CVE

What each publisher says about a vulnerability, whether working code exists for it, and what is written about it afterwards.

Behind7 sourcesupdated 6h agofresh within 24h

66,157things

8,747named by two sources or more

1,072conflicts

7sources

Only one source knows: Exploit-DB 23133 · GitHub advisories 30 · CISA Known Exploited Vulnerabilities 1004 · Metasploit exploit modules 679 · NVD 12679 · Red Hat 19880 · Write-ups 5

Covers. Every CVE in CISA KEV. Red Hat since 2025-01-01, NVD since 2026-08-01, GitHub since 2026-09-01. Every Exploit-DB entry and Metasploit exploit module naming a CVE. Excludes. Vulnerabilities with no CVE number. Ubuntu, whose list endpoint answers 20 records in thirty seconds and cannot be paged at a useful rate.

Compared · what is held against what, and from which column of each source

Property	CISA Known Exploited Vulnerabilities	Red Hat	NVD	GitHub advisories	Metasploit exploit modules	Exploit-DB	Write-ups
Cvss	not said	`cvss3_score`	`cve.metrics.cvssMetricV31[].cvssData.baseScore`	`cvss.score`	not said	not said	not said
Exploited	`const:yes`	not said	not said	not said	not said	not said	not said
Severity	not said	`severity`	not said	`severity`	not said	not said	not said

Everything else the sources say is shown side by side, and not compared.

severity=medium ✕source=zetlyn/cve-nvd ✕

Everything Exploited, and severe article 10 exploit 49396vulnerability 49746

Found

1–25 of 461

Thing	Kind	Severity	Cvss	Date
kernel: Linux kernel ath12k Wi-Fi memory leak CVE-2025-39890 · Red Hat, NVD · matched kernel	vulnerability 2	medium	4.7 / 5.5	2025-09-24
kernel: Kernel: Denial of Service in buffer queue driver CVE-2024-53922 · Red Hat, NVD · matched kernel	vulnerability 2	medium	5.7	2026-09-13
In the Linux kernel, the following vulnerability has been resolved: bpf: Guard __get_user acesss with access_ok for uprobe_multi data As reported by sashiko [1] we need to use access_ok to check the user space data bounds before we use __get-user to get it. [1] https://lore.kernel.org/bpf/20260610145235.CB1441F00893@smtp.kernel.org/ CVE-2026-74258 · NVD, Red Hat · matched kernel	vulnerability 2	medium	5.5 / 7.8	2026-08-15
In the Linux kernel, the following vulnerability has been resolved: openrisc: fix arbitrary kernel memory access via or1k_atomic syscall sys_or1k_atomic() (syscall 244 in the "or1k" ABI) takes two user pointers, v1 and v2, and swaps the words they point to in hand-written assembly. l.lwz r29,0(r4) l.lwz r27,0(r5) l.sw 0(r4),r27 l.sw 0(r5),r29 The pointers are not checked with access_ok(). The four memory accesses also have no exception table entries. A caller passes a kernel address as either pointer, and the syscall reads from and writes to it directly. This gives an unprivileged process a kernel read/write primitive. It overwrites kernel data such as the sys_call_table, gaining code execution in kernel context. Check both pointers before entering the critical section. Add fixups for the four memory accesses so faults on valid but unmapped user addresses return -EFAULT. [shorne@gmail.com: fix comment style] CVE-2026-89489 · NVD, Red Hat · matched kernel	vulnerability 2	medium	5.5 / 7.8	2026-09-11
NVIDIA GPU Display Driver for Windows contains a vulnerability in the kernel-mode color transform path where excessive kernel stack use occurs when evaluating YCbCr420 display emulation. A successful exploit of this vulnerability might lead to denial of service. CVE-2026-47506 · NVD, GitHub advisories · matched kernel	vulnerability 2	medium	5.5	2026-09-30
NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode layer where a user could cause uninitialized kernel memory to be copied back to userspace. A successful exploit of this vulnerability might lead to information disclosure. CVE-2026-47555 · NVD, Red Hat, GitHub advisories · matched kernel	vulnerability 3	medium	5.5	2026-09-30
NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer where an unprivileged user could cause a memory leak in error paths leading to kernel memory exhaustion. A successful exploit of this vulnerability might lead to denial of service. CVE-2026-47566 · NVD, Red Hat, GitHub advisories · matched kernel	vulnerability 3	medium	5.5	2026-09-30
In the Linux kernel, the following vulnerability has been resolved: scsi: fnic: Use GFP_ATOMIC for VLAN alloc under spinlock fnic_fcoe_process_vlan_resp() allocates a VLAN descriptor with kzalloc_obj() (default GFP_KERNEL) while holding vlans_lock via spin_lock_irqsave(). GFP_KERNEL may sleep, which is not allowed in this atomic context and can trigger a sleeping-from-invalid-context warning or deadlock. Pass GFP_ATOMIC so the allocation is safe under the IRQ-safe spinlock. CVE-2026-89514 · NVD, Red Hat · matched kernel	vulnerability 2	medium	5.5	2026-09-11
NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer where a user could cause uncontrolled kernel log generation by repeatedly invoking an interface that emits unrate-limited error messages. A successful exploit of this vulnerability might lead to denial of service. CVE-2026-47568 · NVD, Red Hat, GitHub advisories · matched kernel	vulnerability 3	medium	5.5	2026-09-30
Linux Kernel Race Condition Vulnerability CVE-2025-39964 · CISA Known Exploited Vulnerabilities, NVD, Red Hat · matched kernel	vulnerability 3	medium	7.3 / 7.8	2025-10-13
NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer where a user could inject crafted text into the kernel log because the supplied version string is not properly sanitized. A successful exploit of this vulnerability might lead to denial of service and data tampering. CVE-2026-47562 · NVD, Red Hat, GitHub advisories · matched kernel	vulnerability 3	medium	4.4	2026-09-30
In the Linux kernel, the following vulnerability has been resolved: debugfs: Fix lockdown check for mmap_prepare Commit 651fdda8406d ("relay: update relay to use mmap_prepare") changed the `mmap` file operation to `mmap_prepare` for relayfs, but the lockdown check in debugfs was not updated accordingly. This prevents debugfs from being locked down when the kernel is in integrity mode if a file uses `mmap_prepare` but not `mmap`. Since the conversion to `mmap_prepare` across the kernel is not yet complete, update the lockdown check to look for both `mmap` and `mmap_prepare` to ensure comprehensive coverage. CVE-2026-89745 · NVD, Red Hat · matched kernel	vulnerability 2	medium	7	2026-09-11
Linux Kernel Improper Check for Unusual or Exceptional Conditions Vulnerability CVE-2025-39682 · CISA Known Exploited Vulnerabilities, NVD, Red Hat · matched kernel	vulnerability 3	medium	7 / 9.8	2025-09-05
kernel: bpf: Harden bloom filter sizing and indexing on 32-bit kernels CVE-2026-89579 · Red Hat, NVD · matched kernel	vulnerability 2	medium	6.7 / 7.8	2026-09-11
vLLM is an inference and serving engine for large language models. Prior to 0.27.0, an integer overflow in blockIdx.x * 2 * d in activation_kernels.cu can cause act_and_mul_kernel to consume another batched user's input, allowing a request processed in the same inference batch to receive a partial or complete copy of another user's inference result. This issue is fixed in version 0.27.0. CVE-2026-73558 · NVD, Red Hat · matched kernel	vulnerability 2	medium	5.3	2026-08-13
In the Linux kernel, the following vulnerability has been resolved: xdp: fix zero-copy frame layout xdp_convert_zc_to_xdp_frame() clones an XSK packet into an order-0 page and advertises PAGE_SIZE as its frame size. It allows the copied frame to occupy the page tail needed by skb_shared_info and records zero headroom even when metadata separates the frame header from packet data. An AF_XDP zero-copy packet redirected through cpumap can therefore make the skb overlap skb_shared_info or place it beyond the allocated page. Limit the copied layout to SKB_WITH_OVERHEAD(PAGE_SIZE) and include the metadata length in frame headroom. Redirect callers already handle a NULL conversion result. BUG: KASAN: slab-out-of-bounds in skb_gro_receive Write of size 4 at addr ffff88800cf37004 by task cpumap/1/map:1/146 Call Trace: skb_gro_receive (net/core/gro.c:174) udp_gro_receive (net/ipv4/udp_offload.c:812) inet_gro_receive (net/ipv4/af_inet.c:1539) dev_gro_receive (net/core/gro.c:515) gro_receive_skb (net/core/gro.c:633) cpu_map_kthread_run (kernel/bpf/cpumap.c:395) kthread (kernel/kthread.c:436) ret_from_fork (arch/x86/kernel/process.c:164) ret_from_fork_asm (arch/x86/entry/entry_64.S:255) Kernel panic - not syncing: KASAN: panic_on_warn set ... CVE-2026-81002 · NVD, Red Hat · matched kernel	vulnerability 2	medium	7 / 9.8	2026-09-11
In the Linux kernel, the following vulnerability has been resolved: ntfs: verify run length exceeding volume boundary The mapping pairs decoder validates that the starting LCN is within the volume but does not check if the run extends beyond the volume boundary. A malformed NTFS image with a crafted mapping pairs array could cause the kernel to access memory beyond the volume boundary, potentially leading to memory corruption and privilege escalation. Add validation to ensure lcn + length stays within nr_clusters. CVE-2026-89610 · NVD, Red Hat · matched kernel	vulnerability 2	medium	5.5 / 9.8	2026-09-11
In the Linux kernel, the following vulnerability has been resolved: fbdev: uvesafb: unregister connector callback on init failure uvesafb_init() registers the v86d connector callback before registering the platform driver. If platform_driver_register() fails, the function returns the error directly and leaves the connector callback registered. The later platform-device failure path already unregisters the callback. Add the same cleanup before the final return when platform-driver registration fails. This issue was identified during our ongoing static-analysis research while reviewing kernel code. CVE-2026-89597 · NVD, Red Hat · matched kernel	vulnerability 2	medium	5.5 / 7.8	2026-09-11
In the Linux kernel, the following vulnerability has been resolved: ocfs2: fix readdir position truncation on 32-bit kernels In ocfs2_dir_foreach_blk_el(), the directory cookie position is rebuilt with ctx->pos = (ctx->pos & ~(sb->s_blocksize - 1)) \| offset; `ctx->pos` is loff_t (signed 64-bit), while `sb->s_blocksize` is unsigned long. On 32-bit kernels unsigned long is 32-bit, so the mask ~(sb->s_blocksize - 1) is computed as a 32-bit unsigned value (e.g. 0xfffff000 for a 4 KiB block size). In the AND expression with the 64-bit `ctx->pos`, that unsigned operand is zero-extended to 64 bits per the usual arithmetic conversions, yielding 0x00000000fffff000. The high 32 bits of `ctx->pos` are silently cleared, even though directory size is allowed to exceed 4 GiB. When readdir() crosses the 4 GiB boundary on a 32-bit kernel the position is reset back into the first 4 GiB block, making the re-validation path re-enumerate already-returned dirents indefinitely. This is ocfs2_dir_foreach_blk_el(), the extent-list readdir path taken for all non-inline directories, so a directory large enough to cross 4 GiB reaches it. This is the same class of bug that commit 3dce5bb82c97 ("exfat: Fix bitwise operation having different size") fixed in exfat, and the fix mirrors the equivalent ext4 fix in this series. Cast the operand to loff_t so the mask is 64-bit before the AND: ctx->pos = (ctx->pos & ~((loff_t)sb->s_blocksize - 1)) \| offset; 64-bit kernels are unaffected. CVE-2026-89490 · NVD, Red Hat · matched kernel	vulnerability 2	medium	5.5	2026-09-11
In the Linux kernel, the following vulnerability has been resolved: ntfs: reject invalid empty mapping pairs Reject an attribute with empty mapping pairs if it has inconsistent highest VCN and size. CVE-2026-89613 · NVD, Red Hat · matched kernel	vulnerability 2	medium	5.5 / 9.8	2026-09-11
NVIDIA GPU Display Driver for Windows contains a vulnerability in the kernel module where a user could cause improper locking. A successful exploit of this vulnerability might lead to denial of service. CVE-2026-47581 · NVD, GitHub advisories · matched kernel	vulnerability 2	medium	5.5	2026-09-30
Memory Corruption via Uncanceled AIO Requests on Error: libkcapi's one-shot AIO path can return an error before all submitted IOCBs are drained, allowing later kernel writes into caller-owned output buffers. CVE-2026-71226 · NVD, Red Hat · matched kernel	vulnerability 2	medium	7.3	2026-08-05
In the Linux kernel, the following vulnerability has been resolved: bpf: Mask pseudo pointer values in verifier logs print_bpf_insn() masks ldimm64 immediates for pointer-bearing pseudo sources when pointer leaks are not allowed, but the mask only covers BPF_PSEUDO_MAP_FD and BPF_PSEUDO_MAP_VALUE. BPF_PSEUDO_MAP_IDX, BPF_PSEUDO_MAP_IDX_VALUE, and BPF_PSEUDO_BTF_ID can also be resolved to kernel pointer values before the verifier log prints the instruction. Include them in the existing pointer classification so the log prints 0x0 instead of the rewritten address. CVE-2026-72402 · NVD, Red Hat · matched kernel	vulnerability 2	medium	5.5	2026-08-15
In the Linux kernel, the following vulnerability has been resolved: tracing: Fix use-after-free in trace_pipe read on sub-buffer order change Writing to buffer_subbuf_size_kb calls ring_buffer_subbuf_order_set(), which frees every sub-buffer of the ring buffer, including the reader page, and replaces them with newly allocated ones. Readers of trace_pipe hold pointers into those pages. ring_buffer_peek() looks up an event under cpu_buffer->reader_lock but returns the event pointer after dropping the lock, and peek_next_entry() then calls ring_buffer_event_length() and ring_buffer_event_data() on it. If the sub-buffer order is changed in that window, the reader dereferences freed memory: BUG: KASAN: use-after-free in ring_buffer_peek+0x3e0/0x430 Read of size 1 at addr ffff88802a4cf010 by task syz-executor989/6002 Freed by: free_buffer_page kernel/trace/ring_buffer.c:398 [inline] ring_buffer_subbuf_order_set+0x1325/0x18e0 kernel/trace/ring_buffer.c:7444 buffer_subbuf_size_write+0x182/0x280 kernel/trace/trace.c:8221 Take trace_access_lock(RING_BUFFER_ALL_CPUS) around the order change. This is the lock trace_pipe readers already hold across their entire peek-and-print loop, so the swap can no longer race with a reader that is dereferencing a peeked event. CVE-2026-89747 · NVD, Red Hat · matched kernel	vulnerability 2	medium	7 / 7.8	2026-09-11
In the Linux kernel, the following vulnerability has been resolved: udf: reject VAT indexes equal to the entry count UDF 1.50 virtual partition mapping uses the VAT as an array of physical block mappings. s_num_entries stores the number of entries in that array, not the highest valid index. The valid VAT indexes are therefore below s_num_entries. udf_get_pblock_virt15() currently rejects only indexes greater than s_num_entries. A crafted image can request index s_num_entries, pass the bounds check, and make the kernel read one entry past the allocated VAT table. Change the check to reject block >= s_num_entries, so the count is handled as an exclusive upper bound. A crafted UDF image reproduced this on origin/master commit 0e35b9b6ec0ffcc5e23cbdec09f5c622ad532b53 with a KASAN slab-out-of-bounds report in udf_get_pblock_virt15(). Trail of Bits has a reproducer that triggers kernel panic demonstrating the bug, and can share it if needed. CVE-2026-89525 · NVD, Red Hat · matched kernel	vulnerability 2	medium	5.5	2026-09-11

Facets

Kind 99152 of 99152 claims

Source 99152 of 99152 claims

Severity 26286 of 99152 claims

Exploited 1731 of 99152 claims

Sources

CISA Known Exploited Vulnerabilities primary

The only source that says a vulnerability is being exploited right now.

Red Hat high

Its own severity, and the packages it tracks a vulnerability in.

NVD high

The CVSS baseline, and an anchor for CVEs the other members never reach.

GitHub advisories high

The ecosystem packages no distribution ships.

Metasploit exploit modules normal

Whether a module exists for the tool an attacker actually runs.

Exploit-DB normal

Whether working code exists at all, which is a different question from how severe it is.

Write-ups normal

The prose that explains a vulnerability after the advisories have stopped.