Kythos AI vulnerability intelligence
Zero-Day Exploits / Vulnerabilities
A server-rendered, source-attributed view of confirmed CISA KEV entries and all NVD CVEs published in the rolling 48-hour UTC window.
Important distinction: CISA KEV means exploitation has been observed; it does not mean every entry was a zero-day. An NVD publication in the past 48 hours does not mean exploitation has occurred. Source records describe third-party products and do not identify Kythos AI customers, contracts, affiliations, or work history.
Confirmed exploitation intelligence
Zero-Day Exploits / Vulnerabilities
Complete CISA Known Exploited Vulnerabilities catalog, ordered by the date CISA added each entry. Every result is known to be exploited; entries are not necessarily zero-days.
Entries 433–456 of 1,769
CVE-2025-30397: Microsoft Windows Scripting Engine Type Confusion Vulnerability
Microsoft · Windows
Microsoft Windows Scripting Engine contains a type confusion vulnerability that allows an unauthorized attacker to execute code over a network via a specially crafted URL.
Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
CVE-2025-47729: TeleMessage TM SGNL Hidden Functionality Vulnerability
TeleMessage · TM SGNL
TeleMessage TM SGNL contains a hidden functionality vulnerability in which the archiving backend holds cleartext copies of messages from TM SGNL application users.
Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
CVE-2024-6047: GeoVision Devices OS Command Injection Vulnerability
GeoVision · Multiple Devices
Multiple GeoVision devices contain an OS command injection vulnerability that allows a remote, unauthenticated attacker to inject and execute arbitrary system commands. The impacted products could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization.
Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
CVE-2024-11120: GeoVision Devices OS Command Injection Vulnerability
GeoVision · Multiple Devices
Multiple GeoVision devices contain an OS command injection vulnerability that allows a remote, unauthenticated attacker to inject and execute arbitrary system commands. The impacted products could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization.
Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
CVE-2025-27363: FreeType Out-of-Bounds Write Vulnerability
FreeType · FreeType
FreeType contains an out-of-bounds write vulnerability when attempting to parse font subglyph structures related to TrueType GX and variable font files that may allow for arbitrary code execution.
Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
CVE-2025-3248: Langflow Missing Authentication Vulnerability
Langflow · Langflow
Langflow contains a missing authentication vulnerability in the /api/v1/validate/code endpoint that allows a remote, unauthenticated attacker to execute arbitrary code via crafted HTTP requests.
Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
CVE-2025-34028: Commvault Command Center Path Traversal Vulnerability
Commvault · Command Center
Commvault Command Center contains a path traversal vulnerability that allows a remote, unauthenticated attacker to execute arbitrary code.
Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
CVE-2024-58136: Yiiframework Yii Improper Protection of Alternate Path Vulnerability
Yiiframework · Yii
Yii Framework contains an improper protection of alternate path vulnerability that may allow a remote attacker to execute arbitrary code. This vulnerability could affect other products that implement Yii, including—but not limited to—Craft CMS, as represented by CVE-2025-32432.
Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
CVE-2024-38475: Apache HTTP Server Improper Escaping of Output Vulnerability
Apache · HTTP Server
Apache HTTP Server contains an improper escaping of output vulnerability in mod_rewrite that allows an attacker to map URLs to filesystem locations that are permitted to be served by the server but are not intentionally/directly reachable by any URL, resulting in code…
Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
CVE-2023-44221: SonicWall SMA100 Appliances OS Command Injection Vulnerability
SonicWall · SMA100 Appliances
SonicWall SMA100 appliances contain an OS command injection vulnerability in the SSL-VPN management interface that allows a remote, authenticated attacker with administrative privilege to inject arbitrary commands as a 'nobody' user.
Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
CVE-2025-31324: SAP NetWeaver Unrestricted File Upload Vulnerability
SAP · NetWeaver
SAP NetWeaver Visual Composer Metadata Uploader contains an unrestricted file upload vulnerability that allows an unauthenticated agent to upload potentially malicious executable binaries.
Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
CVE-2025-42599: Qualitia Active! Mail Stack-Based Buffer Overflow Vulnerability
Qualitia · Active! Mail
Qualitia Active! Mail contains a stack-based buffer overflow vulnerability that allows a remote, unauthenticated attacker to execute arbitrary or trigger a denial-of-service via a specially crafted request.
Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
CVE-2025-3928: Commvault Web Server Unspecified Vulnerability
Commvault · Web Server
Commvault Web Server contains an unspecified vulnerability that allows a remote, authenticated attacker to create and execute webshells.
Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
CVE-2025-1976: Broadcom Brocade Fabric OS Code Injection Vulnerability
Broadcom · Brocade Fabric OS
Broadcom Brocade Fabric OS contains a code injection vulnerability that allows a local user with administrative privileges to execute arbitrary code with full root privileges.
Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
CVE-2025-31201: Apple Multiple Products Arbitrary Read and Write Vulnerability
Apple · Multiple Products
Apple iOS, iPadOS, macOS, and other Apple products contain an arbitrary read and write vulnerability that allows an attacker to bypass Pointer Authentication.
Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
CVE-2025-31200: Apple Multiple Products Memory Corruption Vulnerability
Apple · Multiple Products
Apple iOS, iPadOS, macOS, and other Apple products contain a memory corruption vulnerability that allows for code execution when processing an audio stream in a maliciously crafted media file.
Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
CVE-2025-24054: Microsoft Windows NTLM Hash Disclosure Spoofing Vulnerability
Microsoft · Windows
Microsoft Windows NTLM contains an external control of file name or path vulnerability that allows an unauthorized attacker to perform spoofing over a network.
Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
CVE-2021-20035: SonicWall SMA100 Appliances OS Command Injection Vulnerability
SonicWall · SMA100 Appliances
SonicWall SMA100 appliances contain an OS command injection vulnerability in the management interface that allows a remote authenticated attacker to inject arbitrary commands as a 'nobody' user, which could potentially lead to code execution.
Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
CVE-2024-53197: Linux Kernel Out-of-Bounds Access Vulnerability
Linux · Kernel
Linux Kernel contains an out-of-bounds access vulnerability in the USB-audio driver that allows an attacker with physical access to the system to use a malicious USB device to potentially manipulate system memory, escalate privileges, or execute arbitrary code.
Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
CVE-2024-53150: Linux Kernel Out-of-Bounds Read Vulnerability
Linux · Kernel
Linux Kernel contains an out-of-bounds read vulnerability in the USB-audio driver that allows a local, privileged attacker to obtain potentially sensitive information.
Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
CVE-2025-30406: Gladinet CentreStack and Triofox Use of Hard-coded Cryptographic Key Vulnerability
Gladinet · CentreStack
Gladinet CentreStack and Triofox contains a use of hard-coded cryptographic key vulnerability in the way that the application manages keys used for ViewState integrity verification. Successful exploitation allows an attacker to forge ViewState payloads for server-side deserialization, allowing for remote code execution.
Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
CVE-2025-29824: Microsoft Windows Common Log File System (CLFS) Driver Use-After-Free Vulnerability
Microsoft · Windows
Microsoft Windows Common Log File System (CLFS) Driver contains a use-after-free vulnerability that allows an authorized attacker to elevate privileges locally.
Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
CVE-2025-31161: CrushFTP Authentication Bypass Vulnerability
CrushFTP · CrushFTP
CrushFTP contains an authentication bypass vulnerability in the HTTP authorization header that allows a remote unauthenticated attacker to authenticate to any known or guessable user account (e.g., crushadmin), potentially leading to a full compromise.
Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
CVE-2025-22457: Ivanti Connect Secure, Policy Secure, and ZTA Gateways Stack-Based Buffer Overflow Vulnerability
Ivanti · Connect Secure, Policy Secure, and ZTA Gateways
Ivanti Connect Secure, Policy Secure, and ZTA Gateways contains a stack-based buffer overflow vulnerability that allows a remote unauthenticated attacker to achieve remote code execution.
Required action: Apply mitigations as set forth in the CISA instructions linked below.
Complete fixed-window snapshot
CVEs — Past 48 Hours
All unique CVEs returned by NVD for the displayed UTC publication window. The snapshot is accepted only when its normalized unique-item count exactly equals the API totalResults value.
Entries 385–408 of 1,041
CVE-2026-18838
IBM API Connect [network address omitted] through [network address omitted] could allow a remote attacker to obtain sensitive information and modify API configurations due to improper authentication. Identity information supplied in requests is not sufficiently verified, which could allow a caller to impersonate another user.
CVE-2026-18836
IBM API Connect [network address omitted] through [network address omitted] and [network address omitted] through [network address omitted] could allow a remote attacker to obtain sensitive information due to server-side request forgery. The affected component can be made to send requests to unintended destinations and return…
CVE-2026-18689
IBM API Connect [network address omitted] through [network address omitted] and [network address omitted] through [network address omitted] could allow an authenticated user to obtain limited information about other organizations due to incorrect authorization. A token issued for a limited purpose is accepted where it should…
CVE-2026-18535
IBM API Connect [network address omitted] through [network address omitted] and [network address omitted] through [network address omitted] are vulnerable to a Regular Expression Denial of Service (ReDoS) attack and to improper neutralisation of wildcard query operators.
CVE-2026-17428
IBM API Connect [network address omitted] through [network address omitted] and [network address omitted] through [network address omitted] could allow a remote authenticated attacker to obtain sensitive information due to improper authorization. Values supplied in the request URL are used in authorization decisions without sufficient verification,…
CVE-2026-17411
IBM API Connect [network address omitted] through [network address omitted] and [network address omitted] through [network address omitted] could allow an authenticated attacker to view, add, modify, or delete information in the back-end database due to SQL injection. Input is not properly neutralized before it is…
CVE-2026-17410
IBM API Connect [network address omitted] through [network address omitted] and [network address omitted] through [network address omitted] could allow a remote authenticated attacker to access and modify other tenants' portal data due to improper neutralization of argument delimiters.
CVE-2026-17409
IBM API Connect [network address omitted] through [network address omitted] and [network address omitted] through [network address omitted] could allow a remote attacker to execute unauthorized administrative operations and obtain sensitive information due to improper handling of case sensitivity. Access controls are not applied consistently to…
CVE-2026-17408
IBM API Connect [network address omitted] through [network address omitted] and [network address omitted] through [network address omitted] could allow a remote attacker to execute arbitrary code due to improper neutralization of special elements in an OS command.
CVE-2026-17407
IBM API Connect [network address omitted] through [network address omitted] and [network address omitted] through [network address omitted] could allow a remote authenticated attacker to execute arbitrary SQL commands due to SQL injection. Values received during sign-in are not properly neutralized before being used in a…
CVE-2026-17406
IBM API Connect [network address omitted] through [network address omitted] and [network address omitted] through [network address omitted] could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery. Address checks can be bypassed, which could allow the server to reach destinations…
CVE-2026-17405
IBM API Connect [network address omitted] through [network address omitted] and [network address omitted] through [network address omitted] could allow a remote authenticated attacker to obtain sensitive information due to broken object-level authorization. Access checks on keystore objects do not confirm that the requesting user is…
CVE-2026-17404
IBM API Connect [network address omitted] through [network address omitted] and [network address omitted] through [network address omitted] could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery.
CVE-2026-17403
IBM API Connect [network address omitted] through [network address omitted] and [network address omitted] through [network address omitted] could allow a remote attacker to gain full administrative control due to the use of hard-coded credentials.
CVE-2026-17402
IBM API Connect [network address omitted] through [network address omitted] and [network address omitted] through [network address omitted] could allow a remote authenticated attacker to execute arbitrary commands due to OS command injection. User-supplied input is not properly neutralized before it is passed to the operating…
CVE-2026-17401
IBM API Connect [network address omitted] through [network address omitted] and [network address omitted] through [network address omitted] could allow a remote authenticated attacker to execute arbitrary code due to a stack-based buffer overflow.
CVE-2026-17400
IBM API Connect [network address omitted] through [network address omitted] and [network address omitted] through [network address omitted] could allow a remote authenticated attacker to obtain sensitive information due to SQL injection.
CVE-2026-17399
IBM API Connect [network address omitted] through [network address omitted] and [network address omitted] through [network address omitted] could allow a remote authenticated attacker to execute arbitrary code due to insufficient validation of uploaded content. Content uploaded to the product is not sufficiently checked before it…
CVE-2026-17398
IBM API Connect [network address omitted] through [network address omitted] and [network address omitted] through [network address omitted] could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery.
CVE-2026-17397
IBM API Connect [network address omitted] through [network address omitted] and [network address omitted] through [network address omitted] could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery.
CVE-2026-17396
IBM API Connect [network address omitted] through [network address omitted] and [network address omitted] through [network address omitted] could allow a remote authenticated attacker to obtain sensitive information due to SQL injection.
CVE-2026-17395
IBM API Connect [network address omitted] through [network address omitted] and [network address omitted] through [network address omitted] could allow a remote authenticated attacker to access internal network resources due to improper validation of a user-supplied URL. Destinations are not sufficiently restricted, which could allow the…
CVE-2026-17394
IBM API Connect [network address omitted] through [network address omitted] and [network address omitted] through [network address omitted] could allow a remote authenticated attacker to obtain sensitive information due to improperly controlled modification of object attributes. A user-supplied value could change an access-related setting that should…
CVE-2026-17393
IBM API Connect [network address omitted] through [network address omitted] could allow a local attacker to obtain sensitive information due to the use of a cryptographically weak pseudo-random number generator.