{
  "day": "2026-07-19",
  "boundary": "UTC calendar day",
  "published_count": 464,
  "by_severity": {
    "CRITICAL": 58,
    "HIGH": 211,
    "MEDIUM": 72,
    "LOW": 18
  },
  "kev_count": 0,
  "exploit_reference_count": 0,
  "awaiting_enrichment_count": 105,
  "ranking": "Sort: (1) KEV membership, descending. (2) EPSS score, descending. (3) CVSS base score, descending. (4) CVE ID, ascending. CVEs lacking EPSS or CVSS data sort below those that have it within their KEV tier and are labeled AWAITING ENRICHMENT. Missing scores are never imputed.",
  "results": [
    {
      "rank": 1,
      "cve_id": "CVE-2026-44359",
      "cvss_base": 10,
      "cvss_severity": "CRITICAL",
      "epss_score": 0.01799,
      "epss_percentile": 0.76781,
      "kev": false,
      "kev_due_at": null,
      "vendor": "meshtastic",
      "product": "firmware",
      "cwe": "CWE-94",
      "title": "Meshtastic GitHub repo vulnerable to Arbitrary Code Execution via pull_request_target Fork Checkout in CI Workflow",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-44359"
    },
    {
      "rank": 2,
      "cve_id": "CVE-2026-63913",
      "cvss_base": 8.2,
      "cvss_severity": "HIGH",
      "epss_score": 0.00971,
      "epss_percentile": 0.59277,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-63913"
    },
    {
      "rank": 3,
      "cve_id": "CVE-2026-63887",
      "cvss_base": 9.8,
      "cvss_severity": "CRITICAL",
      "epss_score": 0.00778,
      "epss_percentile": 0.53074,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-63887"
    },
    {
      "rank": 4,
      "cve_id": "CVE-2026-63888",
      "cvss_base": 9.8,
      "cvss_severity": "CRITICAL",
      "epss_score": 0.00778,
      "epss_percentile": 0.53074,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd()",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-63888"
    },
    {
      "rank": 5,
      "cve_id": "CVE-2026-63825",
      "cvss_base": 9.8,
      "cvss_severity": "CRITICAL",
      "epss_score": 0.00775,
      "epss_percentile": 0.53003,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "gcov: use atomic counter updates to fix concurrent access crashes",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-63825"
    },
    {
      "rank": 6,
      "cve_id": "CVE-2026-63993",
      "cvss_base": 9.8,
      "cvss_severity": "CRITICAL",
      "epss_score": 0.00755,
      "epss_percentile": 0.52332,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu()",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-63993"
    },
    {
      "rank": 7,
      "cve_id": "CVE-2026-64046",
      "cvss_base": 9.8,
      "cvss_severity": "CRITICAL",
      "epss_score": 0.00755,
      "epss_percentile": 0.5233,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "net: tls: prevent chain-after-chain in plain text SG",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-64046"
    },
    {
      "rank": 8,
      "cve_id": "CVE-2026-64047",
      "cvss_base": 9.8,
      "cvss_severity": "CRITICAL",
      "epss_score": 0.00755,
      "epss_percentile": 0.5233,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "net: tls: fix off-by-one in sg_chain entry count for wrapped sk_msg ring",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-64047"
    },
    {
      "rank": 9,
      "cve_id": "CVE-2026-64055",
      "cvss_base": 9.8,
      "cvss_severity": "CRITICAL",
      "epss_score": 0.00755,
      "epss_percentile": 0.52331,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "net: ethernet: cortina: Carry over frag counter",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-64055"
    },
    {
      "rank": 10,
      "cve_id": "CVE-2026-63992",
      "cvss_base": 9.1,
      "cvss_severity": "CRITICAL",
      "epss_score": 0.00735,
      "epss_percentile": 0.51665,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "tunnels: do not assume transport header in iptunnel_pmtud_check_icmp()",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-63992"
    },
    {
      "rank": 11,
      "cve_id": "CVE-2026-64102",
      "cvss_base": 9.8,
      "cvss_severity": "CRITICAL",
      "epss_score": 0.00734,
      "epss_percentile": 0.51622,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": "CWE-125",
      "title": "RDMA/siw: Reject MPA FPDU length underflow before signed receive math",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-64102"
    },
    {
      "rank": 12,
      "cve_id": "CVE-2026-64113",
      "cvss_base": 9.8,
      "cvss_severity": "CRITICAL",
      "epss_score": 0.00734,
      "epss_percentile": 0.51622,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": "CWE-416",
      "title": "ixgbevf: fix use-after-free in VEPA multicast source pruning",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-64113"
    },
    {
      "rank": 13,
      "cve_id": "CVE-2026-64000",
      "cvss_base": 9.8,
      "cvss_severity": "CRITICAL",
      "epss_score": 0.00721,
      "epss_percentile": 0.51165,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "net: hsr: fix potential OOB access in supervision frame handling",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-64000"
    },
    {
      "rank": 14,
      "cve_id": "CVE-2026-64033",
      "cvss_base": 9.8,
      "cvss_severity": "CRITICAL",
      "epss_score": 0.00717,
      "epss_percentile": 0.51023,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "RDMA/rtrs: Fix use-after-free in path file creation cleanup",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-64033"
    },
    {
      "rank": 15,
      "cve_id": "CVE-2026-63912",
      "cvss_base": 9.8,
      "cvss_severity": "CRITICAL",
      "epss_score": 0.00714,
      "epss_percentile": 0.50894,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "xfrm: esp: restore combined single-frag length gate",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-63912"
    },
    {
      "rank": 16,
      "cve_id": "CVE-2026-63922",
      "cvss_base": 9.8,
      "cvss_severity": "CRITICAL",
      "epss_score": 0.00714,
      "epss_percentile": 0.50893,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "ipv6: exthdrs: refresh nh after handling HAO option",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-63922"
    },
    {
      "rank": 17,
      "cve_id": "CVE-2026-63924",
      "cvss_base": 9.8,
      "cvss_severity": "CRITICAL",
      "epss_score": 0.00714,
      "epss_percentile": 0.50893,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo()",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-63924"
    },
    {
      "rank": 18,
      "cve_id": "CVE-2026-63886",
      "cvss_base": 9.8,
      "cvss_severity": "CRITICAL",
      "epss_score": 0.00711,
      "epss_percentile": 0.508,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "scsi: target: iscsi: Validate CHAP_R length before base64 decode",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-63886"
    },
    {
      "rank": 19,
      "cve_id": "CVE-2026-16209",
      "cvss_base": 5.5,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00709,
      "epss_percentile": 0.5073,
      "kev": false,
      "kev_due_at": null,
      "vendor": "n/a",
      "product": "Gerapy",
      "cwe": "CWE-287",
      "title": "Gerapy Project Upload Endpoint views.py missing authentication",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-16209"
    },
    {
      "rank": 20,
      "cve_id": "CVE-2026-64142",
      "cvss_base": 9.8,
      "cvss_severity": "CRITICAL",
      "epss_score": 0.00705,
      "epss_percentile": 0.50556,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": "CWE-416",
      "title": "ksmbd: close durable scavenger races against m_fp_list lookups",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-64142"
    },
    {
      "rank": 21,
      "cve_id": "CVE-2026-64116",
      "cvss_base": 7.5,
      "cvss_severity": "HIGH",
      "epss_score": 0.007,
      "epss_percentile": 0.50383,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": "CWE-476",
      "title": "ipv6: ioam: add NULL check for idev in ipv6_hop_ioam()",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-64116"
    },
    {
      "rank": 22,
      "cve_id": "CVE-2026-16210",
      "cvss_base": 5.5,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00686,
      "epss_percentile": 0.49883,
      "kev": false,
      "kev_due_at": null,
      "vendor": "newpanjing",
      "product": "simpleui",
      "cwe": "CWE-287",
      "title": "newpanjing simpleui AjaxAdmin AJAX Endpoint admin.py self.get_action missing authentication",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-16210"
    },
    {
      "rank": 23,
      "cve_id": "CVE-2026-64132",
      "cvss_base": 9.8,
      "cvss_severity": "CRITICAL",
      "epss_score": 0.00671,
      "epss_percentile": 0.49259,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": "CWE-416",
      "title": "ipv6: ioam: refresh hdr pointer before ioam6_event()",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-64132"
    },
    {
      "rank": 24,
      "cve_id": "CVE-2026-64136",
      "cvss_base": 9.8,
      "cvss_severity": "CRITICAL",
      "epss_score": 0.00671,
      "epss_percentile": 0.49259,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked()",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-64136"
    },
    {
      "rank": 25,
      "cve_id": "CVE-2026-64148",
      "cvss_base": 7.5,
      "cvss_severity": "HIGH",
      "epss_score": 0.0067,
      "epss_percentile": 0.49206,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": "CWE-835",
      "title": "pds_core: fix error handling in pdsc_devcmd_wait",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-64148"
    },
    {
      "rank": 26,
      "cve_id": "CVE-2026-63968",
      "cvss_base": 7.5,
      "cvss_severity": "HIGH",
      "epss_score": 0.00665,
      "epss_percentile": 0.48992,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "ipv6: fix possible infinite loop in fib6_select_path()",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-63968"
    },
    {
      "rank": 27,
      "cve_id": "CVE-2026-53383",
      "cvss_base": 7.5,
      "cvss_severity": "HIGH",
      "epss_score": 0.00664,
      "epss_percentile": 0.48963,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": "CWE-476",
      "title": "ksmbd: reject non-VALID session in compound request branch",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-53383"
    },
    {
      "rank": 28,
      "cve_id": "CVE-2026-64025",
      "cvss_base": 9.8,
      "cvss_severity": "CRITICAL",
      "epss_score": 0.00652,
      "epss_percentile": 0.48496,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "bpf, skmsg: fix verdict sk_data_ready racing with ktls rx",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-64025"
    },
    {
      "rank": 29,
      "cve_id": "CVE-2026-64061",
      "cvss_base": 9.8,
      "cvss_severity": "CRITICAL",
      "epss_score": 0.00652,
      "epss_percentile": 0.48496,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "netfs: Fix early put of sink folio in netfs_read_gaps()",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-64061"
    },
    {
      "rank": 30,
      "cve_id": "CVE-2026-63919",
      "cvss_base": 8.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.0065,
      "epss_percentile": 0.48418,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "xfrm: input: hold netns during deferred transport reinjection",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-63919"
    },
    {
      "rank": 31,
      "cve_id": "CVE-2026-63857",
      "cvss_base": 9.8,
      "cvss_severity": "CRITICAL",
      "epss_score": 0.00649,
      "epss_percentile": 0.48365,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "net: airoha: Do not read uninitialized fragment address in airoha_dev_xmit()",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-63857"
    },
    {
      "rank": 32,
      "cve_id": "CVE-2026-63979",
      "cvss_base": 9.8,
      "cvss_severity": "CRITICAL",
      "epss_score": 0.00649,
      "epss_percentile": 0.48364,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "net/handshake: hand off the pinned file reference to accept_doit",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-63979"
    },
    {
      "rank": 33,
      "cve_id": "CVE-2026-64016",
      "cvss_base": 9.8,
      "cvss_severity": "CRITICAL",
      "epss_score": 0.00649,
      "epss_percentile": 0.48363,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "ksmbd: fix durable reconnect error path file lifetime",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-64016"
    },
    {
      "rank": 34,
      "cve_id": "CVE-2026-64035",
      "cvss_base": 9.8,
      "cvss_severity": "CRITICAL",
      "epss_score": 0.00649,
      "epss_percentile": 0.48363,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "igc: set tx buffer type for SMD frames",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-64035"
    },
    {
      "rank": 35,
      "cve_id": "CVE-2026-64066",
      "cvss_base": 9.8,
      "cvss_severity": "CRITICAL",
      "epss_score": 0.00649,
      "epss_percentile": 0.48364,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "netfs: Fix netfs_read_to_pagecache() to pause on subreq failure",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-64066"
    },
    {
      "rank": 36,
      "cve_id": "CVE-2026-64069",
      "cvss_base": 9.8,
      "cvss_severity": "CRITICAL",
      "epss_score": 0.00649,
      "epss_percentile": 0.48363,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "netfs: Fix cancellation of a DIO and single read subrequests",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-64069"
    },
    {
      "rank": 37,
      "cve_id": "CVE-2026-64150",
      "cvss_base": 9.8,
      "cvss_severity": "CRITICAL",
      "epss_score": 0.00649,
      "epss_percentile": 0.48365,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "netfilter: nft_inner: release local_lock before re-enabling softirqs",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-64150"
    },
    {
      "rank": 38,
      "cve_id": "CVE-2026-64162",
      "cvss_base": 9.8,
      "cvss_severity": "CRITICAL",
      "epss_score": 0.00649,
      "epss_percentile": 0.48364,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init()",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-64162"
    },
    {
      "rank": 39,
      "cve_id": "CVE-2026-64037",
      "cvss_base": 9.8,
      "cvss_severity": "CRITICAL",
      "epss_score": 0.00631,
      "epss_percentile": 0.4752,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-64037"
    },
    {
      "rank": 40,
      "cve_id": "CVE-2026-64122",
      "cvss_base": 9.8,
      "cvss_severity": "CRITICAL",
      "epss_score": 0.00631,
      "epss_percentile": 0.4752,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": "CWE-416",
      "title": "net/mlx5e: Fix use-after-free in mlx5e_tx_reporter_timeout_recover",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-64122"
    },
    {
      "rank": 41,
      "cve_id": "CVE-2026-63980",
      "cvss_base": 7.5,
      "cvss_severity": "HIGH",
      "epss_score": 0.0063,
      "epss_percentile": 0.47445,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "net/handshake: Use spin_lock_bh for hn_lock",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-63980"
    },
    {
      "rank": 42,
      "cve_id": "CVE-2026-64003",
      "cvss_base": 7.5,
      "cvss_severity": "HIGH",
      "epss_score": 0.0063,
      "epss_percentile": 0.47446,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-64003"
    },
    {
      "rank": 43,
      "cve_id": "CVE-2026-64141",
      "cvss_base": 7.5,
      "cvss_severity": "HIGH",
      "epss_score": 0.0063,
      "epss_percentile": 0.47443,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": "CWE-476",
      "title": "ksmbd: fix null pointer dereference in compare_guid_key()",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-64141"
    },
    {
      "rank": 44,
      "cve_id": "CVE-2026-63909",
      "cvss_base": 8.1,
      "cvss_severity": "HIGH",
      "epss_score": 0.00628,
      "epss_percentile": 0.47361,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "ksmbd: OOB read regression in smb_check_perm_dacl() ACE-walk loops",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-63909"
    },
    {
      "rank": 45,
      "cve_id": "CVE-2026-16207",
      "cvss_base": 6.3,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00622,
      "epss_percentile": 0.47138,
      "kev": false,
      "kev_due_at": null,
      "vendor": "n/a",
      "product": "django-tastypie",
      "cwe": "CWE-598",
      "title": "django-tastypie authentication.py ApiKeyAuthentication get request method with sensitive query strings",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-16207"
    },
    {
      "rank": 46,
      "cve_id": "CVE-2026-63978",
      "cvss_base": 9.8,
      "cvss_severity": "CRITICAL",
      "epss_score": 0.00618,
      "epss_percentile": 0.46886,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "net/handshake: Drain pending requests at net namespace exit",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-63978"
    },
    {
      "rank": 47,
      "cve_id": "CVE-2026-64175",
      "cvss_base": 7.5,
      "cvss_severity": "HIGH",
      "epss_score": 0.00609,
      "epss_percentile": 0.46456,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "wifi: iwlwifi: mld: stop TX during firmware restart",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-64175"
    },
    {
      "rank": 48,
      "cve_id": "CVE-2026-64138",
      "cvss_base": 8.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00601,
      "epss_percentile": 0.46075,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "ksmbd: validate SID in parent security descriptor during ACL inheritance",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-64138"
    },
    {
      "rank": 49,
      "cve_id": "CVE-2026-63867",
      "cvss_base": 8.2,
      "cvss_severity": "HIGH",
      "epss_score": 0.00592,
      "epss_percentile": 0.45665,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "mptcp: close TOCTOU race while computing rcv_wnd",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-63867"
    },
    {
      "rank": 50,
      "cve_id": "CVE-2026-63972",
      "cvss_base": 7.5,
      "cvss_severity": "HIGH",
      "epss_score": 0.00592,
      "epss_percentile": 0.45647,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "net: mana: Skip redundant detach on already-detached port",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-63972"
    },
    {
      "rank": 51,
      "cve_id": "CVE-2026-64024",
      "cvss_base": 9.4,
      "cvss_severity": "CRITICAL",
      "epss_score": 0.00566,
      "epss_percentile": 0.44395,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-64024"
    },
    {
      "rank": 52,
      "cve_id": "CVE-2026-64067",
      "cvss_base": 9.8,
      "cvss_severity": "CRITICAL",
      "epss_score": 0.00553,
      "epss_percentile": 0.43713,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "netfs: Fix missing barriers when accessing stream->subrequests locklessly",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-64067"
    },
    {
      "rank": 53,
      "cve_id": "CVE-2026-64068",
      "cvss_base": 9.8,
      "cvss_severity": "CRITICAL",
      "epss_score": 0.00553,
      "epss_percentile": 0.43713,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "netfs: Fix missing locking around retry adding new subreqs",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-64068"
    },
    {
      "rank": 54,
      "cve_id": "CVE-2026-64160",
      "cvss_base": 9.8,
      "cvss_severity": "CRITICAL",
      "epss_score": 0.00553,
      "epss_percentile": 0.43712,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "netfs: Fix potential for tearing in ->remote_i_size and ->zero_point",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-64160"
    },
    {
      "rank": 55,
      "cve_id": "CVE-2026-64056",
      "cvss_base": 9.8,
      "cvss_severity": "CRITICAL",
      "epss_score": 0.00552,
      "epss_percentile": 0.43636,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "net: ethernet: cortina: Make RX SKB per-port",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-64056"
    },
    {
      "rank": 56,
      "cve_id": "CVE-2026-64089",
      "cvss_base": 9.8,
      "cvss_severity": "CRITICAL",
      "epss_score": 0.00552,
      "epss_percentile": 0.43636,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "batman-adv: tt: fix negative last_changeset_len",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-64089"
    },
    {
      "rank": 57,
      "cve_id": "CVE-2026-64125",
      "cvss_base": 9.8,
      "cvss_severity": "CRITICAL",
      "epss_score": 0.00552,
      "epss_percentile": 0.43636,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "net: bcmgenet: keep RBUF EEE/PM disabled",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-64125"
    },
    {
      "rank": 58,
      "cve_id": "CVE-2026-16215",
      "cvss_base": 5.5,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00547,
      "epss_percentile": 0.43378,
      "kev": false,
      "kev_due_at": null,
      "vendor": "geex-arts",
      "product": "django-jet",
      "cwe": "CWE-862",
      "title": "geex-arts django-jet OAuth Credential Revoke authorization",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-16215"
    },
    {
      "rank": 59,
      "cve_id": "CVE-2026-16204",
      "cvss_base": 2.1,
      "cvss_severity": "LOW",
      "epss_score": 0.00547,
      "epss_percentile": 0.43387,
      "kev": false,
      "kev_due_at": null,
      "vendor": "zevorn",
      "product": "rt-claw",
      "cwe": "CWE-74",
      "title": "zevorn rt-claw Telegram-to-AI Tool Execution Flow script.c tool_run_script_execute code injection",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-16204"
    },
    {
      "rank": 60,
      "cve_id": "CVE-2026-53398",
      "cvss_base": 9.8,
      "cvss_severity": "CRITICAL",
      "epss_score": 0.00543,
      "epss_percentile": 0.43142,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "NFSD: Fix SECINFO_NO_NAME decode error cleanup",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-53398"
    },
    {
      "rank": 61,
      "cve_id": "CVE-2026-53399",
      "cvss_base": 9.8,
      "cvss_severity": "CRITICAL",
      "epss_score": 0.00543,
      "epss_percentile": 0.43143,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": "CWE-476",
      "title": "nfsd: release layout stid on setlease failure",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-53399"
    },
    {
      "rank": 62,
      "cve_id": "CVE-2026-16201",
      "cvss_base": 5.5,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00532,
      "epss_percentile": 0.42536,
      "kev": false,
      "kev_due_at": null,
      "vendor": "zevorn",
      "product": "rt-claw",
      "cwe": "CWE-200",
      "title": "zevorn rt-claw http_request net.c claw_net_post information disclosure",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-16201"
    },
    {
      "rank": 63,
      "cve_id": "CVE-2026-63976",
      "cvss_base": 8.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.0053,
      "epss_percentile": 0.4241,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "Bluetooth: l2cap: clear chan->ident on ECRED reconfiguration success",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-63976"
    },
    {
      "rank": 64,
      "cve_id": "CVE-2026-53392",
      "cvss_base": 7.5,
      "cvss_severity": "HIGH",
      "epss_score": 0.00529,
      "epss_percentile": 0.42352,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": "CWE-476",
      "title": "NFSv4/flexfiles: reject zero filehandle version count",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-53392"
    },
    {
      "rank": 65,
      "cve_id": "CVE-2026-53397",
      "cvss_base": 7.5,
      "cvss_severity": "HIGH",
      "epss_score": 0.00529,
      "epss_percentile": 0.42352,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": "CWE-401",
      "title": "nfsd: fix posix_acl leak on SETACL decode failure",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-53397"
    },
    {
      "rank": 66,
      "cve_id": "CVE-2026-63800",
      "cvss_base": 9.8,
      "cvss_severity": "CRITICAL",
      "epss_score": 0.00527,
      "epss_percentile": 0.42279,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": "CWE-416",
      "title": "pNFS: Fix use-after-free in pnfs_update_layout()",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-63800"
    },
    {
      "rank": 67,
      "cve_id": "CVE-2026-63808",
      "cvss_base": 9.8,
      "cvss_severity": "CRITICAL",
      "epss_score": 0.00527,
      "epss_percentile": 0.42279,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "exfat: fix potential use-after-free in exfat_find_dir_entry()",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-63808"
    },
    {
      "rank": 68,
      "cve_id": "CVE-2026-53391",
      "cvss_base": 7.5,
      "cvss_severity": "HIGH",
      "epss_score": 0.00517,
      "epss_percentile": 0.41615,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": "CWE-476",
      "title": "NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-53391"
    },
    {
      "rank": 69,
      "cve_id": "CVE-2026-53384",
      "cvss_base": 9.8,
      "cvss_severity": "CRITICAL",
      "epss_score": 0.00515,
      "epss_percentile": 0.4153,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": "CWE-416",
      "title": "serial: 8250_dw: unregister 8250 port if clk_notifier_register() fails",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-53384"
    },
    {
      "rank": 70,
      "cve_id": "CVE-2026-63984",
      "cvss_base": 9.8,
      "cvss_severity": "CRITICAL",
      "epss_score": 0.00514,
      "epss_percentile": 0.41439,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress()",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-63984"
    },
    {
      "rank": 71,
      "cve_id": "CVE-2026-63994",
      "cvss_base": 9.8,
      "cvss_severity": "CRITICAL",
      "epss_score": 0.00514,
      "epss_percentile": 0.41439,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]()",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-63994"
    },
    {
      "rank": 72,
      "cve_id": "CVE-2026-64007",
      "cvss_base": 9.8,
      "cvss_severity": "CRITICAL",
      "epss_score": 0.00514,
      "epss_percentile": 0.41437,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "netfilter: synproxy: refresh tcphdr after skb_ensure_writable",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-64007"
    },
    {
      "rank": 73,
      "cve_id": "CVE-2026-63801",
      "cvss_base": 8.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00513,
      "epss_percentile": 0.41347,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": "CWE-416",
      "title": "tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-63801"
    },
    {
      "rank": 74,
      "cve_id": "CVE-2026-63795",
      "cvss_base": 10,
      "cvss_severity": "CRITICAL",
      "epss_score": 0.00504,
      "epss_percentile": 0.40746,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": "CWE-416",
      "title": "9p: avoid putting oldfid in p9_client_walk() error path",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-63795"
    },
    {
      "rank": 75,
      "cve_id": "CVE-2026-64048",
      "cvss_base": 7.5,
      "cvss_severity": "HIGH",
      "epss_score": 0.00501,
      "epss_percentile": 0.40589,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-64048"
    },
    {
      "rank": 76,
      "cve_id": "CVE-2026-16200",
      "cvss_base": 5.5,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00495,
      "epss_percentile": 0.40203,
      "kev": false,
      "kev_due_at": null,
      "vendor": "zevorn",
      "product": "rt-claw",
      "cwe": "CWE-285",
      "title": "zevorn rt-claw RPC swarm.c claw_tool_invoke authorization",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-16200"
    },
    {
      "rank": 77,
      "cve_id": "CVE-2026-42566",
      "cvss_base": 7.5,
      "cvss_severity": "HIGH",
      "epss_score": 0.00488,
      "epss_percentile": 0.39759,
      "kev": false,
      "kev_due_at": null,
      "vendor": "meshtastic",
      "product": "firmware",
      "cwe": "CWE-20",
      "title": "Meshtastic: Malformed UTF-8 in User.long_name broadcast over LoRa causes mesh-wide client decode failure",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-42566"
    },
    {
      "rank": 78,
      "cve_id": "CVE-2026-53395",
      "cvss_base": 7.5,
      "cvss_severity": "HIGH",
      "epss_score": 0.00488,
      "epss_percentile": 0.39766,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": "CWE-674",
      "title": "nfsd: fix dead ACL conflict guard in nfsd4_create",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-53395"
    },
    {
      "rank": 79,
      "cve_id": "CVE-2026-63955",
      "cvss_base": 7.5,
      "cvss_severity": "HIGH",
      "epss_score": 0.00488,
      "epss_percentile": 0.39768,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "mm/vmalloc: do not trigger BUG() on BH disabled context",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-63955"
    },
    {
      "rank": 80,
      "cve_id": "CVE-2026-64020",
      "cvss_base": 7.5,
      "cvss_severity": "HIGH",
      "epss_score": 0.00488,
      "epss_percentile": 0.39765,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "nvme-pci: fix dma_vecs leak on p2p memory",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-64020"
    },
    {
      "rank": 81,
      "cve_id": "CVE-2026-64140",
      "cvss_base": 7.5,
      "cvss_severity": "HIGH",
      "epss_score": 0.00488,
      "epss_percentile": 0.39767,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": "CWE-476",
      "title": "ksmbd: fix null pointer dereference in proc_show_files()",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-64140"
    },
    {
      "rank": 82,
      "cve_id": "CVE-2026-53394",
      "cvss_base": 7.5,
      "cvss_severity": "HIGH",
      "epss_score": 0.00483,
      "epss_percentile": 0.39445,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": "CWE-401",
      "title": "nfsd: avoid leaking pre-allocated openowner on unconfirmed retry race",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-53394"
    },
    {
      "rank": 83,
      "cve_id": "CVE-2026-63796",
      "cvss_base": 8.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00481,
      "epss_percentile": 0.39284,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": "CWE-125",
      "title": "ocfs2: reject oversized group bitmap descriptors",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-63796"
    },
    {
      "rank": 84,
      "cve_id": "CVE-2026-53390",
      "cvss_base": 8.1,
      "cvss_severity": "HIGH",
      "epss_score": 0.0047,
      "epss_percentile": 0.38545,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": "CWE-125",
      "title": "ksmbd: fix out-of-bounds read in smb_check_perm_dacl()",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-53390"
    },
    {
      "rank": 85,
      "cve_id": "CVE-2026-16220",
      "cvss_base": 2.1,
      "cvss_severity": "LOW",
      "epss_score": 0.0047,
      "epss_percentile": 0.3857,
      "kev": false,
      "kev_due_at": null,
      "vendor": "code-projects",
      "product": "Online Examination System",
      "cwe": "CWE-79",
      "title": "code-projects Online Examination System account.php cross site scripting",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-16220"
    },
    {
      "rank": 86,
      "cve_id": "CVE-2026-16229",
      "cvss_base": 2.1,
      "cvss_severity": "LOW",
      "epss_score": 0.0047,
      "epss_percentile": 0.38569,
      "kev": false,
      "kev_due_at": null,
      "vendor": "itsourcecode",
      "product": "Courier Management System",
      "cwe": "CWE-79",
      "title": "itsourcecode Courier Management System index.php cross site scripting",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-16229"
    },
    {
      "rank": 87,
      "cve_id": "CVE-2026-16221",
      "cvss_base": 7.5,
      "cvss_severity": "HIGH",
      "epss_score": 0.00436,
      "epss_percentile": 0.36104,
      "kev": false,
      "kev_due_at": null,
      "vendor": "fast-uri",
      "product": "fast-uri",
      "cwe": "CWE-436",
      "title": "fast-uri vulnerable to host confusion via literal backslash authority delimiter",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-16221"
    },
    {
      "rank": 88,
      "cve_id": "CVE-2026-16227",
      "cvss_base": 5.5,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00431,
      "epss_percentile": 0.35657,
      "kev": false,
      "kev_due_at": null,
      "vendor": "SourceCodester",
      "product": "Class and Exam Timetabling System",
      "cwe": "CWE-74",
      "title": "SourceCodester Class and Exam Timetabling System edit_subject.php sql injection",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-16227"
    },
    {
      "rank": 89,
      "cve_id": "CVE-2026-16228",
      "cvss_base": 5.5,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00431,
      "epss_percentile": 0.35659,
      "kev": false,
      "kev_due_at": null,
      "vendor": "SourceCodester",
      "product": "Class and Exam Timetabling System",
      "cwe": "CWE-74",
      "title": "SourceCodester Class and Exam Timetabling System edit_schoolyr.php sql injection",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-16228"
    },
    {
      "rank": 90,
      "cve_id": "CVE-2026-64091",
      "cvss_base": 9.8,
      "cvss_severity": "CRITICAL",
      "epss_score": 0.00426,
      "epss_percentile": 0.35268,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": "CWE-367",
      "title": "batman-adv: tt: fix TOCTOU race for reported vlans",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-64091"
    },
    {
      "rank": 91,
      "cve_id": "CVE-2026-16219",
      "cvss_base": 2.1,
      "cvss_severity": "LOW",
      "epss_score": 0.00425,
      "epss_percentile": 0.35164,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Croogo",
      "product": "CMS",
      "cwe": "CWE-22",
      "title": "Croogo CMS Admin File Manager FileManager.php isEditable path traversal",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-16219"
    },
    {
      "rank": 92,
      "cve_id": "CVE-2026-63916",
      "cvss_base": 8.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00412,
      "epss_percentile": 0.34003,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "HID: wacom: Fix OOB write in wacom_hid_set_device_mode()",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-63916"
    },
    {
      "rank": 93,
      "cve_id": "CVE-2026-64088",
      "cvss_base": 8.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00412,
      "epss_percentile": 0.34001,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "batman-adv: tt: fix negative tt_buff_len",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-64088"
    },
    {
      "rank": 94,
      "cve_id": "CVE-2026-64178",
      "cvss_base": 8.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00412,
      "epss_percentile": 0.34001,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": "CWE-416",
      "title": "Bluetooth: bnep: Fix UAF read of dev->name",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-64178"
    },
    {
      "rank": 95,
      "cve_id": "CVE-2026-64095",
      "cvss_base": 7.1,
      "cvss_severity": "HIGH",
      "epss_score": 0.00408,
      "epss_percentile": 0.33667,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "batman-adv: bla: avoid double decrement of bla.num_requests",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-64095"
    },
    {
      "rank": 96,
      "cve_id": "CVE-2026-63947",
      "cvss_base": 8.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00403,
      "epss_percentile": 0.3312,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "Bluetooth: HIDP: fix missing length checks in hidp_input_report()",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-63947"
    },
    {
      "rank": 97,
      "cve_id": "CVE-2026-64093",
      "cvss_base": 8.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00403,
      "epss_percentile": 0.3312,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "batman-adv: tp_meter: directly shut down timer on cleanup",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-64093"
    },
    {
      "rank": 98,
      "cve_id": "CVE-2026-63925",
      "cvss_base": 8.1,
      "cvss_severity": "HIGH",
      "epss_score": 0.00402,
      "epss_percentile": 0.33034,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "macsec: fix replay protection at XPN lower-PN wrap",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-63925"
    },
    {
      "rank": 99,
      "cve_id": "CVE-2026-64010",
      "cvss_base": 8.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.004,
      "epss_percentile": 0.32908,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "nfc: llcp: Fix use-after-free race in nfc_llcp_recv_cc()",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-64010"
    },
    {
      "rank": 100,
      "cve_id": "CVE-2026-64096",
      "cvss_base": 8.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.004,
      "epss_percentile": 0.32908,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": "CWE-416",
      "title": "batman-adv: mcast: fix use-after-free in orig_node RCU release",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-64096"
    },
    {
      "rank": 101,
      "cve_id": "CVE-2026-16225",
      "cvss_base": 2.1,
      "cvss_severity": "LOW",
      "epss_score": 0.00399,
      "epss_percentile": 0.32711,
      "kev": false,
      "kev_due_at": null,
      "vendor": "davenardella",
      "product": "snap7",
      "cwe": "CWE-119",
      "title": "davenardella snap7 s7_peer.cpp NegotiatePDULength out-of-bounds write",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-16225"
    },
    {
      "rank": 102,
      "cve_id": "CVE-2026-12484",
      "cvss_base": 7.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00393,
      "epss_percentile": 0.32108,
      "kev": false,
      "kev_due_at": null,
      "vendor": "keras-team",
      "product": "keras-team/keras",
      "cwe": "CWE-502",
      "title": "Unsafe Deserialization in keras.layers.TorchModuleWrapper.from_config",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-12484"
    },
    {
      "rank": 103,
      "cve_id": "CVE-2026-63889",
      "cvss_base": 8.1,
      "cvss_severity": "HIGH",
      "epss_score": 0.00389,
      "epss_percentile": 0.31684,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-63889"
    },
    {
      "rank": 104,
      "cve_id": "CVE-2026-63944",
      "cvss_base": 8.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00387,
      "epss_percentile": 0.31515,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-63944"
    },
    {
      "rank": 105,
      "cve_id": "CVE-2026-63893",
      "cvss_base": 8.1,
      "cvss_severity": "HIGH",
      "epss_score": 0.00386,
      "epss_percentile": 0.31374,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "thunderbolt: property: Reject u32 wrap in tb_property_entry_valid()",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-63893"
    },
    {
      "rank": 106,
      "cve_id": "CVE-2026-16224",
      "cvss_base": 5.3,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00385,
      "epss_percentile": 0.3131,
      "kev": false,
      "kev_due_at": null,
      "vendor": "jxxghp",
      "product": "MoviePilot",
      "cwe": "CWE-266",
      "title": "jxxghp MoviePilot Application API improper authorization",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-16224"
    },
    {
      "rank": 107,
      "cve_id": "CVE-2026-16214",
      "cvss_base": 2.1,
      "cvss_severity": "LOW",
      "epss_score": 0.00384,
      "epss_percentile": 0.31161,
      "kev": false,
      "kev_due_at": null,
      "vendor": "geex-arts",
      "product": "django-jet",
      "cwe": "CWE-285",
      "title": "geex-arts django-jet Dashboard views.py authorization",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-16214"
    },
    {
      "rank": 108,
      "cve_id": "CVE-2026-16217",
      "cvss_base": 2.1,
      "cvss_severity": "LOW",
      "epss_score": 0.00384,
      "epss_percentile": 0.31161,
      "kev": false,
      "kev_due_at": null,
      "vendor": "guohongze",
      "product": "adminset",
      "cwe": "CWE-285",
      "title": "guohongze adminset Delivery Deployment Endpoint deli.py authorization",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-16217"
    },
    {
      "rank": 109,
      "cve_id": "CVE-2026-53396",
      "cvss_base": 7.1,
      "cvss_severity": "HIGH",
      "epss_score": 0.0038,
      "epss_percentile": 0.30724,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": "CWE-401",
      "title": "nfsd: fix posix_acl leak and ignored error in nfsd4_create_file",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-53396"
    },
    {
      "rank": 110,
      "cve_id": "CVE-2026-63974",
      "cvss_base": 8.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00379,
      "epss_percentile": 0.30682,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-63974"
    },
    {
      "rank": 111,
      "cve_id": "CVE-2026-16226",
      "cvss_base": 5.1,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00376,
      "epss_percentile": 0.30362,
      "kev": false,
      "kev_due_at": null,
      "vendor": "SourceCodester",
      "product": "Pizzafy Ecommerce System",
      "cwe": "CWE-284",
      "title": "SourceCodester Pizzafy Ecommerce System admin_class_novo.php save_settings unrestricted upload",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-16226"
    },
    {
      "rank": 112,
      "cve_id": "CVE-2026-63832",
      "cvss_base": 8.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00375,
      "epss_percentile": 0.30233,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "wifi: mt76: add wcid publish check in mt76_sta_add",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-63832"
    },
    {
      "rank": 113,
      "cve_id": "CVE-2026-63866",
      "cvss_base": 8.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00375,
      "epss_percentile": 0.30233,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "wifi: mt76: mt7996: Clear wcid pointer in mt7996_mac_sta_deinit_link()",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-63866"
    },
    {
      "rank": 114,
      "cve_id": "CVE-2026-64030",
      "cvss_base": 8.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00375,
      "epss_percentile": 0.30233,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-64030"
    },
    {
      "rank": 115,
      "cve_id": "CVE-2026-16222",
      "cvss_base": 2.1,
      "cvss_severity": "LOW",
      "epss_score": 0.00374,
      "epss_percentile": 0.30158,
      "kev": false,
      "kev_due_at": null,
      "vendor": "1Panel-dev",
      "product": "CordysCRM",
      "cwe": "CWE-918",
      "title": "1Panel-dev CordysCRM Third Party Endpoint TokenService.java server-side request forgery",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-16222"
    },
    {
      "rank": 116,
      "cve_id": "CVE-2026-16223",
      "cvss_base": 2.1,
      "cvss_severity": "LOW",
      "epss_score": 0.00374,
      "epss_percentile": 0.30159,
      "kev": false,
      "kev_due_at": null,
      "vendor": "1Panel-dev",
      "product": "CordysCRM",
      "cwe": "CWE-918",
      "title": "1Panel-dev CordysCRM Third Party Edit Endpoint IntegrationConfigService.java getSqlBotSrc server-side request forgery",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-16223"
    },
    {
      "rank": 117,
      "cve_id": "CVE-2026-63830",
      "cvss_base": 9.4,
      "cvss_severity": "CRITICAL",
      "epss_score": 0.00372,
      "epss_percentile": 0.29908,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "net: skmsg: preserve sg.copy across SG transforms",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-63830"
    },
    {
      "rank": 118,
      "cve_id": "CVE-2026-16206",
      "cvss_base": 5.3,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00366,
      "epss_percentile": 0.29256,
      "kev": false,
      "kev_due_at": null,
      "vendor": "django-oauth",
      "product": "django-oauth-toolkit",
      "cwe": "CWE-613",
      "title": "django-oauth django-oauth-toolkit oauth2_validators.py _load_id_token session expiration",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-16206"
    },
    {
      "rank": 119,
      "cve_id": "CVE-2026-16199",
      "cvss_base": 2.1,
      "cvss_severity": "LOW",
      "epss_score": 0.00366,
      "epss_percentile": 0.29256,
      "kev": false,
      "kev_due_at": null,
      "vendor": "nextlevelbuilder",
      "product": "GoClaw",
      "cwe": "CWE-266",
      "title": "nextlevelbuilder GoClaw credentialed_exec.go ExecTool.Execute improper authorization",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-16199"
    },
    {
      "rank": 120,
      "cve_id": "CVE-2026-63915",
      "cvss_base": 8.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00354,
      "epss_percentile": 0.28069,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "nfc: hci: fix out-of-bounds read in HCP header parsing",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-63915"
    },
    {
      "rank": 121,
      "cve_id": "CVE-2026-63975",
      "cvss_base": 8.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00354,
      "epss_percentile": 0.28069,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-63975"
    },
    {
      "rank": 122,
      "cve_id": "CVE-2026-16205",
      "cvss_base": 1.9,
      "cvss_severity": "LOW",
      "epss_score": 0.0035,
      "epss_percentile": 0.27556,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Pluck",
      "product": "CMS",
      "cwe": "CWE-79",
      "title": "Pluck CMS Albums albums.admin.php htmlspecialchars_decode cross site scripting",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-16205"
    },
    {
      "rank": 123,
      "cve_id": "CVE-2026-16202",
      "cvss_base": 2,
      "cvss_severity": "LOW",
      "epss_score": 0.00348,
      "epss_percentile": 0.27402,
      "kev": false,
      "kev_due_at": null,
      "vendor": "SourceCodester",
      "product": "Class and Exam Timetabling System",
      "cwe": "CWE-79",
      "title": "SourceCodester Class and Exam Timetabling System CYS.php cross site scripting",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-16202"
    },
    {
      "rank": 124,
      "cve_id": "CVE-2026-16203",
      "cvss_base": 2,
      "cvss_severity": "LOW",
      "epss_score": 0.00348,
      "epss_percentile": 0.27403,
      "kev": false,
      "kev_due_at": null,
      "vendor": "SourceCodester",
      "product": "Class and Exam Timetabling System",
      "cwe": "CWE-79",
      "title": "SourceCodester Class and Exam Timetabling System forCYS.php cross site scripting",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-16203"
    },
    {
      "rank": 125,
      "cve_id": "CVE-2026-64176",
      "cvss_base": 8.1,
      "cvss_severity": "HIGH",
      "epss_score": 0.00342,
      "epss_percentile": 0.26772,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "wifi: iwlwifi: mvm: fix driver-set TX rates on old devices",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-64176"
    },
    {
      "rank": 126,
      "cve_id": "CVE-2026-64117",
      "cvss_base": 8.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.0034,
      "epss_percentile": 0.26548,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": "CWE-416",
      "title": "wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-64117"
    },
    {
      "rank": 127,
      "cve_id": "CVE-2026-63869",
      "cvss_base": 7.6,
      "cvss_severity": "HIGH",
      "epss_score": 0.00338,
      "epss_percentile": 0.26234,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-63869"
    },
    {
      "rank": 128,
      "cve_id": "CVE-2026-63946",
      "cvss_base": 8.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00336,
      "epss_percentile": 0.26054,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "Bluetooth: ISO: fix UAF in iso_recv_frame",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-63946"
    },
    {
      "rank": 129,
      "cve_id": "CVE-2026-16218",
      "cvss_base": 2.1,
      "cvss_severity": "LOW",
      "epss_score": 0.00294,
      "epss_percentile": 0.21365,
      "kev": false,
      "kev_due_at": null,
      "vendor": "hunvreus",
      "product": "devpush",
      "cwe": "CWE-703",
      "title": "hunvreus devpush Storage Reset Failure storage.py reset_storage improper check or handling of exceptional conditions",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-16218"
    },
    {
      "rank": 130,
      "cve_id": "CVE-2026-16212",
      "cvss_base": 1.3,
      "cvss_severity": "LOW",
      "epss_score": 0.0029,
      "epss_percentile": 0.20906,
      "kev": false,
      "kev_due_at": null,
      "vendor": "awesto",
      "product": "django-shop",
      "cwe": "CWE-362",
      "title": "awesto django-shop Purchase Stock inventory.py race condition",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-16212"
    },
    {
      "rank": 131,
      "cve_id": "CVE-2026-16208",
      "cvss_base": 2.3,
      "cvss_severity": "LOW",
      "epss_score": 0.00264,
      "epss_percentile": 0.17867,
      "kev": false,
      "kev_due_at": null,
      "vendor": "n/a",
      "product": "django-tastypie",
      "cwe": "CWE-362",
      "title": "django-tastypie throttle.py CacheDBThrottle race condition",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-16208"
    },
    {
      "rank": 132,
      "cve_id": "CVE-2026-63891",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.00263,
      "epss_percentile": 0.17761,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "thunderbolt: property: Cap recursion depth in __tb_property_parse_dir()",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-63891"
    },
    {
      "rank": 133,
      "cve_id": "CVE-2026-63895",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.00254,
      "epss_percentile": 0.16646,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "usb: gadget: f_fs: copy only received bytes on short ep0 read",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-63895"
    },
    {
      "rank": 134,
      "cve_id": "CVE-2026-63831",
      "cvss_base": 8.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00252,
      "epss_percentile": 0.16301,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "mac802154: llsec: add skb_cow_data() before in-place crypto",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-63831"
    },
    {
      "rank": 135,
      "cve_id": "CVE-2026-45138",
      "cvss_base": 5.4,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00235,
      "epss_percentile": 0.14163,
      "kev": false,
      "kev_due_at": null,
      "vendor": "ci4-cms-erp",
      "product": "ci4ms",
      "cwe": "CWE-79",
      "title": "CI4MS: Stored XSS in Blog Content via Broken `html_purify` Validation Rule",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-45138"
    },
    {
      "rank": 136,
      "cve_id": "CVE-2026-64028",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.00231,
      "epss_percentile": 0.13659,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "tracing: Avoid NULL return from hist_field_name() on truncation",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-64028"
    },
    {
      "rank": 137,
      "cve_id": "CVE-2026-16216",
      "cvss_base": 2.1,
      "cvss_severity": "LOW",
      "epss_score": 0.0023,
      "epss_percentile": 0.13588,
      "kev": false,
      "kev_due_at": null,
      "vendor": "geex-arts",
      "product": "django-jet",
      "cwe": "CWE-352",
      "title": "geex-arts django-jet OAuth cross-site request forgery",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-16216"
    },
    {
      "rank": 138,
      "cve_id": "CVE-2026-63981",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.00229,
      "epss_percentile": 0.13415,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "net/sched: act_mirred: Fix blockcast recursion bypass leading to stack overflow",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-63981"
    },
    {
      "rank": 139,
      "cve_id": "CVE-2026-63899",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.00226,
      "epss_percentile": 0.13047,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "USB: serial: mxuport: fix memory corruption with small endpoint",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-63899"
    },
    {
      "rank": 140,
      "cve_id": "CVE-2026-63901",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.00226,
      "epss_percentile": 0.13047,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "USB: serial: digi_acceleport: fix memory corruption with small endpoints",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-63901"
    },
    {
      "rank": 141,
      "cve_id": "CVE-2026-63990",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.00225,
      "epss_percentile": 0.13015,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "bonding: refuse to enslave CAN devices",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-63990"
    },
    {
      "rank": 142,
      "cve_id": "CVE-2026-16211",
      "cvss_base": 1.2,
      "cvss_severity": "LOW",
      "epss_score": 0.00224,
      "epss_percentile": 0.12755,
      "kev": false,
      "kev_due_at": null,
      "vendor": "n/a",
      "product": "allegro",
      "cwe": "CWE-362",
      "title": "allegro Hostname Allocation assets.py AssetLastHostname.increment_hostname race condition",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-16211"
    },
    {
      "rank": 143,
      "cve_id": "CVE-2026-63868",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.0022,
      "epss_percentile": 0.12258,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "net: garp: fix unsigned integer underflow in garp_pdu_parse_attr",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-63868"
    },
    {
      "rank": 144,
      "cve_id": "CVE-2026-63890",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.0022,
      "epss_percentile": 0.12259,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "scsi: fcoe: Reject FIP descriptors with zero fip_dlen in CVL walker",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-63890"
    },
    {
      "rank": 145,
      "cve_id": "CVE-2026-63892",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.0022,
      "epss_percentile": 0.12259,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "thunderbolt: property: Reject dir_len < 4 to prevent size_t underflow",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-63892"
    },
    {
      "rank": 146,
      "cve_id": "CVE-2026-63897",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.0022,
      "epss_percentile": 0.12259,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "USB: serial: mct_u232: fix missing interrupt-in transfer sanity check",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-63897"
    },
    {
      "rank": 147,
      "cve_id": "CVE-2026-63898",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.0022,
      "epss_percentile": 0.1225,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "USB: serial: mct_u232: fix memory corruption with small endpoint",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-63898"
    },
    {
      "rank": 148,
      "cve_id": "CVE-2026-63900",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.0022,
      "epss_percentile": 0.12251,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "USB: serial: keyspan: fix missing indat transfer sanity check",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-63900"
    },
    {
      "rank": 149,
      "cve_id": "CVE-2026-63902",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.0022,
      "epss_percentile": 0.1225,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "USB: serial: cypress_m8: validate interrupt packet headers",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-63902"
    },
    {
      "rank": 150,
      "cve_id": "CVE-2026-63903",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.0022,
      "epss_percentile": 0.12251,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "USB: serial: belkin_sa: validate interrupt status length",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-63903"
    },
    {
      "rank": 151,
      "cve_id": "CVE-2026-63904",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.0022,
      "epss_percentile": 0.12258,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "usb: usbtmc: check URB actual_length for interrupt-IN notifications",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-63904"
    },
    {
      "rank": 152,
      "cve_id": "CVE-2026-63905",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.0022,
      "epss_percentile": 0.12257,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "usbip: vudc: Fix use after free bug in vudc_remove due to race condition",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-63905"
    },
    {
      "rank": 153,
      "cve_id": "CVE-2026-63908",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.0022,
      "epss_percentile": 0.1225,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "Input: atmel_mxt_ts - fix boundary check in mxt_prepare_cfg_mem",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-63908"
    },
    {
      "rank": 154,
      "cve_id": "CVE-2026-63931",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.0022,
      "epss_percentile": 0.12249,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "iio: chemical: scd30: fix division by zero in write_raw",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-63931"
    },
    {
      "rank": 155,
      "cve_id": "CVE-2026-63933",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.0022,
      "epss_percentile": 0.1225,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "iio: gyro: adis16260: fix division by zero in write_raw",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-63933"
    },
    {
      "rank": 156,
      "cve_id": "CVE-2026-63934",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.0022,
      "epss_percentile": 0.12251,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "iio: gyro: itg3200: fix i2c read into the wrong stack location",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-63934"
    },
    {
      "rank": 157,
      "cve_id": "CVE-2026-63948",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.0022,
      "epss_percentile": 0.12254,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "Bluetooth: L2CAP: fix chan ref leak in l2cap_chan_timeout() on !conn",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-63948"
    },
    {
      "rank": 158,
      "cve_id": "CVE-2026-63956",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.0022,
      "epss_percentile": 0.12249,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "USB: serial: cypress_m8: fix memory corruption with small endpoint",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-63956"
    },
    {
      "rank": 159,
      "cve_id": "CVE-2026-63957",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.0022,
      "epss_percentile": 0.12248,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "USB: serial: safe_serial: fix memory corruption with small endpoint",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-63957"
    },
    {
      "rank": 160,
      "cve_id": "CVE-2026-63960",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.0022,
      "epss_percentile": 0.12256,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "usb: typec: wcove: don't write past struct pd_message in wcove_read_rx_buffer()",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-63960"
    },
    {
      "rank": 161,
      "cve_id": "CVE-2026-63961",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.0022,
      "epss_percentile": 0.12256,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "usb: typec: altmodes/displayport: validate count before reading Status Update VDO",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-63961"
    },
    {
      "rank": 162,
      "cve_id": "CVE-2026-63964",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.0022,
      "epss_percentile": 0.12251,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "usb: typec: ucsi: ccg: reject firmware images without a ':' record header",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-63964"
    },
    {
      "rank": 163,
      "cve_id": "CVE-2026-63967",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.0022,
      "epss_percentile": 0.12259,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "iio: imu: st_lsm6dsx: fix stack leak in tagged FIFO buffer",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-63967"
    },
    {
      "rank": 164,
      "cve_id": "CVE-2026-63991",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.0022,
      "epss_percentile": 0.12254,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "Bluetooth: 6lowpan: check skb_clone() return value in send_mcast_pkt()",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-63991"
    },
    {
      "rank": 165,
      "cve_id": "CVE-2026-64012",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.0022,
      "epss_percentile": 0.12257,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "net/sched: sch_sfb: Replace direct dequeue call with peek and qdisc_dequeue_peeked",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-64012"
    },
    {
      "rank": 166,
      "cve_id": "CVE-2026-64014",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.0022,
      "epss_percentile": 0.12255,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "Input: usbtouchscreen - clamp NEXIO data_len/x_len to URB buffer size",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-64014"
    },
    {
      "rank": 167,
      "cve_id": "CVE-2026-64083",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.0022,
      "epss_percentile": 0.12255,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "hwmon: (pmbus/adm1266) reject short block-read responses in the GPIO accessors",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-64083"
    },
    {
      "rank": 168,
      "cve_id": "CVE-2026-64085",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.0022,
      "epss_percentile": 0.12255,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "hwmon: (pmbus/adm1266) bounce blackbox records through a protocol-sized buffer",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-64085"
    },
    {
      "rank": 169,
      "cve_id": "CVE-2026-64087",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.0022,
      "epss_percentile": 0.12256,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "hwmon: (pmbus/adm1266) reject implausible blackbox record_count",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-64087"
    },
    {
      "rank": 170,
      "cve_id": "CVE-2026-63928",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.00216,
      "epss_percentile": 0.11877,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "USB: serial: omninet: fix memory corruption with small endpoint",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-63928"
    },
    {
      "rank": 171,
      "cve_id": "CVE-2026-63861",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.00215,
      "epss_percentile": 0.11658,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "spi: mtk-snfi: unregister ECC engine on probe failure and remove() callback",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-63861"
    },
    {
      "rank": 172,
      "cve_id": "CVE-2026-63862",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.00215,
      "epss_percentile": 0.11656,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "PCI: mediatek-gen3: Prevent leaking IRQ domains when IRQ not found",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-63862"
    },
    {
      "rank": 173,
      "cve_id": "CVE-2026-63882",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.00215,
      "epss_percentile": 0.11658,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "drm/amdkfd: fix NULL pointer bug in svm_range_set_attr",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-63882"
    },
    {
      "rank": 174,
      "cve_id": "CVE-2026-63949",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.00215,
      "epss_percentile": 0.11657,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "auxdisplay: line-display: fix OOB read on zero-length message_store()",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-63949"
    },
    {
      "rank": 175,
      "cve_id": "CVE-2026-63969",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.00215,
      "epss_percentile": 0.11656,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "ipv6: fix possible infinite loop in rt6_fill_node()",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-63969"
    },
    {
      "rank": 176,
      "cve_id": "CVE-2026-63973",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.00215,
      "epss_percentile": 0.11655,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "net: mana: Add NULL guards in teardown path to prevent panic on attach failure",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-63973"
    },
    {
      "rank": 177,
      "cve_id": "CVE-2026-63939",
      "cvss_base": 9.3,
      "cvss_severity": "CRITICAL",
      "epss_score": 0.00212,
      "epss_percentile": 0.11286,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "KVM: SEV: Compute the correct max length of the in-GHCB scratch area",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-63939"
    },
    {
      "rank": 178,
      "cve_id": "CVE-2026-63958",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.00211,
      "epss_percentile": 0.11257,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "usb: typec: ucsi: validate connector number in ucsi_connector_change()",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-63958"
    },
    {
      "rank": 179,
      "cve_id": "CVE-2026-63838",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.00209,
      "epss_percentile": 0.10894,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "ASoC: rsnd: Fix potential out-of-bounds access of component_dais[]",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-63838"
    },
    {
      "rank": 180,
      "cve_id": "CVE-2026-63871",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.00209,
      "epss_percentile": 0.10889,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "Bluetooth: ISO: Fix data-race on iso_pi fields in hci_get_route calls",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-63871"
    },
    {
      "rank": 181,
      "cve_id": "CVE-2026-63876",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.00209,
      "epss_percentile": 0.10893,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "serial: zs: Convert to use a platform device",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-63876"
    },
    {
      "rank": 182,
      "cve_id": "CVE-2026-63877",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.00209,
      "epss_percentile": 0.1089,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "serial: dz: Convert to use a platform device",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-63877"
    },
    {
      "rank": 183,
      "cve_id": "CVE-2026-63896",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.00209,
      "epss_percentile": 0.10892,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "usb: gadget: composite: fix integer underflow in WebUSB GET_URL handling",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-63896"
    },
    {
      "rank": 184,
      "cve_id": "CVE-2026-63929",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.00209,
      "epss_percentile": 0.10895,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "iio: buffer: Fix DMA fence leak in iio_buffer_enqueue_dmabuf()",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-63929"
    },
    {
      "rank": 185,
      "cve_id": "CVE-2026-63936",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.00209,
      "epss_percentile": 0.10892,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "iio: adc: mt6359: fix unchecked return value in mt6358_read_imp",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-63936"
    },
    {
      "rank": 186,
      "cve_id": "CVE-2026-63943",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.00209,
      "epss_percentile": 0.1089,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "Input: xpad - fix out-of-bounds access for Share button",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-63943"
    },
    {
      "rank": 187,
      "cve_id": "CVE-2026-63959",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.00209,
      "epss_percentile": 0.10894,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "usb: typec: tcpm/tcpci_maxim: validate header NDO against RX_BYTE_CNT",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-63959"
    },
    {
      "rank": 188,
      "cve_id": "CVE-2026-63962",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.00209,
      "epss_percentile": 0.10894,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "usb: typec: tcpm: bound altmode_desc[] per iteration in svdm_consume_modes()",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-63962"
    },
    {
      "rank": 189,
      "cve_id": "CVE-2026-63963",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.00209,
      "epss_percentile": 0.10894,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "usb: typec: tcpm: validate VDO count in Discover Identity ACK handlers",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-63963"
    },
    {
      "rank": 190,
      "cve_id": "CVE-2026-63997",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.00209,
      "epss_percentile": 0.10891,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "ethtool: module: avoid leaking a netdev ref on module flash errors",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-63997"
    },
    {
      "rank": 191,
      "cve_id": "CVE-2026-64001",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.00209,
      "epss_percentile": 0.10893,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "ALSA: pcm: oss: Fix setup list UAF on proc write error",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-64001"
    },
    {
      "rank": 192,
      "cve_id": "CVE-2026-64006",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.00209,
      "epss_percentile": 0.1089,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "netfilter: nf_tables: fix dst corruption in same register operation",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-64006"
    },
    {
      "rank": 193,
      "cve_id": "CVE-2026-64052",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.00209,
      "epss_percentile": 0.10893,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "block: bio-integrity: Fix null-ptr-deref in bio_integrity_map_user()",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-64052"
    },
    {
      "rank": 194,
      "cve_id": "CVE-2026-64059",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.00209,
      "epss_percentile": 0.10891,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "netfs: Fix folio->private handling in netfs_perform_write()",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-64059"
    },
    {
      "rank": 195,
      "cve_id": "CVE-2026-64062",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.00209,
      "epss_percentile": 0.10891,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "netfs: Fix potential deadlock in write-through mode",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-64062"
    },
    {
      "rank": 196,
      "cve_id": "CVE-2026-64063",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.00209,
      "epss_percentile": 0.1089,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "netfs: Fix streaming write being overwritten",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-64063"
    },
    {
      "rank": 197,
      "cve_id": "CVE-2026-64064",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.00209,
      "epss_percentile": 0.10891,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "netfs: Fix netfs_invalidate_folio() to clear dirty bit if all changes gone",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-64064"
    },
    {
      "rank": 198,
      "cve_id": "CVE-2026-64065",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.00209,
      "epss_percentile": 0.10892,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "netfs: fix VM_BUG_ON_FOLIO() issue in netfs_write_begin() call",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-64065"
    },
    {
      "rank": 199,
      "cve_id": "CVE-2026-63837",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.00206,
      "epss_percentile": 0.10596,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "net: ena: PHC: Check return code before setting timestamp output",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-63837"
    },
    {
      "rank": 200,
      "cve_id": "CVE-2026-63859",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.00206,
      "epss_percentile": 0.10595,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "net: airoha: Add missing bits in airoha_qdma_cleanup_tx_queue()",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-63859"
    },
    {
      "rank": 201,
      "cve_id": "CVE-2026-63873",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.00206,
      "epss_percentile": 0.10597,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "accel/amdxdna: Fix mm_struct reference leak in aie2_populate_range()",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-63873"
    },
    {
      "rank": 202,
      "cve_id": "CVE-2026-63878",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.00206,
      "epss_percentile": 0.10598,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "drm/amdgpu: check num_entries in GEM_OP GET_MAPPING_INFO",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-63878"
    },
    {
      "rank": 203,
      "cve_id": "CVE-2026-63880",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.00206,
      "epss_percentile": 0.10598,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "drm/amdgpu: fix lock leak on ENOMEM in AMDGPU_GEM_OP_GET_MAPPING_INFO",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-63880"
    },
    {
      "rank": 204,
      "cve_id": "CVE-2026-63932",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.00206,
      "epss_percentile": 0.10599,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "iio: chemical: mhz19b: reject oversized serial replies",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-63932"
    },
    {
      "rank": 205,
      "cve_id": "CVE-2026-63965",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.00206,
      "epss_percentile": 0.10601,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "iio: pressure: bmp280: fix stack leak in bmp580 trigger handler",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-63965"
    },
    {
      "rank": 206,
      "cve_id": "CVE-2026-63966",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.00206,
      "epss_percentile": 0.10594,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "iio: imu: adis16550: fix stack leak in trigger handler",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-63966"
    },
    {
      "rank": 207,
      "cve_id": "CVE-2026-63982",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.00206,
      "epss_percentile": 0.10599,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "net/sched: Fix ethx:ingress -> ethy:egress -> ethx:ingress mirred loop",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-63982"
    },
    {
      "rank": 208,
      "cve_id": "CVE-2026-63983",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.00206,
      "epss_percentile": 0.10599,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "net/sched: fix packet loop on netem when duplicate is on",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-63983"
    },
    {
      "rank": 209,
      "cve_id": "CVE-2026-63986",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.00206,
      "epss_percentile": 0.10597,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "ethtool: tsinfo: don't pass ERR_PTR to genlmsg_cancel on prepare failure",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-63986"
    },
    {
      "rank": 210,
      "cve_id": "CVE-2026-63988",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.00206,
      "epss_percentile": 0.10598,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "bridge: Fix sleep in atomic context in sysfs path",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-63988"
    },
    {
      "rank": 211,
      "cve_id": "CVE-2026-63989",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.00206,
      "epss_percentile": 0.106,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "bridge: Fix sleep in atomic context in netlink path",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-63989"
    },
    {
      "rank": 212,
      "cve_id": "CVE-2026-63998",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.00206,
      "epss_percentile": 0.10599,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "ethtool: module: call ethnl_ops_complete() on module flash errors",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-63998"
    },
    {
      "rank": 213,
      "cve_id": "CVE-2026-63999",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.00206,
      "epss_percentile": 0.10596,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "ethtool: rss: fix indir_table and hkey leak on get_rxfh failure",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-63999"
    },
    {
      "rank": 214,
      "cve_id": "CVE-2026-64021",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.00206,
      "epss_percentile": 0.10601,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "drm/xe/oa: Fix exec_queue leak on width check in stream open",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-64021"
    },
    {
      "rank": 215,
      "cve_id": "CVE-2026-64022",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.00206,
      "epss_percentile": 0.106,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "gpio: aggregator: remove the software node when deactivating the aggregator",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-64022"
    },
    {
      "rank": 216,
      "cve_id": "CVE-2026-64038",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.00206,
      "epss_percentile": 0.10597,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "hwmon: (lm90) Stop work before releasing hwmon device",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-64038"
    },
    {
      "rank": 217,
      "cve_id": "CVE-2026-64043",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.00206,
      "epss_percentile": 0.10595,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "ovpn: fix race between deleting interface and adding new peer",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-64043"
    },
    {
      "rank": 218,
      "cve_id": "CVE-2026-64049",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.00206,
      "epss_percentile": 0.10596,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "drm/msm/adreno: fix userspace-triggered crash on a2xx-a4xx",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-64049"
    },
    {
      "rank": 219,
      "cve_id": "CVE-2026-64054",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.00206,
      "epss_percentile": 0.10595,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "net: shaper: reject duplicate leaves in GROUP request",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-64054"
    },
    {
      "rank": 220,
      "cve_id": "CVE-2026-64060",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.00206,
      "epss_percentile": 0.106,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "netfs: Fix leak of request in netfs_write_begin() error handling",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-64060"
    },
    {
      "rank": 221,
      "cve_id": "CVE-2026-64071",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.00206,
      "epss_percentile": 0.10597,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "nvme-pci: fix use-after-free in nvme_free_host_mem()",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-64071"
    },
    {
      "rank": 222,
      "cve_id": "CVE-2026-64072",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.00206,
      "epss_percentile": 0.10601,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "nvme: fix bio leak on mapping failure",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-64072"
    },
    {
      "rank": 223,
      "cve_id": "CVE-2026-64075",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.00206,
      "epss_percentile": 0.106,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "fprobe: Fix unregister_fprobe() to wait for RCU grace period",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-64075"
    },
    {
      "rank": 224,
      "cve_id": "CVE-2026-64034",
      "cvss_base": 9.3,
      "cvss_severity": "CRITICAL",
      "epss_score": 0.00205,
      "epss_percentile": 0.10441,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-64034"
    },
    {
      "rank": 225,
      "cve_id": "CVE-2026-64009",
      "cvss_base": 7.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00201,
      "epss_percentile": 0.09877,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "xfrm: Check for underflow in xfrm_state_mtu",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-64009"
    },
    {
      "rank": 226,
      "cve_id": "CVE-2026-64080",
      "cvss_base": 9.3,
      "cvss_severity": "CRITICAL",
      "epss_score": 0.00198,
      "epss_percentile": 0.09572,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "firmware: arm_ffa: Snapshot notifier callbacks under lock",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-64080"
    },
    {
      "rank": 227,
      "cve_id": "CVE-2026-63820",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.00198,
      "epss_percentile": 0.09518,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "f2fs: fix missing read bio submission on large folio error",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-63820"
    },
    {
      "rank": 228,
      "cve_id": "CVE-2026-63839",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.00198,
      "epss_percentile": 0.09519,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "platform/x86: lenovo-wmi-helpers: Fix memory leak in lwmi_dev_evaluate_int()",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-63839"
    },
    {
      "rank": 229,
      "cve_id": "CVE-2026-63907",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.00198,
      "epss_percentile": 0.09519,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "uio: uio_pci_generic_sva: fix double free of devm_kzalloc() memory",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-63907"
    },
    {
      "rank": 230,
      "cve_id": "CVE-2026-63935",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.00198,
      "epss_percentile": 0.09519,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "iio: adc: nxp-sar-adc: fix division by zero in write_raw",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-63935"
    },
    {
      "rank": 231,
      "cve_id": "CVE-2026-63953",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.00198,
      "epss_percentile": 0.09519,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "mm/migrate_device: fix pgtable leak in migrate_vma_insert_huge_pmd_page",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-63953"
    },
    {
      "rank": 232,
      "cve_id": "CVE-2026-64013",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.00198,
      "epss_percentile": 0.0952,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "ACPI: button: Fix ACPI GPE handler leak during removal",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-64013"
    },
    {
      "rank": 233,
      "cve_id": "CVE-2026-64019",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.00198,
      "epss_percentile": 0.09518,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "nvme-pci: fix dma mapping leak on data setup error",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-64019"
    },
    {
      "rank": 234,
      "cve_id": "CVE-2026-64040",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.00198,
      "epss_percentile": 0.09517,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "cachefiles: Fix error return when vfs_mkdir() fails",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-64040"
    },
    {
      "rank": 235,
      "cve_id": "CVE-2026-64070",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.00198,
      "epss_percentile": 0.09521,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "powerpc/hv-gpci: fix preempt count leak in sysfs show paths",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-64070"
    },
    {
      "rank": 236,
      "cve_id": "CVE-2026-64079",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.00198,
      "epss_percentile": 0.09517,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "netfilter: x_tables: allocate hook ops while under mutex",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-64079"
    },
    {
      "rank": 237,
      "cve_id": "CVE-2026-63938",
      "cvss_base": 9.3,
      "cvss_severity": "CRITICAL",
      "epss_score": 0.00196,
      "epss_percentile": 0.0927,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "KVM: SEV: Check PSC request indices against the actual size of the buffer",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-63938"
    },
    {
      "rank": 238,
      "cve_id": "CVE-2026-63940",
      "cvss_base": 9.3,
      "cvss_severity": "CRITICAL",
      "epss_score": 0.00196,
      "epss_percentile": 0.09269,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "KVM: SEV: Ignore Port I/O requests of length '0'",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-63940"
    },
    {
      "rank": 239,
      "cve_id": "CVE-2026-64018",
      "cvss_base": 9.3,
      "cvss_severity": "CRITICAL",
      "epss_score": 0.00196,
      "epss_percentile": 0.09269,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "net: mana: validate rx_req_idx to prevent out-of-bounds array access",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-64018"
    },
    {
      "rank": 240,
      "cve_id": "CVE-2026-63860",
      "cvss_base": 8.4,
      "cvss_severity": "HIGH",
      "epss_score": 0.00196,
      "epss_percentile": 0.09269,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "RDMA/core: Prefer NLA_NUL_STRING",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-63860"
    },
    {
      "rank": 241,
      "cve_id": "CVE-2026-63926",
      "cvss_base": 8.4,
      "cvss_severity": "HIGH",
      "epss_score": 0.00196,
      "epss_percentile": 0.0927,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "bpf: sockmap: fix tail fragment offset in bpf_msg_push_data",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-63926"
    },
    {
      "rank": 242,
      "cve_id": "CVE-2026-64118",
      "cvss_base": 8.4,
      "cvss_severity": "HIGH",
      "epss_score": 0.00196,
      "epss_percentile": 0.09269,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": "CWE-415",
      "title": "qed: fix double free in qed_cxt_tables_alloc()",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-64118"
    },
    {
      "rank": 243,
      "cve_id": "CVE-2026-64172",
      "cvss_base": 7.1,
      "cvss_severity": "HIGH",
      "epss_score": 0.00195,
      "epss_percentile": 0.09201,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "KVM: SVM: Disable AVIC IPI virtualization on Hygon Family 18h (erratum #1235)",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-64172"
    },
    {
      "rank": 244,
      "cve_id": "CVE-2026-64045",
      "cvss_base": 8.4,
      "cvss_severity": "HIGH",
      "epss_score": 0.00194,
      "epss_percentile": 0.09033,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "ovpn: tcp - use cached peer pointer in ovpn_tcp_close()",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-64045"
    },
    {
      "rank": 245,
      "cve_id": "CVE-2026-64081",
      "cvss_base": 8.4,
      "cvss_severity": "HIGH",
      "epss_score": 0.00194,
      "epss_percentile": 0.09033,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "firmware: arm_ffa: Validate framework notification message layout",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-64081"
    },
    {
      "rank": 246,
      "cve_id": "CVE-2026-63906",
      "cvss_base": 8.4,
      "cvss_severity": "HIGH",
      "epss_score": 0.0019,
      "epss_percentile": 0.08659,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "usb: musb: omap2430: Fix use-after-free in omap2430_probe()",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-63906"
    },
    {
      "rank": 247,
      "cve_id": "CVE-2026-63881",
      "cvss_base": 7.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00189,
      "epss_percentile": 0.08566,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "drm/amdkfd: fix a vulnerability of integer overflow in kfd debugger",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-63881"
    },
    {
      "rank": 248,
      "cve_id": "CVE-2026-64041",
      "cvss_base": 7.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00187,
      "epss_percentile": 0.08331,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "ASoC: codecs: fs210x: fix possible buffer overflow",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-64041"
    },
    {
      "rank": 249,
      "cve_id": "CVE-2026-64114",
      "cvss_base": 7.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00185,
      "epss_percentile": 0.08038,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": "CWE-125",
      "title": "ipv4: raw: reject IP_HDRINCL packets with ihl < 5",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-64114"
    },
    {
      "rank": 250,
      "cve_id": "CVE-2026-64044",
      "cvss_base": 7.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00184,
      "epss_percentile": 0.07967,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "ovpn: respect peer refcount in CMD_NEW_PEER error path",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-64044"
    },
    {
      "rank": 251,
      "cve_id": "CVE-2026-63810",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.00183,
      "epss_percentile": 0.07855,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "block: Avoid mounting the bdev pseudo-filesystem in userspace",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-63810"
    },
    {
      "rank": 252,
      "cve_id": "CVE-2026-63864",
      "cvss_base": 8.4,
      "cvss_severity": "HIGH",
      "epss_score": 0.0018,
      "epss_percentile": 0.07508,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "bpf: Propagate error from visit_tailcall_insn",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-63864"
    },
    {
      "rank": 253,
      "cve_id": "CVE-2026-64073",
      "cvss_base": 7.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.0018,
      "epss_percentile": 0.07575,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "irq_work: Fix use-after-free in irq_work_single() on PREEMPT_RT",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-64073"
    },
    {
      "rank": 254,
      "cve_id": "CVE-2026-64039",
      "cvss_base": 7.7,
      "cvss_severity": "HIGH",
      "epss_score": 0.0018,
      "epss_percentile": 0.07577,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "drm/msm/snapshot: fix dumping of the unaligned regions",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-64039"
    },
    {
      "rank": 255,
      "cve_id": "CVE-2026-53401",
      "cvss_base": 7.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00177,
      "epss_percentile": 0.07228,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": "CWE-416",
      "title": "fbdev: omap2: fix use-after-free in omapfb_mmap",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-53401"
    },
    {
      "rank": 256,
      "cve_id": "CVE-2026-63951",
      "cvss_base": 7.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00177,
      "epss_percentile": 0.07228,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "zram: fix use-after-free in zram_writeback_endio",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-63951"
    },
    {
      "rank": 257,
      "cve_id": "CVE-2026-63865",
      "cvss_base": 8.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00176,
      "epss_percentile": 0.07108,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "bpf: Drop task_to_inode and inet_conn_established from lsm sleepable hooks",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-63865"
    },
    {
      "rank": 258,
      "cve_id": "CVE-2026-63921",
      "cvss_base": 8.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00176,
      "epss_percentile": 0.07135,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate().",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-63921"
    },
    {
      "rank": 259,
      "cve_id": "CVE-2026-64153",
      "cvss_base": 8.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00176,
      "epss_percentile": 0.07114,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "drm/msm: Fix iommu_map_sgtable() return value check and avoid WARN",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-64153"
    },
    {
      "rank": 260,
      "cve_id": "CVE-2026-63870",
      "cvss_base": 7.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00176,
      "epss_percentile": 0.07108,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "ieee802154: 6lowpan: only accept IPv6 packets in lowpan_xmit()",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-63870"
    },
    {
      "rank": 261,
      "cve_id": "CVE-2026-63875",
      "cvss_base": 7.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00176,
      "epss_percentile": 0.07112,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "arm64: tlb: Flush walk cache when unsharing PMD tables",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-63875"
    },
    {
      "rank": 262,
      "cve_id": "CVE-2026-63884",
      "cvss_base": 7.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00176,
      "epss_percentile": 0.07117,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "drm/i915: Fix potential UAF in TTM object purge",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-63884"
    },
    {
      "rank": 263,
      "cve_id": "CVE-2026-63942",
      "cvss_base": 7.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00176,
      "epss_percentile": 0.07111,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "parport: Fix race between port and client registration",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-63942"
    },
    {
      "rank": 264,
      "cve_id": "CVE-2026-63954",
      "cvss_base": 7.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00176,
      "epss_percentile": 0.07111,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "hpfs: fix a crash if hpfs_map_dnode_bitmap fails",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-63954"
    },
    {
      "rank": 265,
      "cve_id": "CVE-2026-63985",
      "cvss_base": 7.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00176,
      "epss_percentile": 0.07111,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "ethtool: eeprom: add more safeties to EEPROM Netlink fallback",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-63985"
    },
    {
      "rank": 266,
      "cve_id": "CVE-2026-64002",
      "cvss_base": 7.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00176,
      "epss_percentile": 0.07106,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table()",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-64002"
    },
    {
      "rank": 267,
      "cve_id": "CVE-2026-64004",
      "cvss_base": 7.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00176,
      "epss_percentile": 0.07108,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "net/iucv: fix locking in .getsockopt",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-64004"
    },
    {
      "rank": 268,
      "cve_id": "CVE-2026-64005",
      "cvss_base": 7.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00176,
      "epss_percentile": 0.07105,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "net/smc: Do not re-initialize smc hashtables",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-64005"
    },
    {
      "rank": 269,
      "cve_id": "CVE-2026-64015",
      "cvss_base": 7.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00176,
      "epss_percentile": 0.07111,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "security/keys: fix missed RCU read section on lookup",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-64015"
    },
    {
      "rank": 270,
      "cve_id": "CVE-2026-64084",
      "cvss_base": 7.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00176,
      "epss_percentile": 0.07105,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "hwmon: (pmbus/adm1266) cap PDIO scan in get_multiple at ADM1266_PDIO_NR",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-64084"
    },
    {
      "rank": 271,
      "cve_id": "CVE-2026-64086",
      "cvss_base": 7.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00176,
      "epss_percentile": 0.07106,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "hwmon: (pmbus/adm1266) include PEC byte in pmbus_block_xfer read buffer",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-64086"
    },
    {
      "rank": 272,
      "cve_id": "CVE-2026-64097",
      "cvss_base": 7.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00176,
      "epss_percentile": 0.07108,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": "CWE-787",
      "title": "drm/amd/display: Validate GPIO pin LUT table size before iterating",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-64097"
    },
    {
      "rank": 273,
      "cve_id": "CVE-2026-64108",
      "cvss_base": 7.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00176,
      "epss_percentile": 0.07105,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "cifs: Fix busy dentry used after unmounting",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-64108"
    },
    {
      "rank": 274,
      "cve_id": "CVE-2026-64133",
      "cvss_base": 7.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00176,
      "epss_percentile": 0.07115,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": "CWE-125",
      "title": "ALSA: asihpi: Fix potential OOB array access at reading cache",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-64133"
    },
    {
      "rank": 275,
      "cve_id": "CVE-2026-64137",
      "cvss_base": 7.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00176,
      "epss_percentile": 0.07114,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "smb: client: require net admin for CIFS SWN netlink",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-64137"
    },
    {
      "rank": 276,
      "cve_id": "CVE-2026-63937",
      "cvss_base": 8.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00175,
      "epss_percentile": 0.07018,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-63937"
    },
    {
      "rank": 277,
      "cve_id": "CVE-2026-64109",
      "cvss_base": 8.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00175,
      "epss_percentile": 0.07017,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": "CWE-416",
      "title": "af_unix: Fix UAF read of tail->len in unix_stream_data_wait()",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-64109"
    },
    {
      "rank": 278,
      "cve_id": "CVE-2026-53386",
      "cvss_base": 7.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00175,
      "epss_percentile": 0.07023,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": "CWE-129",
      "title": "iio: adc: ti-ads1298: add bounds check to pga_settings index",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-53386"
    },
    {
      "rank": 279,
      "cve_id": "CVE-2026-63812",
      "cvss_base": 7.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00175,
      "epss_percentile": 0.07019,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "f2fs: fix incorrect FI_NO_EXTENT handling in __destroy_extent_node()",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-63812"
    },
    {
      "rank": 280,
      "cve_id": "CVE-2026-63842",
      "cvss_base": 7.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00175,
      "epss_percentile": 0.07015,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "drm/amdgpu/jpeg: set no_user_fence for JPEG v5.0.0 ring",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-63842"
    },
    {
      "rank": 281,
      "cve_id": "CVE-2026-63843",
      "cvss_base": 7.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00175,
      "epss_percentile": 0.07017,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "drm/amdgpu/jpeg: set no_user_fence for JPEG v4.0.5 ring",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-63843"
    },
    {
      "rank": 282,
      "cve_id": "CVE-2026-63844",
      "cvss_base": 7.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00175,
      "epss_percentile": 0.0702,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "drm/amdgpu/jpeg: set no_user_fence for JPEG v4.0.3 ring",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-63844"
    },
    {
      "rank": 283,
      "cve_id": "CVE-2026-63845",
      "cvss_base": 7.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00175,
      "epss_percentile": 0.0702,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "drm/amdgpu/jpeg: set no_user_fence for JPEG v4.0 ring",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-63845"
    },
    {
      "rank": 284,
      "cve_id": "CVE-2026-63846",
      "cvss_base": 7.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00175,
      "epss_percentile": 0.07021,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "drm/amdgpu/jpeg: set no_user_fence for JPEG v3.0 ring",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-63846"
    },
    {
      "rank": 285,
      "cve_id": "CVE-2026-63847",
      "cvss_base": 7.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00175,
      "epss_percentile": 0.07018,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "drm/amdgpu/jpeg: set no_user_fence for JPEG v2.5 ring",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-63847"
    },
    {
      "rank": 286,
      "cve_id": "CVE-2026-63848",
      "cvss_base": 7.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00175,
      "epss_percentile": 0.07019,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "drm/amdgpu/jpeg: set no_user_fence for JPEG v2.0 ring",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-63848"
    },
    {
      "rank": 287,
      "cve_id": "CVE-2026-63850",
      "cvss_base": 7.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00175,
      "epss_percentile": 0.07017,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "drm/amdgpu/vcn: set no_user_fence for VCN v5.0.0 enc ring",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-63850"
    },
    {
      "rank": 288,
      "cve_id": "CVE-2026-63851",
      "cvss_base": 7.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00175,
      "epss_percentile": 0.07019,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "drm/amdgpu/vcn: set no_user_fence for VCN v4.0.5 enc ring",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-63851"
    },
    {
      "rank": 289,
      "cve_id": "CVE-2026-63852",
      "cvss_base": 7.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00175,
      "epss_percentile": 0.07021,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "drm/amdgpu/vcn: set no_user_fence for VCN v4.0.3 enc ring",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-63852"
    },
    {
      "rank": 290,
      "cve_id": "CVE-2026-63854",
      "cvss_base": 7.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00175,
      "epss_percentile": 0.0702,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "drm/amdgpu/vcn: set no_user_fence for VCN v3.0 enc/dec rings",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-63854"
    },
    {
      "rank": 291,
      "cve_id": "CVE-2026-63855",
      "cvss_base": 7.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00175,
      "epss_percentile": 0.07019,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "drm/amdgpu/vcn: set no_user_fence for VCN v2.5 enc/dec rings",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-63855"
    },
    {
      "rank": 292,
      "cve_id": "CVE-2026-63856",
      "cvss_base": 7.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00175,
      "epss_percentile": 0.07021,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "drm/amdgpu/vcn: set no_user_fence for VCN v2.0 enc/dec rings",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-63856"
    },
    {
      "rank": 293,
      "cve_id": "CVE-2026-63970",
      "cvss_base": 7.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00175,
      "epss_percentile": 0.07028,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "vsock/virtio: bind uarg before filling zerocopy skb",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-63970"
    },
    {
      "rank": 294,
      "cve_id": "CVE-2026-63987",
      "cvss_base": 7.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00175,
      "epss_percentile": 0.07022,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "ethtool: coalesce: cap profile updates at NET_DIM_PARAMS_NUM_PROFILES",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-63987"
    },
    {
      "rank": 295,
      "cve_id": "CVE-2026-63995",
      "cvss_base": 7.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00175,
      "epss_percentile": 0.07022,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "ethtool: cmis: validate start_cmd_payload_size from module",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-63995"
    },
    {
      "rank": 296,
      "cve_id": "CVE-2026-63996",
      "cvss_base": 7.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00175,
      "epss_percentile": 0.07015,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "ethtool: cmis: require exact CDB reply length",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-63996"
    },
    {
      "rank": 297,
      "cve_id": "CVE-2026-64026",
      "cvss_base": 7.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00175,
      "epss_percentile": 0.0702,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "rxrpc: Fix DATA decrypt vs splice() by copying data to buffer in recvmsg",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-64026"
    },
    {
      "rank": 298,
      "cve_id": "CVE-2026-64051",
      "cvss_base": 7.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00175,
      "epss_percentile": 0.07018,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "accel/qaic: Add overflow check to remap_pfn_range during mmap",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-64051"
    },
    {
      "rank": 299,
      "cve_id": "CVE-2026-64053",
      "cvss_base": 7.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00175,
      "epss_percentile": 0.07017,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "block: don't overwrite bip_vcnt in bio_integrity_copy_user()",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-64053"
    },
    {
      "rank": 300,
      "cve_id": "CVE-2026-64134",
      "cvss_base": 7.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00175,
      "epss_percentile": 0.07015,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": "CWE-476",
      "title": "ALSA: pcm: Don't setup bogus iov_iter for silencing",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-64134"
    },
    {
      "rank": 301,
      "cve_id": "CVE-2026-63822",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.00174,
      "epss_percentile": 0.06843,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "wifi: ath11k: fix warning when unbinding",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-63822"
    },
    {
      "rank": 302,
      "cve_id": "CVE-2026-63834",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.00174,
      "epss_percentile": 0.06901,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "batman-adv: tp_meter: restrict number of unacked list entries",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-63834"
    },
    {
      "rank": 303,
      "cve_id": "CVE-2026-63835",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.00174,
      "epss_percentile": 0.06901,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "batman-adv: v: prevent OGM aggregation on disabled hardif",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-63835"
    },
    {
      "rank": 304,
      "cve_id": "CVE-2026-63836",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.00174,
      "epss_percentile": 0.06902,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "batman-adv: tp_meter: avoid divide-by-zero for dec_cwnd",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-63836"
    },
    {
      "rank": 305,
      "cve_id": "CVE-2026-63885",
      "cvss_base": 8.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00173,
      "epss_percentile": 0.06783,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "drm/gem: fix race between change_handle and handle_delete",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-63885"
    },
    {
      "rank": 306,
      "cve_id": "CVE-2026-63923",
      "cvss_base": 8.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00173,
      "epss_percentile": 0.06779,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-63923"
    },
    {
      "rank": 307,
      "cve_id": "CVE-2026-64124",
      "cvss_base": 8.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00173,
      "epss_percentile": 0.06777,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "net: devmem: reject dma-buf bind with non-page-aligned size or SG length",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-64124"
    },
    {
      "rank": 308,
      "cve_id": "CVE-2026-63805",
      "cvss_base": 7.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00173,
      "epss_percentile": 0.06784,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "crypto: nx - fix nx_crypto_ctx_exit argument",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-63805"
    },
    {
      "rank": 309,
      "cve_id": "CVE-2026-63813",
      "cvss_base": 7.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00173,
      "epss_percentile": 0.06782,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "Revert \"f2fs: remove non-uptodate folio from the page cache in move_data_block\"",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-63813"
    },
    {
      "rank": 310,
      "cve_id": "CVE-2026-63819",
      "cvss_base": 7.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00173,
      "epss_percentile": 0.06782,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "f2fs: fix to do sanity check on f2fs_get_node_folio_ra()",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-63819"
    },
    {
      "rank": 311,
      "cve_id": "CVE-2026-63841",
      "cvss_base": 7.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00173,
      "epss_percentile": 0.06779,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "drm/amdgpu/jpeg: set no_user_fence for JPEG v5.0.1 ring",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-63841"
    },
    {
      "rank": 312,
      "cve_id": "CVE-2026-63849",
      "cvss_base": 7.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00173,
      "epss_percentile": 0.06783,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "drm/amdgpu/vcn: set no_user_fence for VCN v5.0.1 enc ring",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-63849"
    },
    {
      "rank": 313,
      "cve_id": "CVE-2026-63853",
      "cvss_base": 7.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00173,
      "epss_percentile": 0.06782,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "drm/amdgpu/vcn: set no_user_fence for VCN v4.0 enc ring",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-63853"
    },
    {
      "rank": 314,
      "cve_id": "CVE-2026-63874",
      "cvss_base": 7.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00173,
      "epss_percentile": 0.06779,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "net: mctp: usb: fix race between urb completion and rx_retry cancellation",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-63874"
    },
    {
      "rank": 315,
      "cve_id": "CVE-2026-63950",
      "cvss_base": 7.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00173,
      "epss_percentile": 0.06781,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "mm/rmap: initialize nr_pages to 1 at loop start in try_to_unmap_one",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-63950"
    },
    {
      "rank": 316,
      "cve_id": "CVE-2026-64008",
      "cvss_base": 7.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00173,
      "epss_percentile": 0.06777,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "accel/rocket: fix UAF via dangling GEM handle in create_bo",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-64008"
    },
    {
      "rank": 317,
      "cve_id": "CVE-2026-64027",
      "cvss_base": 7.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00173,
      "epss_percentile": 0.06781,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "net: shaper: rework the VALID marking (again)",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-64027"
    },
    {
      "rank": 318,
      "cve_id": "CVE-2026-64031",
      "cvss_base": 7.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00173,
      "epss_percentile": 0.06781,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "erofs: fix managed cache race for unaligned extents",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-64031"
    },
    {
      "rank": 319,
      "cve_id": "CVE-2026-64036",
      "cvss_base": 7.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00173,
      "epss_percentile": 0.06778,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "cgroup/rstat: validate cpu before css_rstat_cpu() access",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-64036"
    },
    {
      "rank": 320,
      "cve_id": "CVE-2026-64058",
      "cvss_base": 7.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00173,
      "epss_percentile": 0.06776,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "netfs: Fix netfs_read_folio() to wait on writeback",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-64058"
    },
    {
      "rank": 321,
      "cve_id": "CVE-2026-64074",
      "cvss_base": 7.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00173,
      "epss_percentile": 0.06782,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "fs/statmount: fix slab out-of-bounds write in statmount_mnt_idmap",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-64074"
    },
    {
      "rank": 322,
      "cve_id": "CVE-2026-64076",
      "cvss_base": 7.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00173,
      "epss_percentile": 0.0678,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "netfilter: bridge: eb_tables: close module init race",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-64076"
    },
    {
      "rank": 323,
      "cve_id": "CVE-2026-64077",
      "cvss_base": 7.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00173,
      "epss_percentile": 0.06781,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "netfilter: ebtables: move to two-stage removal scheme",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-64077"
    },
    {
      "rank": 324,
      "cve_id": "CVE-2026-64078",
      "cvss_base": 7.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00173,
      "epss_percentile": 0.0678,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "netfilter: x_tables: add and use xtables_unregister_table_exit",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-64078"
    },
    {
      "rank": 325,
      "cve_id": "CVE-2026-64181",
      "cvss_base": 7.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00173,
      "epss_percentile": 0.06778,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "mm: fix __vm_normal_page() to handle missing support for pmd_special()/pud_special()",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-64181"
    },
    {
      "rank": 326,
      "cve_id": "CVE-2026-63879",
      "cvss_base": 7.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00172,
      "epss_percentile": 0.06674,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "drm/amdgpu: fix amdgpu_hmm_range_get_pages",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-63879"
    },
    {
      "rank": 327,
      "cve_id": "CVE-2026-63821",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.00172,
      "epss_percentile": 0.06653,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "wifi: rtw88: usb: fix memory leaks on USB write failures",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-63821"
    },
    {
      "rank": 328,
      "cve_id": "CVE-2026-64115",
      "cvss_base": 8.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00171,
      "epss_percentile": 0.06544,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": "CWE-416",
      "title": "vsock/vmci: fix UAF when peer resets connection during handshake",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-64115"
    },
    {
      "rank": 329,
      "cve_id": "CVE-2026-63930",
      "cvss_base": 7.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00171,
      "epss_percentile": 0.06545,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "iio: buffer: hw-consumer: fix use-after-free in error path",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-63930"
    },
    {
      "rank": 330,
      "cve_id": "CVE-2026-63945",
      "cvss_base": 7.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00171,
      "epss_percentile": 0.06544,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-63945"
    },
    {
      "rank": 331,
      "cve_id": "CVE-2026-64011",
      "cvss_base": 7.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00171,
      "epss_percentile": 0.06543,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "nfc: llcp: Fix use-after-free in llcp_sock_release()",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-64011"
    },
    {
      "rank": 332,
      "cve_id": "CVE-2026-64032",
      "cvss_base": 7.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00171,
      "epss_percentile": 0.06543,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "bridge: mcast: Fix a possible use-after-free when removing a bridge port",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-64032"
    },
    {
      "rank": 333,
      "cve_id": "CVE-2026-64123",
      "cvss_base": 7.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00171,
      "epss_percentile": 0.06543,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": "CWE-416",
      "title": "net: hsr: defer node table free until after RCU readers",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-64123"
    },
    {
      "rank": 334,
      "cve_id": "CVE-2026-63883",
      "cvss_base": 7.3,
      "cvss_severity": "HIGH",
      "epss_score": 0.00171,
      "epss_percentile": 0.06512,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "serial: qcom_geni: fix kfifo underflow when flush precedes DMA completion IRQ",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-63883"
    },
    {
      "rank": 335,
      "cve_id": "CVE-2026-64126",
      "cvss_base": 7.3,
      "cvss_severity": "HIGH",
      "epss_score": 0.00171,
      "epss_percentile": 0.06576,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": "CWE-125",
      "title": "Bluetooth: MGMT: validate Add Extended Advertising Data length",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-64126"
    },
    {
      "rank": 336,
      "cve_id": "CVE-2026-64111",
      "cvss_base": 7.1,
      "cvss_severity": "HIGH",
      "epss_score": 0.00171,
      "epss_percentile": 0.06587,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "lsm: hold cred_guard_mutex for lsm_set_self_attr()",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-64111"
    },
    {
      "rank": 337,
      "cve_id": "CVE-2026-53389",
      "cvss_base": 7.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.0017,
      "epss_percentile": 0.06459,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": "CWE-416",
      "title": "net/tcp-ao: fix use-after-free of key in del_async path",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-53389"
    },
    {
      "rank": 338,
      "cve_id": "CVE-2026-63894",
      "cvss_base": 7.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.0017,
      "epss_percentile": 0.06461,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "usb: gadget: f_fs: serialize DMABUF cancel against request completion",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-63894"
    },
    {
      "rank": 339,
      "cve_id": "CVE-2026-63918",
      "cvss_base": 7.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.0017,
      "epss_percentile": 0.0646,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "l2tp: use refcount_inc_not_zero in l2tp_session_get_by_ifname",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-63918"
    },
    {
      "rank": 340,
      "cve_id": "CVE-2026-64029",
      "cvss_base": 7.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.0017,
      "epss_percentile": 0.0646,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "ALSA: seq: Serialize UMP output teardown with event_input",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-64029"
    },
    {
      "rank": 341,
      "cve_id": "CVE-2026-64099",
      "cvss_base": 7.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.0017,
      "epss_percentile": 0.06458,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": "CWE-416",
      "title": "drm/v3d: Fix use-after-free of CPU job query arrays on error path",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-64099"
    },
    {
      "rank": 342,
      "cve_id": "CVE-2026-63917",
      "cvss_base": 8.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00169,
      "epss_percentile": 0.06308,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "ip6: vti: Use ip6_tnl.net in vti6_changelink().",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-63917"
    },
    {
      "rank": 343,
      "cve_id": "CVE-2026-64104",
      "cvss_base": 8.7,
      "cvss_severity": "HIGH",
      "epss_score": 0.00169,
      "epss_percentile": 0.06322,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": "CWE-401",
      "title": "virt: sev-guest: Explicitly leak pages in unknown state",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-64104"
    },
    {
      "rank": 344,
      "cve_id": "CVE-2026-63971",
      "cvss_base": 7.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00169,
      "epss_percentile": 0.06311,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "sctp: fix race between sctp_wait_for_connect and peeloff",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-63971"
    },
    {
      "rank": 345,
      "cve_id": "CVE-2026-53368",
      "cvss_base": 7.1,
      "cvss_severity": "HIGH",
      "epss_score": 0.00169,
      "epss_percentile": 0.0634,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "f2fs: fix fsck inconsistency caused by incorrect nat_entry flag usage",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-53368"
    },
    {
      "rank": 346,
      "cve_id": "CVE-2026-63911",
      "cvss_base": 7.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00168,
      "epss_percentile": 0.06283,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "xfrm: iptfs: reset runtime state when cloning SAs",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-63911"
    },
    {
      "rank": 347,
      "cve_id": "CVE-2026-64023",
      "cvss_base": 7.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00168,
      "epss_percentile": 0.06284,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "gpio: aggregator: fix a potential use-after-free",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-64023"
    },
    {
      "rank": 348,
      "cve_id": "CVE-2026-64050",
      "cvss_base": 7.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00168,
      "epss_percentile": 0.06284,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "drm/msm/dpu: don't mix devm and drmm functions",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-64050"
    },
    {
      "rank": 349,
      "cve_id": "CVE-2026-63920",
      "cvss_base": 7.1,
      "cvss_severity": "HIGH",
      "epss_score": 0.00167,
      "epss_percentile": 0.06075,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "ipv6: validate extension header length before copying to cmsg",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-63920"
    },
    {
      "rank": 350,
      "cve_id": "CVE-2026-53387",
      "cvss_base": 7.1,
      "cvss_severity": "HIGH",
      "epss_score": 0.00166,
      "epss_percentile": 0.05995,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": "CWE-129",
      "title": "iio: light: veml6075: add bounds check to veml6075_it_ms index",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-53387"
    },
    {
      "rank": 351,
      "cve_id": "CVE-2026-63826",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.00166,
      "epss_percentile": 0.05972,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "fbdev: fix use-after-free in store_modes()",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-63826"
    },
    {
      "rank": 352,
      "cve_id": "CVE-2026-63863",
      "cvss_base": 8.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00165,
      "epss_percentile": 0.05886,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "drm/gpusvm: Fix unbalanced unlock in drm_gpusvm_scan_mm()",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-63863"
    },
    {
      "rank": 353,
      "cve_id": "CVE-2026-63941",
      "cvss_base": 8.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00165,
      "epss_percentile": 0.05886,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "KVM: arm64: Correctly cap ZCR_EL2 provided by a guest hypervisor",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-63941"
    },
    {
      "rank": 354,
      "cve_id": "CVE-2026-64042",
      "cvss_base": 8.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00165,
      "epss_percentile": 0.0589,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "vfio/pci: Check BAR resources before exporting a DMABUF",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-64042"
    },
    {
      "rank": 355,
      "cve_id": "CVE-2026-53373",
      "cvss_base": 7.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00165,
      "epss_percentile": 0.05887,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "mm/vma: do not try to unmap a VMA if mmap_prepare() invoked from mmap()",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-53373"
    },
    {
      "rank": 356,
      "cve_id": "CVE-2026-53380",
      "cvss_base": 7.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00165,
      "epss_percentile": 0.05889,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": "CWE-787",
      "title": "media: rzv2h-ivc: Fix concurrent buffer list access",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-53380"
    },
    {
      "rank": 357,
      "cve_id": "CVE-2026-63793",
      "cvss_base": 7.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00165,
      "epss_percentile": 0.0589,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": "CWE-416",
      "title": "ntfs: serialize volume label accesses",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-63793"
    },
    {
      "rank": 358,
      "cve_id": "CVE-2026-63799",
      "cvss_base": 7.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00165,
      "epss_percentile": 0.05892,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": "CWE-125",
      "title": "sched/mmcid: Fix OOB clear_bit when CID is MM_CID_UNSET in fixup path",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-63799"
    },
    {
      "rank": 359,
      "cve_id": "CVE-2026-63840",
      "cvss_base": 7.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00165,
      "epss_percentile": 0.05892,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "drm/amdgpu/jpeg: set no_user_fence for JPEG v5.3.0 ring",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-63840"
    },
    {
      "rank": 360,
      "cve_id": "CVE-2026-63858",
      "cvss_base": 7.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00165,
      "epss_percentile": 0.05891,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "netfilter: nf_tables: add hook transactions for device deletions",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-63858"
    },
    {
      "rank": 361,
      "cve_id": "CVE-2026-63910",
      "cvss_base": 7.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00165,
      "epss_percentile": 0.0589,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "dma-buf: fix UAF in dma_buf_fd() tracepoint",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-63910"
    },
    {
      "rank": 362,
      "cve_id": "CVE-2026-63977",
      "cvss_base": 7.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00165,
      "epss_percentile": 0.05888,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-63977"
    },
    {
      "rank": 363,
      "cve_id": "CVE-2026-64057",
      "cvss_base": 7.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00165,
      "epss_percentile": 0.05891,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "afs: Fix the locking used by afs_get_link()",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-64057"
    },
    {
      "rank": 364,
      "cve_id": "CVE-2026-64082",
      "cvss_base": 7.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00165,
      "epss_percentile": 0.05891,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "riscv: Fix register corruption from uninitialized cregs on error",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-64082"
    },
    {
      "rank": 365,
      "cve_id": "CVE-2026-63952",
      "cvss_base": 8.4,
      "cvss_severity": "HIGH",
      "epss_score": 0.00164,
      "epss_percentile": 0.05811,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "memfd: deny writeable mappings when implying SEAL_WRITE",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-63952"
    },
    {
      "rank": 366,
      "cve_id": "CVE-2026-63927",
      "cvss_base": 7.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00164,
      "epss_percentile": 0.05756,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "usb: dwc2: Fix use after free in debug code",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-63927"
    },
    {
      "rank": 367,
      "cve_id": "CVE-2026-64151",
      "cvss_base": 8.4,
      "cvss_severity": "HIGH",
      "epss_score": 0.00163,
      "epss_percentile": 0.05665,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "iommupt: Check for missing PAGE_SIZE in the pgsize_bitmap",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-64151"
    },
    {
      "rank": 368,
      "cve_id": "CVE-2026-63914",
      "cvss_base": 7.3,
      "cvss_severity": "HIGH",
      "epss_score": 0.00162,
      "epss_percentile": 0.05605,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "xfrm: route MIGRATE notifications to caller's netns",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-63914"
    },
    {
      "rank": 369,
      "cve_id": "CVE-2026-64105",
      "cvss_base": 5.5,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00162,
      "epss_percentile": 0.05548,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "KVM: arm64: vgic: Free private_irqs when init fails after allocation",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-64105"
    },
    {
      "rank": 370,
      "cve_id": "CVE-2026-64127",
      "cvss_base": 5.5,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00162,
      "epss_percentile": 0.05549,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "Bluetooth: L2CAP: ecred_reconfigure: send packed pdu, not stack pointer",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-64127"
    },
    {
      "rank": 371,
      "cve_id": "CVE-2026-64128",
      "cvss_base": 5.5,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00162,
      "epss_percentile": 0.05621,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": "CWE-476",
      "title": "Bluetooth: ISO: drop ISO_END frames received without prior ISO_START",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-64128"
    },
    {
      "rank": 372,
      "cve_id": "CVE-2026-64144",
      "cvss_base": 5.5,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00162,
      "epss_percentile": 0.05551,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": "CWE-401",
      "title": "Bluetooth: btmtk: fix urb->setup_packet leak in error paths",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-64144"
    },
    {
      "rank": 373,
      "cve_id": "CVE-2026-64157",
      "cvss_base": 5.5,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00162,
      "epss_percentile": 0.0555,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "netfs: Fix partial invalidation of streaming-write folio",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-64157"
    },
    {
      "rank": 374,
      "cve_id": "CVE-2026-64163",
      "cvss_base": 5.5,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00162,
      "epss_percentile": 0.05552,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "test_kprobes: clear kprobes between test runs",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-64163"
    },
    {
      "rank": 375,
      "cve_id": "CVE-2026-64170",
      "cvss_base": 5.5,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00162,
      "epss_percentile": 0.05621,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": "CWE-476",
      "title": "spi: qup: fix error pointer deref after DMA setup failure",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-64170"
    },
    {
      "rank": 376,
      "cve_id": "CVE-2026-64177",
      "cvss_base": 5.5,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00162,
      "epss_percentile": 0.05624,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "phonet/pep: disable BH around forwarded sk_receive_skb()",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-64177"
    },
    {
      "rank": 377,
      "cve_id": "CVE-2026-64179",
      "cvss_base": 5.5,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00162,
      "epss_percentile": 0.05621,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": "CWE-401",
      "title": "net: wwan: iosm: fix potential memory leaks in ipc_imem_init()",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-64179"
    },
    {
      "rank": 378,
      "cve_id": "CVE-2026-64180",
      "cvss_base": 5.5,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00162,
      "epss_percentile": 0.05551,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "mm/memory_hotplug: fix memory block reference leak on remove",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-64180"
    },
    {
      "rank": 379,
      "cve_id": "CVE-2026-64182",
      "cvss_base": 5.5,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00162,
      "epss_percentile": 0.0555,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "drivers/base/memory: fix memory block reference leak in poison accounting",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-64182"
    },
    {
      "rank": 380,
      "cve_id": "CVE-2026-64183",
      "cvss_base": 5.5,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00162,
      "epss_percentile": 0.05552,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": "CWE-476",
      "title": "efi: Allocate runtime workqueue before ACPI init",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-64183"
    },
    {
      "rank": 381,
      "cve_id": "CVE-2026-64184",
      "cvss_base": 5.5,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00162,
      "epss_percentile": 0.05551,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "mm/damon/sysfs-schemes: call missing mem_cgroup_iter_break()",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-64184"
    },
    {
      "rank": 382,
      "cve_id": "CVE-2026-53367",
      "cvss_base": 5.5,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.0016,
      "epss_percentile": 0.05361,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "selinux: fix avdcache auditing",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-53367"
    },
    {
      "rank": 383,
      "cve_id": "CVE-2026-53371",
      "cvss_base": 5.5,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.0016,
      "epss_percentile": 0.05359,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "RDMA/ionic: bound node_desc sysfs read with %.64s",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-53371"
    },
    {
      "rank": 384,
      "cve_id": "CVE-2026-53372",
      "cvss_base": 5.5,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.0016,
      "epss_percentile": 0.0536,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "iommu/vt-d: Block PASID attachment to nested domain with dirty tracking",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-53372"
    },
    {
      "rank": 385,
      "cve_id": "CVE-2026-64110",
      "cvss_base": 5.5,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.0016,
      "epss_percentile": 0.05354,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": "CWE-401",
      "title": "igc: fix potential skb leak in igc_fpe_xmit_smd_frame()",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-64110"
    },
    {
      "rank": 386,
      "cve_id": "CVE-2026-64120",
      "cvss_base": 5.5,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.0016,
      "epss_percentile": 0.05357,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": "CWE-476",
      "title": "net: ethtool: fix NULL pointer dereference in phy_reply_size",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-64120"
    },
    {
      "rank": 387,
      "cve_id": "CVE-2026-64130",
      "cvss_base": 5.5,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.0016,
      "epss_percentile": 0.05358,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": "CWE-908",
      "title": "mm/page_alloc: fix initialization of tags of the huge zero folio with init_on_free",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-64130"
    },
    {
      "rank": 388,
      "cve_id": "CVE-2026-64149",
      "cvss_base": 5.5,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.0016,
      "epss_percentile": 0.05358,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "dma-mapping: move dma_map_resource() sanity check into debug code",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-64149"
    },
    {
      "rank": 389,
      "cve_id": "CVE-2026-64156",
      "cvss_base": 5.5,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.0016,
      "epss_percentile": 0.05355,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "netfs, afs: Fix write skipping in dir/link writepages",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-64156"
    },
    {
      "rank": 390,
      "cve_id": "CVE-2026-63806",
      "cvss_base": 7.1,
      "cvss_severity": "HIGH",
      "epss_score": 0.00155,
      "epss_percentile": 0.04861,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": "CWE-617",
      "title": "KVM: Replace guest-triggerable BUG_ON() in ioeventfd datamatch with get_unaligned()",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-63806"
    },
    {
      "rank": 391,
      "cve_id": "CVE-2026-64094",
      "cvss_base": 5.5,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00155,
      "epss_percentile": 0.04902,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": "CWE-476",
      "title": "batman-adv: bla: avoid NULL-ptr deref for claim via dropped interface",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-64094"
    },
    {
      "rank": 392,
      "cve_id": "CVE-2026-63809",
      "cvss_base": 7.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00154,
      "epss_percentile": 0.04758,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "bpf: use kvfree() for replaced sysctl write buffer",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-63809"
    },
    {
      "rank": 393,
      "cve_id": "CVE-2026-64098",
      "cvss_base": 7.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00153,
      "epss_percentile": 0.047,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": "CWE-667",
      "title": "drm/virtio: use uninterruptible resv lock for plane updates",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-64098"
    },
    {
      "rank": 394,
      "cve_id": "CVE-2026-64106",
      "cvss_base": 9,
      "cvss_severity": "CRITICAL",
      "epss_score": 0.00148,
      "epss_percentile": 0.04248,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "KVM: arm64: vgic-its: Reject restored DTE with out-of-range num_eventid_bits",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-64106"
    },
    {
      "rank": 395,
      "cve_id": "CVE-2026-53369",
      "cvss_base": 8.4,
      "cvss_severity": "HIGH",
      "epss_score": 0.00147,
      "epss_percentile": 0.04159,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "udf: reject descriptors with oversized CRC length",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-53369"
    },
    {
      "rank": 396,
      "cve_id": "CVE-2026-63797",
      "cvss_base": 8.4,
      "cvss_severity": "HIGH",
      "epss_score": 0.00146,
      "epss_percentile": 0.0409,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": "CWE-416",
      "title": "rpmsg: char: Fix use-after-free on probe error path",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-63797"
    },
    {
      "rank": 397,
      "cve_id": "CVE-2026-53378",
      "cvss_base": 5.5,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00143,
      "epss_percentile": 0.03847,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": "CWE-401",
      "title": "drm/colorop: Fix blob property reference tracking in state lifecycle",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-53378"
    },
    {
      "rank": 398,
      "cve_id": "CVE-2026-64107",
      "cvss_base": 5.5,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00143,
      "epss_percentile": 0.03839,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": "CWE-476",
      "title": "ASoC: codecs: pcm512x: fix null-ptr dereference in pcm512x_overclock_xxx_put()",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-64107"
    },
    {
      "rank": 399,
      "cve_id": "CVE-2026-64146",
      "cvss_base": 5.5,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00143,
      "epss_percentile": 0.03839,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": "CWE-401",
      "title": "erofs: fix metabuf leak in inode xattr initialization",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-64146"
    },
    {
      "rank": 400,
      "cve_id": "CVE-2026-64159",
      "cvss_base": 5.5,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00143,
      "epss_percentile": 0.03839,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "netfs: Fix zeropoint update where i_size > remote_i_size",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-64159"
    },
    {
      "rank": 401,
      "cve_id": "CVE-2026-63794",
      "cvss_base": 7.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00142,
      "epss_percentile": 0.03721,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": "CWE-787",
      "title": "KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-63794"
    },
    {
      "rank": 402,
      "cve_id": "CVE-2026-64152",
      "cvss_base": 7.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00141,
      "epss_percentile": 0.03686,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "iommu: Handle unmap error when iommu_debug is enabled",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-64152"
    },
    {
      "rank": 403,
      "cve_id": "CVE-2026-63818",
      "cvss_base": 8.4,
      "cvss_severity": "HIGH",
      "epss_score": 0.0014,
      "epss_percentile": 0.03556,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "f2fs: validate orphan inode entry count",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-63818"
    },
    {
      "rank": 404,
      "cve_id": "CVE-2026-63815",
      "cvss_base": 8.4,
      "cvss_severity": "HIGH",
      "epss_score": 0.00139,
      "epss_percentile": 0.03517,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "f2fs: bound i_inline_xattr_size for non-inline-xattr inodes",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-63815"
    },
    {
      "rank": 405,
      "cve_id": "CVE-2026-53381",
      "cvss_base": 7.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00139,
      "epss_percentile": 0.03474,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": "CWE-416",
      "title": "virtiofs: fix UAF on submount umount",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-53381"
    },
    {
      "rank": 406,
      "cve_id": "CVE-2026-63807",
      "cvss_base": 8.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00137,
      "epss_percentile": 0.03309,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": "CWE-125",
      "title": "KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-63807"
    },
    {
      "rank": 407,
      "cve_id": "CVE-2026-63804",
      "cvss_base": 7.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00137,
      "epss_percentile": 0.03333,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": "CWE-416",
      "title": "gfs2: fix use-after-free in gfs2_qd_dealloc",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-63804"
    },
    {
      "rank": 408,
      "cve_id": "CVE-2026-64139",
      "cvss_base": 5.5,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00136,
      "epss_percentile": 0.03265,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": "CWE-401",
      "title": "ksmbd: fix SID memory leak in set_posix_acl_entries_dacl() on overflow",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-64139"
    },
    {
      "rank": 409,
      "cve_id": "CVE-2026-64112",
      "cvss_base": 7.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00135,
      "epss_percentile": 0.03204,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": "CWE-367",
      "title": "rbd: eliminate a race in lock_dwork draining on unmap",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-64112"
    },
    {
      "rank": 410,
      "cve_id": "CVE-2026-53402",
      "cvss_base": 7.1,
      "cvss_severity": "HIGH",
      "epss_score": 0.00135,
      "epss_percentile": 0.03208,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": "CWE-125",
      "title": "fbdev: fbcon: fix out-of-bounds read in err_out of fbcon_do_set_font()",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-53402"
    },
    {
      "rank": 411,
      "cve_id": "CVE-2026-63817",
      "cvss_base": 7.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00134,
      "epss_percentile": 0.03103,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "f2fs: validate compress cache inode only when enabled",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-63817"
    },
    {
      "rank": 412,
      "cve_id": "CVE-2026-53388",
      "cvss_base": 7.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00133,
      "epss_percentile": 0.03019,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": "CWE-416",
      "title": "fuse: re-lock request before replacing page cache folio",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-53388"
    },
    {
      "rank": 413,
      "cve_id": "CVE-2026-63803",
      "cvss_base": 7.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00133,
      "epss_percentile": 0.03019,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": "CWE-416",
      "title": "hdlc_ppp: sync per-proto timers before freeing hdlc state",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-63803"
    },
    {
      "rank": 414,
      "cve_id": "CVE-2026-63802",
      "cvss_base": 7.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00132,
      "epss_percentile": 0.0298,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": "CWE-416",
      "title": "blk-cgroup: fix UAF in __blkcg_rstat_flush()",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-63802"
    },
    {
      "rank": 415,
      "cve_id": "CVE-2026-53382",
      "cvss_base": 5.5,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00132,
      "epss_percentile": 0.03007,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": "CWE-476",
      "title": "media: vidtv: fix NULL pointer dereference in vidtv_mux_push_si",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-53382"
    },
    {
      "rank": 416,
      "cve_id": "CVE-2026-53385",
      "cvss_base": 5.5,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00132,
      "epss_percentile": 0.03007,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": "CWE-476",
      "title": "vc_screen: fix null-ptr-deref in vcs_notifier() during concurrent vcs_write",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-53385"
    },
    {
      "rank": 417,
      "cve_id": "CVE-2026-63828",
      "cvss_base": 8.4,
      "cvss_severity": "HIGH",
      "epss_score": 0.00131,
      "epss_percentile": 0.02908,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "apparmor: mediate the implicit connect of TCP fast open sendmsg",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-63828"
    },
    {
      "rank": 418,
      "cve_id": "CVE-2026-63824",
      "cvss_base": 7.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.0013,
      "epss_percentile": 0.02849,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "KEYS: fix overflow in keyctl_pkey_params_get_2()",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-63824"
    },
    {
      "rank": 419,
      "cve_id": "CVE-2026-53403",
      "cvss_base": 5.5,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.0013,
      "epss_percentile": 0.02831,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": "CWE-476",
      "title": "fbdev: Fix fb_new_modelist to prevent null-ptr-deref in fb_videomode_to_var",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-53403"
    },
    {
      "rank": 420,
      "cve_id": "CVE-2026-53393",
      "cvss_base": 5.5,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00129,
      "epss_percentile": 0.02812,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "nfsd: reset write verifier on deferred writeback errors",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-53393"
    },
    {
      "rank": 421,
      "cve_id": "CVE-2026-64090",
      "cvss_base": 5.5,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00128,
      "epss_percentile": 0.02675,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "batman-adv: tt: avoid empty VLAN responses",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-64090"
    },
    {
      "rank": 422,
      "cve_id": "CVE-2026-64092",
      "cvss_base": 5.5,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00128,
      "epss_percentile": 0.02676,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "batman-adv: tp_meter: fix tp_vars reference leak in receiver shutdown",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-64092"
    },
    {
      "rank": 423,
      "cve_id": "CVE-2026-63811",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.00128,
      "epss_percentile": 0.02659,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "f2fs: read COW data with the original inode during atomic write",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-63811"
    },
    {
      "rank": 424,
      "cve_id": "CVE-2026-53374",
      "cvss_base": 8.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00127,
      "epss_percentile": 0.02584,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "drm/amdgpu: zero-initialize GART table on allocation",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-53374"
    },
    {
      "rank": 425,
      "cve_id": "CVE-2026-53375",
      "cvss_base": 8.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00127,
      "epss_percentile": 0.02584,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "drm/amdgpu/vce: Prevent partial address patches",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-53375"
    },
    {
      "rank": 426,
      "cve_id": "CVE-2026-63829",
      "cvss_base": 8.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00127,
      "epss_percentile": 0.02621,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-63829"
    },
    {
      "rank": 427,
      "cve_id": "CVE-2026-63814",
      "cvss_base": 7.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00127,
      "epss_percentile": 0.02585,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "f2fs: validate ACL entry sizes in f2fs_acl_from_disk()",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-63814"
    },
    {
      "rank": 428,
      "cve_id": "CVE-2026-64145",
      "cvss_base": 7.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00127,
      "epss_percentile": 0.02599,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": "CWE-787",
      "title": "wifi: wilc1000: fix dma_buffer leak on bus acquire failure",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-64145"
    },
    {
      "rank": 429,
      "cve_id": "CVE-2026-64147",
      "cvss_base": 5.5,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00127,
      "epss_percentile": 0.02622,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": "CWE-401",
      "title": "pds_core: fix debugfs_lookup dentry leak and error handling",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-64147"
    },
    {
      "rank": 430,
      "cve_id": "CVE-2026-63816",
      "cvss_base": 7.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00126,
      "epss_percentile": 0.0255,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "f2fs: atomic: fix UAF issue on f2fs_inode_info.atomic_inode",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-63816"
    },
    {
      "rank": 431,
      "cve_id": "CVE-2026-64103",
      "cvss_base": 7.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00126,
      "epss_percentile": 0.02478,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": "CWE-416",
      "title": "scsi: isci: Fix use-after-free in device removal path",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-64103"
    },
    {
      "rank": 432,
      "cve_id": "CVE-2026-64121",
      "cvss_base": 7.1,
      "cvss_severity": "HIGH",
      "epss_score": 0.00126,
      "epss_percentile": 0.02488,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": "CWE-125",
      "title": "net: ifb: report ethtool stats over num_tx_queues",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-64121"
    },
    {
      "rank": 433,
      "cve_id": "CVE-2026-63798",
      "cvss_base": 5.5,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00126,
      "epss_percentile": 0.02531,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": "CWE-401",
      "title": "irqchip/imgpdc: Fix resource leak, add missing chained handler cleanup on remove",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-63798"
    },
    {
      "rank": 434,
      "cve_id": "CVE-2026-64101",
      "cvss_base": 5.5,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00126,
      "epss_percentile": 0.02527,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "fwctl: pds: Validate RPC input size before parsing",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-64101"
    },
    {
      "rank": 435,
      "cve_id": "CVE-2026-64017",
      "cvss_base": 7.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00125,
      "epss_percentile": 0.02435,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "blk-mq: pop cached request if it is usable",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-64017"
    },
    {
      "rank": 436,
      "cve_id": "CVE-2026-63833",
      "cvss_base": 7.1,
      "cvss_severity": "HIGH",
      "epss_score": 0.00125,
      "epss_percentile": 0.02418,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "ntfs3: reject direct userspace writes to reserved $LX* xattrs",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-63833"
    },
    {
      "rank": 437,
      "cve_id": "CVE-2026-63823",
      "cvss_base": 7.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00124,
      "epss_percentile": 0.02358,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "keys: Pin request_key_auth payload in instantiate paths",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-63823"
    },
    {
      "rank": 438,
      "cve_id": "CVE-2026-63827",
      "cvss_base": 7.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00124,
      "epss_percentile": 0.02358,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "apparmor: fix use-after-free in rawdata dedup loop",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-63827"
    },
    {
      "rank": 439,
      "cve_id": "CVE-2026-53370",
      "cvss_base": 5.5,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00124,
      "epss_percentile": 0.02352,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "perf/x86/intel: Improve validation and configuration of ACR masks",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-53370"
    },
    {
      "rank": 440,
      "cve_id": "CVE-2026-53377",
      "cvss_base": 5.5,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00123,
      "epss_percentile": 0.02325,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "drm/msm: always recover the gpu",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-53377"
    },
    {
      "rank": 441,
      "cve_id": "CVE-2026-64129",
      "cvss_base": 5.5,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00123,
      "epss_percentile": 0.02281,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": "CWE-401",
      "title": "mm/migrate_device: fix spinlock leak in migrate_vma_insert_huge_pmd_page",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-64129"
    },
    {
      "rank": 442,
      "cve_id": "CVE-2026-64135",
      "cvss_base": 5.5,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00123,
      "epss_percentile": 0.02245,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": "CWE-674",
      "title": "hwmon: (pmbus/adm1266) widen blackbox-info buffer to I2C_SMBUS_BLOCK_MAX",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-64135"
    },
    {
      "rank": 443,
      "cve_id": "CVE-2026-64155",
      "cvss_base": 5.5,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00123,
      "epss_percentile": 0.02307,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": "CWE-401",
      "title": "wifi: ath11k: fix error path leaks in some WMI WOW calls",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-64155"
    },
    {
      "rank": 444,
      "cve_id": "CVE-2026-64131",
      "cvss_base": 5.5,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00122,
      "epss_percentile": 0.02224,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "mm/memory: fix spurious warning when unmapping device-private/exclusive pages",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-64131"
    },
    {
      "rank": 445,
      "cve_id": "CVE-2026-64119",
      "cvss_base": 5.5,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00121,
      "epss_percentile": 0.0213,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "l2tp: use list_del_rcu in l2tp_session_unhash",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-64119"
    },
    {
      "rank": 446,
      "cve_id": "CVE-2026-64161",
      "cvss_base": 5.5,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00121,
      "epss_percentile": 0.02128,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": "CWE-401",
      "title": "net: ti: icssm-prueth: fix eth_ports_node leak in probe",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-64161"
    },
    {
      "rank": 447,
      "cve_id": "CVE-2026-53376",
      "cvss_base": 5.5,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.0012,
      "epss_percentile": 0.02017,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "drm/amdkfd: Add upper bound check for num_of_nodes",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-53376"
    },
    {
      "rank": 448,
      "cve_id": "CVE-2026-53379",
      "cvss_base": 5.5,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.0012,
      "epss_percentile": 0.02063,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": "CWE-908",
      "title": "media: i2c: ov8856: free control handler on error in ov8856_init_controls()",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-53379"
    },
    {
      "rank": 449,
      "cve_id": "CVE-2026-64166",
      "cvss_base": 5.5,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.0012,
      "epss_percentile": 0.0199,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": "CWE-476",
      "title": "firmware: arm_ffa: Check for NULL FF-A ID table while driver registration",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-64166"
    },
    {
      "rank": 450,
      "cve_id": "CVE-2026-64174",
      "cvss_base": 5.5,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.0012,
      "epss_percentile": 0.0199,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "wifi: cfg80211: advance loop vars in cfg80211_merge_profile()",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-64174"
    },
    {
      "rank": 451,
      "cve_id": "CVE-2026-64165",
      "cvss_base": 5.5,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00119,
      "epss_percentile": 0.01984,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": "CWE-476",
      "title": "ARM: integrator: Fix early initialization",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-64165"
    },
    {
      "rank": 452,
      "cve_id": "CVE-2026-64154",
      "cvss_base": 5.5,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00117,
      "epss_percentile": 0.01861,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "drm/msm/adreno: Fix a reference leak in a6xx_gpu_init()",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-64154"
    },
    {
      "rank": 453,
      "cve_id": "CVE-2026-64185",
      "cvss_base": 5.5,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00117,
      "epss_percentile": 0.01805,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "sysfs: don't remove existing directory on update failure",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-64185"
    },
    {
      "rank": 454,
      "cve_id": "CVE-2026-64186",
      "cvss_base": 7.1,
      "cvss_severity": "HIGH",
      "epss_score": 0.00116,
      "epss_percentile": 0.01758,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": "CWE-125",
      "title": "iommu/amd: Remove latent out-of-bounds access in IOMMU debugfs",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-64186"
    },
    {
      "rank": 455,
      "cve_id": "CVE-2026-64168",
      "cvss_base": 5.5,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00115,
      "epss_percentile": 0.01681,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": "CWE-476",
      "title": "spi: sprd: fix error pointer deref after DMA setup failure",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-64168"
    },
    {
      "rank": 456,
      "cve_id": "CVE-2026-64164",
      "cvss_base": 5.5,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00114,
      "epss_percentile": 0.01656,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": "CWE-476",
      "title": "btrfs: tracepoints: fix sleep while in atomic context in btrfs_sync_file()",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-64164"
    },
    {
      "rank": 457,
      "cve_id": "CVE-2026-64169",
      "cvss_base": 5.5,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00114,
      "epss_percentile": 0.01608,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": "CWE-476",
      "title": "spi: ep93xx: fix error pointer deref after DMA setup failure",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-64169"
    },
    {
      "rank": 458,
      "cve_id": "CVE-2026-64173",
      "cvss_base": 5.5,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00114,
      "epss_percentile": 0.01652,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "tracing: Do not call map->ops->elt_free() if elt_alloc() fails",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-64173"
    },
    {
      "rank": 459,
      "cve_id": "CVE-2026-64143",
      "cvss_base": 5.5,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00112,
      "epss_percentile": 0.01511,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "platform/x86: uniwill-laptop: Do not enable the charging limit even when forced",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-64143"
    },
    {
      "rank": 460,
      "cve_id": "CVE-2026-16213",
      "cvss_base": 4.8,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00109,
      "epss_percentile": 0.01352,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Fantomas42",
      "product": "django-blog-zinnia",
      "cwe": "CWE-310",
      "title": "Fantomas42 django-blog-zinnia Protected Entry Password entry_protection.py cleartext storage",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-16213"
    },
    {
      "rank": 461,
      "cve_id": "CVE-2026-53400",
      "cvss_base": 7.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00103,
      "epss_percentile": 0.01062,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": "CWE-362",
      "title": "i2c: core: fix adapter registration race",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-53400"
    },
    {
      "rank": 462,
      "cve_id": "CVE-2026-64167",
      "cvss_base": 5.5,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.001,
      "epss_percentile": 0.00951,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": "CWE-476",
      "title": "kho: skip KHO for crash kernel",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-64167"
    },
    {
      "rank": 463,
      "cve_id": "CVE-2026-64100",
      "cvss_base": 5.5,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00097,
      "epss_percentile": 0.00826,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": "CWE-667",
      "title": "drm/msm: Fix shrinker deadlock",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-64100"
    },
    {
      "rank": 464,
      "cve_id": "CVE-2026-64171",
      "cvss_base": 5.5,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.0008,
      "epss_percentile": 0.00199,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": "CWE-667",
      "title": "i2c: tegra: fix pm_runtime leak on mutex_lock failure",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-64171"
    }
  ],
  "transactions": [
    {
      "type": "EXPLOIT_PUBLISHED",
      "cve_id": "CVE-2026-16199",
      "detail": "EXPLOIT PUBLISHED — CVE-2026-16199 (nextlevelbuilder GoClaw). Public exploit reference added."
    },
    {
      "type": "EXPLOIT_PUBLISHED",
      "cve_id": "CVE-2026-16200",
      "detail": "EXPLOIT PUBLISHED — CVE-2026-16200 (zevorn rt-claw). Public exploit reference added."
    },
    {
      "type": "EXPLOIT_PUBLISHED",
      "cve_id": "CVE-2026-16201",
      "detail": "EXPLOIT PUBLISHED — CVE-2026-16201 (zevorn rt-claw). Public exploit reference added."
    },
    {
      "type": "EXPLOIT_PUBLISHED",
      "cve_id": "CVE-2026-16202",
      "detail": "EXPLOIT PUBLISHED — CVE-2026-16202 (SourceCodester Class and Exam Timetabling System). Public exploit reference added."
    },
    {
      "type": "EXPLOIT_PUBLISHED",
      "cve_id": "CVE-2026-16203",
      "detail": "EXPLOIT PUBLISHED — CVE-2026-16203 (SourceCodester Class and Exam Timetabling System). Public exploit reference added."
    },
    {
      "type": "EXPLOIT_PUBLISHED",
      "cve_id": "CVE-2026-16204",
      "detail": "EXPLOIT PUBLISHED — CVE-2026-16204 (zevorn rt-claw). Public exploit reference added."
    },
    {
      "type": "EXPLOIT_PUBLISHED",
      "cve_id": "CVE-2026-16205",
      "detail": "EXPLOIT PUBLISHED — CVE-2026-16205 (Pluck CMS). Public exploit reference added."
    },
    {
      "type": "EXPLOIT_PUBLISHED",
      "cve_id": "CVE-2026-16209",
      "detail": "EXPLOIT PUBLISHED — CVE-2026-16209 (Gerapy). Public exploit reference added."
    },
    {
      "type": "EXPLOIT_PUBLISHED",
      "cve_id": "CVE-2026-16210",
      "detail": "EXPLOIT PUBLISHED — CVE-2026-16210 (newpanjing simpleui). Public exploit reference added."
    },
    {
      "type": "EXPLOIT_PUBLISHED",
      "cve_id": "CVE-2026-16211",
      "detail": "EXPLOIT PUBLISHED — CVE-2026-16211 (allegro). Public exploit reference added."
    },
    {
      "type": "EXPLOIT_PUBLISHED",
      "cve_id": "CVE-2026-16212",
      "detail": "EXPLOIT PUBLISHED — CVE-2026-16212 (awesto django-shop). Public exploit reference added."
    },
    {
      "type": "EXPLOIT_PUBLISHED",
      "cve_id": "CVE-2026-16214",
      "detail": "EXPLOIT PUBLISHED — CVE-2026-16214 (geex-arts django-jet). Public exploit reference added."
    },
    {
      "type": "EXPLOIT_PUBLISHED",
      "cve_id": "CVE-2026-16215",
      "detail": "EXPLOIT PUBLISHED — CVE-2026-16215 (geex-arts django-jet). Public exploit reference added."
    },
    {
      "type": "EXPLOIT_PUBLISHED",
      "cve_id": "CVE-2026-16216",
      "detail": "EXPLOIT PUBLISHED — CVE-2026-16216 (geex-arts django-jet). Public exploit reference added."
    },
    {
      "type": "EXPLOIT_PUBLISHED",
      "cve_id": "CVE-2026-16217",
      "detail": "EXPLOIT PUBLISHED — CVE-2026-16217 (guohongze adminset). Public exploit reference added."
    },
    {
      "type": "EXPLOIT_PUBLISHED",
      "cve_id": "CVE-2026-16219",
      "detail": "EXPLOIT PUBLISHED — CVE-2026-16219 (Croogo CMS). Public exploit reference added."
    },
    {
      "type": "EXPLOIT_PUBLISHED",
      "cve_id": "CVE-2026-16220",
      "detail": "EXPLOIT PUBLISHED — CVE-2026-16220 (code-projects Online Examination System). Public exploit reference added."
    },
    {
      "type": "EXPLOIT_PUBLISHED",
      "cve_id": "CVE-2026-16222",
      "detail": "EXPLOIT PUBLISHED — CVE-2026-16222 (1Panel-dev CordysCRM). Public exploit reference added."
    },
    {
      "type": "EXPLOIT_PUBLISHED",
      "cve_id": "CVE-2026-16223",
      "detail": "EXPLOIT PUBLISHED — CVE-2026-16223 (1Panel-dev CordysCRM). Public exploit reference added."
    },
    {
      "type": "EXPLOIT_PUBLISHED",
      "cve_id": "CVE-2026-16225",
      "detail": "EXPLOIT PUBLISHED — CVE-2026-16225 (davenardella snap7). Public exploit reference added."
    },
    {
      "type": "EXPLOIT_PUBLISHED",
      "cve_id": "CVE-2026-16227",
      "detail": "EXPLOIT PUBLISHED — CVE-2026-16227 (SourceCodester Class and Exam Timetabling System). Public exploit reference added."
    },
    {
      "type": "EXPLOIT_PUBLISHED",
      "cve_id": "CVE-2026-16228",
      "detail": "EXPLOIT PUBLISHED — CVE-2026-16228 (SourceCodester Class and Exam Timetabling System). Public exploit reference added."
    },
    {
      "type": "EXPLOIT_PUBLISHED",
      "cve_id": "CVE-2026-16229",
      "detail": "EXPLOIT PUBLISHED — CVE-2026-16229 (itsourcecode Courier Management System). Public exploit reference added."
    },
    {
      "type": "DUE_DATE_PASSED",
      "cve_id": "CVE-2026-46817",
      "detail": "DUE DATE PASSED — CVE-2026-46817 (Oracle Corporation Oracle Payments). CISA remediation deadline was July 18, 2026; still in catalog."
    }
  ],
  "attribution": "CVE Program, NVD (NIST), CISA KEV, FIRST EPSS, OSV. See /security/methodology/."
}