Kythos AI vulnerability intelligence

Zero-Day Exploits / Vulnerabilities

A server-rendered, source-attributed view of confirmed CISA KEV entries and all NVD CVEs published in the rolling 48-hour UTC window.

Important distinction: CISA KEV means exploitation has been observed; it does not mean every entry was a zero-day. An NVD publication in the past 48 hours does not mean exploitation has occurred. Source records describe third-party products and do not identify Kythos AI customers, contracts, affiliations, or work history.

CISA KEV catalog NVD 48-hour CVEs Kythos AI RSS feed

Confirmed exploitation intelligence

Zero-Day Exploits / Vulnerabilities

Complete CISA Known Exploited Vulnerabilities catalog, ordered by the date CISA added each entry. Every result is known to be exploited; entries are not necessarily zero-days.

Current snapshot

Entries 337–360 of 1,769

CISA KEVAdded Oct 6, 2025

CVE-2021-43226: Microsoft Windows Privilege Escalation Vulnerability

Microsoft · Windows

Microsoft Windows Common Log File System Driver contains a privilege escalation vulnerability that could allow a local, privileged attacker to bypass certain security mechanisms.

Federal remediation due Oct 27, 2025Ransomware use: Known

Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

View in the CISA KEV catalog →

CISA KEVAdded Oct 6, 2025

CVE-2021-22555: Linux Kernel Heap Out-of-Bounds Write Vulnerability

Linux · Kernel

Linux Kernel contains a heap out-of-bounds write vulnerability that could allow an attacker to gain privileges or cause a DoS (via heap memory corruption) through user name space.

Federal remediation due Oct 27, 2025Ransomware use: Not confirmed by CISA

Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

View in the CISA KEV catalog →

CISA KEVAdded Oct 6, 2025

CVE-2013-3918: Microsoft Windows Out-of-Bounds Write Vulnerability

Microsoft · Windows

Microsoft Windows contains an out-of-bounds write vulnerability in the InformationCardSigninHelper Class ActiveX control, icardie.dll. An attacker could exploit the vulnerability by constructing a specially crafted webpage. When a user views the webpage, the vulnerability could allow remote code execution. An attacker who…

Federal remediation due Oct 27, 2025Ransomware use: Not confirmed by CISA

Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

View in the CISA KEV catalog →

CISA KEVAdded Oct 6, 2025

CVE-2011-3402: Microsoft Windows Remote Code Execution Vulnerability

Microsoft · Windows

Microsoft Windows Kernel contains an unspecified vulnerability in the TrueType font parsing engine in win32k.sys in the kernel-mode drivers that allows remote attackers to execute arbitrary code via crafted font data in a Word document or web page.

Federal remediation due Oct 27, 2025Ransomware use: Not confirmed by CISA

Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

View in the CISA KEV catalog →

CISA KEVAdded Oct 6, 2025

CVE-2010-3962: Microsoft Internet Explorer Uninitialized Memory Corruption Vulnerability

Microsoft · Internet Explorer

Microsoft Internet Explorer contains an uninitialized memory corruption vulnerability that could allow for remote code execution. The impacted product could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization.

Federal remediation due Oct 27, 2025Ransomware use: Not confirmed by CISA

Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

View in the CISA KEV catalog →

CISA KEVAdded Oct 6, 2025

CVE-2010-3765: Mozilla Multiple Products Remote Code Execution Vulnerability

Mozilla · Multiple Products

Mozilla Firefox, SeaMonkey, and Thunderbird contain an unspecified vulnerability when JavaScript is enabled. This allows remote attackers to execute arbitrary code via vectors related to nsCSSFrameConstructor[network address omitted]ontentAppended, the appendChild method, incorrect index tracking, and the creation of multiple frames, which triggers…

Federal remediation due Oct 27, 2025Ransomware use: Not confirmed by CISA

Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

View in the CISA KEV catalog →

CISA KEVAdded Oct 2, 2025

CVE-2025-4008: Smartbedded Meteobridge Command Injection Vulnerability

Smartbedded · Meteobridge

Smartbedded Meteobridge contains a command injection vulnerability that could allow remote unauthenticated attackers to gain arbitrary command execution with elevated privileges (root) on affected devices.

Federal remediation due Oct 23, 2025Ransomware use: Not confirmed by CISA

Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

View in the CISA KEV catalog →

CISA KEVAdded Oct 2, 2025

CVE-2025-21043: Samsung Mobile Devices Out-of-Bounds Write Vulnerability

Samsung · Mobile Devices

Samsung mobile devices contain an out-of-bounds write vulnerability in libimagecodec.quram.so which allows remote attackers to execute arbitrary code.

Federal remediation due Oct 23, 2025Ransomware use: Not confirmed by CISA

Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

View in the CISA KEV catalog →

CISA KEVAdded Oct 2, 2025

CVE-2017-1000353: Jenkins Remote Code Execution Vulnerability

Jenkins · Jenkins

Jenkins contains a remote code execution vulnerability. This vulnerability that could allowed attackers to transfer a serialized Java SignedObject object to the remoting-based Jenkins CLI, that would be deserialized using a new ObjectInputStream, bypassing the existing blocklist-based protection mechanism.

Federal remediation due Oct 23, 2025Ransomware use: Not confirmed by CISA

Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

View in the CISA KEV catalog →

CISA KEVAdded Oct 2, 2025

CVE-2015-7755: Juniper ScreenOS Improper Authentication Vulnerability

Juniper · ScreenOS

Juniper ScreenOS contains an improper authentication vulnerability that could allow unauthorized remote administrative access to the device.

Federal remediation due Oct 23, 2025Ransomware use: Not confirmed by CISA

Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

View in the CISA KEV catalog →

CISA KEVAdded Oct 2, 2025

CVE-2014-6278: GNU Bash OS Command Injection Vulnerability

GNU · GNU Bash

GNU Bash contains an OS command injection vulnerability which allows remote attackers to execute arbitrary commands via a crafted environment.

Federal remediation due Oct 23, 2025Ransomware use: Not confirmed by CISA

Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

View in the CISA KEV catalog →

CISA KEVAdded Sep 29, 2025

CVE-2025-59689: Libraesva Email Security Gateway Command Injection Vulnerability

Libraesva · Email Security Gateway

Libraesva Email Security Gateway (ESG) contains a command injection vulnerability which allows command injection via a compressed e-mail attachment.

Federal remediation due Oct 20, 2025Ransomware use: Not confirmed by CISA

Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

View in the CISA KEV catalog →

CISA KEVAdded Sep 29, 2025

CVE-2025-32463: Sudo Inclusion of Functionality from Untrusted Control Sphere Vulnerability

Sudo · Sudo

Sudo contains an inclusion of functionality from untrusted control sphere vulnerability. This vulnerability could allow local attacker to leverage sudo’s -R (–chroot) option to run arbitrary commands as root, even if they are not listed in the sudoers file.

Federal remediation due Oct 20, 2025Ransomware use: Not confirmed by CISA

Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

View in the CISA KEV catalog →

CISA KEVAdded Sep 29, 2025

CVE-2025-20352: Cisco IOS and IOS XE Software SNMP Denial of Service and Remote Code Execution Vulnerability

Cisco · IOS and IOS XE

Cisco IOS and IOS XE contains a stack-based buffer overflow vulnerability in the Simple Network Management Protocol (SNMP) subsystem that could allow for denial of service or remote code execution. A successful exploit could allow a low-privileged attacker to cause the affected…

Federal remediation due Oct 20, 2025Ransomware use: Not confirmed by CISA

Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

View in the CISA KEV catalog →

CISA KEVAdded Sep 29, 2025

CVE-2025-10035: Fortra GoAnywhere MFT Deserialization of Untrusted Data Vulnerability

Fortra · GoAnywhere MFT

Fortra GoAnywhere MFT contains a deserialization of untrusted data vulnerability allows an actor with a validly forged license response signature to deserialize an arbitrary actor-controlled object, possibly leading to command injection.

Federal remediation due Oct 20, 2025Ransomware use: Known

Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

View in the CISA KEV catalog →

CISA KEVAdded Sep 29, 2025

CVE-2021-21311: Adminer Server-Side Request Forgery Vulnerability

Adminer · Adminer

Adminer contains a server-side request forgery vulnerability that, when exploited, allows a remote attacker to obtain potentially sensitive information.

Federal remediation due Oct 20, 2025Ransomware use: Not confirmed by CISA

Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

View in the CISA KEV catalog →

CISA KEVAdded Sep 25, 2025

CVE-2025-20362: Cisco Secure Firewall Adaptive Security (ASA) Appliance and Secure Firewall Threat Defense (FTD) Missing Authorization Vulnerability

Cisco · Secure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense

Cisco Secure Firewall Adaptive Security (ASA) Appliance and Secure Firewall Threat Defense (FTD) Software VPN Web Server contain a missing authorization vulnerability. This vulnerability could be chained with CVE-2025-20333.

Federal remediation due Sep 26, 2025Ransomware use: Not confirmed by CISA

Required action: The KEV due date refers to the deadline by which FCEB agencies are expected to review and begin implementing the guidance outlined in Emergency Directive (ED) 25-03 (URL listed below in Notes). Agencies must follow…

View in the CISA KEV catalog →

CISA KEVAdded Sep 25, 2025

CVE-2025-20333: Cisco Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) Buffer Overflow Vulnerability

Cisco · Secure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense

Cisco Secure Firewall Adaptive Security (ASA) Appliance and Secure Firewall Threat Defense (FTD) Software VPN Web Server contain a buffer overflow vulnerability that allows for remote code execution. This vulnerability could be chained with CVE-2025-20362.

Federal remediation due Sep 26, 2025Ransomware use: Not confirmed by CISA

View in the CISA KEV catalog →

CISA KEVAdded Sep 23, 2025

CVE-2025-10585: Google Chromium V8 Type Confusion Vulnerability

Google · Chromium V8

Google Chromium contains a type confusion vulnerability in the V8 JavaScript and WebAssembly engine.

Federal remediation due Oct 14, 2025Ransomware use: Not confirmed by CISA

Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

View in the CISA KEV catalog →

CISA KEVAdded Sep 11, 2025

CVE-2025-5086: Dassault Systèmes DELMIA Apriso Deserialization of Untrusted Data Vulnerability

Dassault Systèmes · DELMIA Apriso

Dassault Systèmes DELMIA Apriso contains a deserialization of untrusted data vulnerability that could lead to a remote code execution.

Federal remediation due Oct 2, 2025Ransomware use: Not confirmed by CISA

Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

View in the CISA KEV catalog →

CISA KEVAdded Sep 4, 2025

CVE-2025-53690: Sitecore Multiple Products Deserialization of Untrusted Data Vulnerability

Sitecore · Multiple Products

Sitecore Experience Manager (XM), Experience Platform (XP), Experience Commerce (XC), and Managed Cloud contain a deserialization of untrusted data vulnerability involving the use of default machine keys. This flaw allows attackers to exploit exposed ASP.NET machine keys to achieve remote code execution.

Federal remediation due Sep 25, 2025Ransomware use: Not confirmed by CISA

Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

View in the CISA KEV catalog →

CISA KEVAdded Sep 4, 2025

CVE-2025-48543: Android Runtime Use-After-Free Vulnerability

Android · Runtime

Android Runtime contains a use-after-free vulnerability potentially allowing a chrome sandbox escape leading to local privilege escalation.

Federal remediation due Sep 25, 2025Ransomware use: Not confirmed by CISA

Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

View in the CISA KEV catalog →

CISA KEVAdded Sep 4, 2025

CVE-2025-38352: Linux Kernel Time-of-Check Time-of-Use (TOCTOU) Race Condition Vulnerability

Linux · Kernel

Linux kernel contains a time-of-check time-of-use (TOCTOU) race condition vulnerability that has a high impact on confidentiality, integrity, and availability.

Federal remediation due Sep 25, 2025Ransomware use: Not confirmed by CISA

Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

View in the CISA KEV catalog →

CISA KEVAdded Sep 3, 2025

CVE-2025-9377: TP-Link Archer C7(EU) and TL-WR841N/ND(MS) OS Command Injection Vulnerability

TP-Link · Multiple Routers

TP-Link Archer C7(EU) and TL-WR841N/ND(MS) contain an OS command injection vulnerability that exists in the Parental Control page. The impacted products could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization.

Federal remediation due Sep 24, 2025Ransomware use: Not confirmed by CISA

Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

View in the CISA KEV catalog →

Source: Official CISA KEV JSONCatalog released Nov 6, 2026, 7:44 PM GMT+0000Site snapshot: Nov 8, 2026, 5:49 AM GMT+0000Showing 24 of 1,769Source text normalized: network addresses and restricted context omittedRefresh interval: 30 minutes

Complete fixed-window snapshot

CVEs — Past 48 Hours

All unique CVEs returned by NVD for the displayed UTC publication window. The snapshot is accepted only when its normalized unique-item count exactly equals the API totalResults value.

Current snapshot

Entries 25–48 of 1,057