1,718, Medium · 4.0–6.9 2,456, Low · 0.1–3.9 200, None · scored 0.0 2, Legacy · v2 only 0, Unscored · no CNA metric 979

UnscoredPublished 24 Apr 2026, 21:42 WIB

CVE-2026-31615

usb: gadget: renesas_usb3: validate endpoint index in standard request handlers

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: renesas_usb3: validate endpoint index in standard request handlers The GET_STATUS and SET/CLEAR_FEATURE handlers extract the endpoint number from the host-supplied wIndex without any sort of validation. Fix this up by validating the numb…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-24T14:42:34.806Z. Updated 2026-06-14T17:42:59.822Z.

CVSS—KEVNot listedEPSSPresentUpdated15 Jun 2026, 00:42 WIB

Official record

UnscoredPublished 24 Apr 2026, 21:42 WIB

CVE-2026-31614

smb: client: fix off-by-8 bounds check in check_wsl_eas()

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix off-by-8 bounds check in check_wsl_eas() The bounds check uses (u8 *)ea + nlen + 1 + vlen as the end of the EA name and value, but ea_data sits at offset sizeof(struct smb2_file_full_ea_info) = 8 from ea, not at offset 0. The strncm…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Showing 961 to 980 of 5813.First page Next page

Published 2026-04-24T14:42:34.153Z. Updated 2026-06-14T17:42:58.516Z.

CVSS—KEVNot listedEPSSPresentUpdated15 Jun 2026, 00:42 WIB

Official record

HighPublished 24 Apr 2026, 21:42 WIB

CVE-2026-31613

smb: client: fix OOB reads parsing symlink error response

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix OOB reads parsing symlink error response When a CREATE returns STATUS_STOPPED_ON_SYMLINK, smb2_check_message() returns success without any length validation, leaving the symlink parsers as the only defense against an untrusted server…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-24T14:42:33.453Z. Updated 2026-10-19T18:56:00.442Z.

CVSS8.1v3.1KEVNot listedEPSSPresentUpdated20 Oct 2026, 01:56 WIB

Official record

HighPublished 24 Apr 2026, 21:42 WIB

CVE-2026-31612

ksmbd: validate EaNameLength in smb2_get_ea()

In the Linux kernel, the following vulnerability has been resolved: ksmbd: validate EaNameLength in smb2_get_ea() smb2_get_ea() reads ea_req->EaNameLength from the client request and passes it directly to strncmp() as the comparison length without verifying that the length of the name really is the size of the input …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-24T14:42:32.760Z. Updated 2026-10-15T01:17:11.549Z.

CVSS7.5v3.1KEVNot listedEPSSPresentUpdated15 Oct 2026, 08:17 WIB

Official record

HighPublished 24 Apr 2026, 21:42 WIB

CVE-2026-31611

ksmbd: require 3 sub-authorities before reading sub_auth[2]

In the Linux kernel, the following vulnerability has been resolved: ksmbd: require 3 sub-authorities before reading sub_auth[2] parse_dacl() compares each ACE SID against sid_unix_NFS_mode and on match reads sid.sub_auth[2] as the file mode. If sid_unix_NFS_mode is the prefix S-1-5-88-3 with num_subauth = 2 then com…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.6 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-24T14:42:32.124Z. Updated 2026-10-15T01:17:10.339Z.

CVSS8.6v3.1KEVNot listedEPSSPresentUpdated15 Oct 2026, 08:17 WIB

Official record

UnscoredPublished 24 Apr 2026, 21:42 WIB

CVE-2026-31610

ksmbd: fix mechToken leak when SPNEGO decode fails after token alloc

In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix mechToken leak when SPNEGO decode fails after token alloc The kernel ASN.1 BER decoder calls action callbacks incrementally as it walks the input. When ksmbd_decode_negTokenInit() reaches the mechToken [2] OCTET STRING element, ksmbd_neg_…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-24T14:42:31.471Z. Updated 2026-07-24T14:33:31.688Z.

CVSS—KEVNot listedEPSSPresentUpdated24 Jul 2026, 21:33 WIB

Official record

CritPublished 24 Apr 2026, 21:42 WIB

CVE-2026-31609

smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush()

In the Linux kernel, the following vulnerability has been resolved: smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() smbd_send_batch_flush() already calls smbd_free_send_io(), so we should not call it again after smbd_post_send() moved it to the batch list.

Excerpt language: en.

Severity critical: primary CNA CVSS 9.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-24T14:42:30.797Z. Updated 2026-10-19T18:56:00.237Z.

CVSS9.8v3.1KEVNot listedEPSSPresentUpdated20 Oct 2026, 01:56 WIB

Official record

CritPublished 24 Apr 2026, 21:42 WIB

CVE-2026-31608

smb: server: avoid double-free in smb_direct_free_sendmsg after smb_direct_flush_send_list()

In the Linux kernel, the following vulnerability has been resolved: smb: server: avoid double-free in smb_direct_free_sendmsg after smb_direct_flush_send_list() smb_direct_flush_send_list() already calls smb_direct_free_sendmsg(), so we should not call it again after post_sendmsg() moved it to the batch list.

Excerpt language: en.

Severity critical: primary CNA CVSS 9.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-24T14:42:30.137Z. Updated 2026-08-05T12:23:46.955Z.

CVSS9.8v3.1KEVNot listedEPSSPresentUpdated05 Aug 2026, 19:23 WIB

Official record

CritPublished 24 Apr 2026, 21:42 WIB

CVE-2026-31607

usbip: validate number_of_packets in usbip_pack_ret_submit()

In the Linux kernel, the following vulnerability has been resolved: usbip: validate number_of_packets in usbip_pack_ret_submit() When a USB/IP client receives a RET_SUBMIT response, usbip_pack_ret_submit() unconditionally overwrites urb->number_of_packets from the network PDU. This value is subsequently used as the l…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-24T14:42:29.468Z. Updated 2026-10-19T18:56:00.074Z.

CVSS9.8v3.1KEVNot listedEPSSPresentUpdated20 Oct 2026, 01:56 WIB

Official record

UnscoredPublished 24 Apr 2026, 21:42 WIB

CVE-2026-31606

usb: gadget: f_hid: don't call cdev_init while cdev in use

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: f_hid: don't call cdev_init while cdev in use When calling unbind, then bind again, cdev_init reinitialized the cdev, even though there may still be references to it. That's the case when the /dev/hidg* device is still opened. This obvio…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-24T14:42:28.792Z. Updated 2026-10-21T12:39:35.359Z.

CVSS—KEVNot listedEPSSPresentUpdated21 Oct 2026, 19:39 WIB

Official record

UnscoredPublished 24 Apr 2026, 21:42 WIB

CVE-2026-31605

fbdev: udlfb: avoid divide-by-zero on FBIOPUT_VSCREENINFO

In the Linux kernel, the following vulnerability has been resolved: fbdev: udlfb: avoid divide-by-zero on FBIOPUT_VSCREENINFO Much like commit 19f953e74356 ("fbdev: fb_pm2fb: Avoid potential divide by zero error"), we also need to prevent that same crash from happening in the udlfb driver as it uses pixclock directly…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-24T14:42:28.120Z. Updated 2026-06-14T17:42:46.052Z.

CVSS—KEVNot listedEPSSPresentUpdated15 Jun 2026, 00:42 WIB

Official record

UnscoredPublished 24 Apr 2026, 21:42 WIB

CVE-2026-31604

wifi: rtw88: fix device leak on probe failure

In the Linux kernel, the following vulnerability has been resolved: wifi: rtw88: fix device leak on probe failure Driver core holds a reference to the USB interface and its parent USB device while the interface is bound to a driver and there is no need to take additional references unless the structures are needed af…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-24T14:42:27.342Z. Updated 2026-06-14T17:42:45.063Z.

CVSS—KEVNot listedEPSSPresentUpdated15 Jun 2026, 00:42 WIB

Official record

UnscoredPublished 24 Apr 2026, 21:42 WIB

CVE-2026-31603

staging: sm750fb: fix division by zero in ps_to_hz()

In the Linux kernel, the following vulnerability has been resolved: staging: sm750fb: fix division by zero in ps_to_hz() ps_to_hz() is called from hw_sm750_crtc_set_mode() without validating that pixclock is non-zero. A zero pixclock passed via FBIOPUT_VSCREENINFO causes a division by zero. Fix by rejecting zero pix…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-24T14:42:26.601Z. Updated 2026-06-14T17:42:44.030Z.

CVSS—KEVNot listedEPSSPresentUpdated15 Jun 2026, 00:42 WIB

Official record

HighPublished 24 Apr 2026, 21:42 WIB

CVE-2026-31602

ALSA: ctxfi: Limit PTP to a single page

In the Linux kernel, the following vulnerability has been resolved: ALSA: ctxfi: Limit PTP to a single page Commit 391e69143d0a increased CT_PTP_NUM from 1 to 4 to support 256 playback streams, but the additional pages are not used by the card correctly. The CT20K2 hardware already has multiple VMEM_PTPAL registers, …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-24T14:42:25.935Z. Updated 2026-08-05T12:23:44.562Z.

CVSS7.8v3.1KEVNot listedEPSSPresentUpdated05 Aug 2026, 19:23 WIB

Official record

UnscoredPublished 24 Apr 2026, 21:42 WIB

CVE-2026-31601

vfio/xe: Reorganize the init to decouple migration from reset

In the Linux kernel, the following vulnerability has been resolved: vfio/xe: Reorganize the init to decouple migration from reset Attempting to issue reset on VF devices that don't support migration leads to the following: BUG: unable to handle page fault for address: 00000000000011f8 #PF: supervisor read access…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-24T14:42:25.287Z. Updated 2026-06-14T17:42:42.047Z.

CVSS—KEVNot listedEPSSPresentUpdated15 Jun 2026, 00:42 WIB

Official record

HighPublished 24 Apr 2026, 21:42 WIB

CVE-2026-31600

arm64: mm: Handle invalid large leaf mappings correctly

In the Linux kernel, the following vulnerability has been resolved: arm64: mm: Handle invalid large leaf mappings correctly It has been possible for a long time to mark ptes in the linear map as invalid. This is done for secretmem, kfence, realm dma memory un/share, and others, by simply clearing the PTE_VALID bit. B…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-24T14:42:24.641Z. Updated 2026-10-19T18:55:59.896Z.

CVSS7.5v3.1KEVNot listedEPSSPresentUpdated20 Oct 2026, 01:55 WIB

Official record

UnscoredPublished 24 Apr 2026, 21:42 WIB

CVE-2026-31599

media: vidtv: fix NULL pointer dereference in vidtv_channel_pmt_match_sections

In the Linux kernel, the following vulnerability has been resolved: media: vidtv: fix NULL pointer dereference in vidtv_channel_pmt_match_sections syzbot reported a general protection fault in vidtv_psi_desc_assign [1]. vidtv_psi_pmt_stream_init() can return NULL on memory allocation failure, but vidtv_channel_pmt_m…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-24T14:42:23.961Z. Updated 2026-06-14T17:42:40.045Z.

CVSS—KEVNot listedEPSSPresentUpdated15 Jun 2026, 00:42 WIB

Official record

HighPublished 24 Apr 2026, 21:42 WIB

CVE-2026-31598

ocfs2: fix possible deadlock between unlink and dio_end_io_write

In the Linux kernel, the following vulnerability has been resolved: ocfs2: fix possible deadlock between unlink and dio_end_io_write ocfs2_unlink takes orphan dir inode_lock first and then ip_alloc_sem, while in ocfs2_dio_end_io_write, it acquires these locks in reverse order. This creates an ABBA lock ordering viola…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-24T14:42:23.304Z. Updated 2026-10-19T18:55:59.744Z.

CVSS7.5v3.1KEVNot listedEPSSPresentUpdated20 Oct 2026, 01:55 WIB

Official record

HighPublished 24 Apr 2026, 21:42 WIB

CVE-2026-31597

ocfs2: fix use-after-free in ocfs2_fault() when VM_FAULT_RETRY

In the Linux kernel, the following vulnerability has been resolved: ocfs2: fix use-after-free in ocfs2_fault() when VM_FAULT_RETRY filemap_fault() may drop the mmap_lock before returning VM_FAULT_RETRY, as documented in mm/filemap.c: "If our return value has VM_FAULT_RETRY set, it's because the mmap_lock may be …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-24T14:42:22.655Z. Updated 2026-08-05T12:23:41.347Z.

CVSS7.8v3.1KEVNot listedEPSSPresentUpdated05 Aug 2026, 19:23 WIB

Official record

UnscoredPublished 24 Apr 2026, 21:42 WIB

CVE-2026-31596

ocfs2: handle invalid dinode in ocfs2_group_extend

In the Linux kernel, the following vulnerability has been resolved: ocfs2: handle invalid dinode in ocfs2_group_extend [BUG] kernel BUG at fs/ocfs2/resize.c:308! Oops: invalid opcode: 0000 [#1] SMP KASAN NOPTI RIP: 0010:ocfs2_group_extend+0x10aa/0x1ae0 fs/ocfs2/resize.c:308 Code: 8b8520ff ffff83f8 860f8580 030000e8 5…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-24T14:42:22.003Z. Updated 2026-06-14T17:42:37.033Z.

CVSS—KEVNot listedEPSSPresentUpdated15 Jun 2026, 00:42 WIB

Official record