Kythos AI vulnerability intelligence
Zero-Day Exploits / Vulnerabilities
A server-rendered, source-attributed view of confirmed CISA KEV entries and all NVD CVEs published in the rolling 48-hour UTC window.
Important distinction: CISA KEV means exploitation has been observed; it does not mean every entry was a zero-day. An NVD publication in the past 48 hours does not mean exploitation has occurred. Source records describe third-party products and do not identify Kythos AI customers, contracts, affiliations, or work history.
Confirmed exploitation intelligence
Zero-Day Exploits / Vulnerabilities
Complete CISA Known Exploited Vulnerabilities catalog, ordered by the date CISA added each entry. Every result is known to be exploited; entries are not necessarily zero-days.
Entries 433–456 of 1,769
CVE-2025-30397: Microsoft Windows Scripting Engine Type Confusion Vulnerability
Microsoft · Windows
Microsoft Windows Scripting Engine contains a type confusion vulnerability that allows an unauthorized attacker to execute code over a network via a specially crafted URL.
Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
CVE-2025-47729: TeleMessage TM SGNL Hidden Functionality Vulnerability
TeleMessage · TM SGNL
TeleMessage TM SGNL contains a hidden functionality vulnerability in which the archiving backend holds cleartext copies of messages from TM SGNL application users.
Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
CVE-2024-6047: GeoVision Devices OS Command Injection Vulnerability
GeoVision · Multiple Devices
Multiple GeoVision devices contain an OS command injection vulnerability that allows a remote, unauthenticated attacker to inject and execute arbitrary system commands. The impacted products could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization.
Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
CVE-2024-11120: GeoVision Devices OS Command Injection Vulnerability
GeoVision · Multiple Devices
Multiple GeoVision devices contain an OS command injection vulnerability that allows a remote, unauthenticated attacker to inject and execute arbitrary system commands. The impacted products could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization.
Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
CVE-2025-27363: FreeType Out-of-Bounds Write Vulnerability
FreeType · FreeType
FreeType contains an out-of-bounds write vulnerability when attempting to parse font subglyph structures related to TrueType GX and variable font files that may allow for arbitrary code execution.
Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
CVE-2025-3248: Langflow Missing Authentication Vulnerability
Langflow · Langflow
Langflow contains a missing authentication vulnerability in the /api/v1/validate/code endpoint that allows a remote, unauthenticated attacker to execute arbitrary code via crafted HTTP requests.
Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
CVE-2025-34028: Commvault Command Center Path Traversal Vulnerability
Commvault · Command Center
Commvault Command Center contains a path traversal vulnerability that allows a remote, unauthenticated attacker to execute arbitrary code.
Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
CVE-2024-58136: Yiiframework Yii Improper Protection of Alternate Path Vulnerability
Yiiframework · Yii
Yii Framework contains an improper protection of alternate path vulnerability that may allow a remote attacker to execute arbitrary code. This vulnerability could affect other products that implement Yii, including—but not limited to—Craft CMS, as represented by CVE-2025-32432.
Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
CVE-2024-38475: Apache HTTP Server Improper Escaping of Output Vulnerability
Apache · HTTP Server
Apache HTTP Server contains an improper escaping of output vulnerability in mod_rewrite that allows an attacker to map URLs to filesystem locations that are permitted to be served by the server but are not intentionally/directly reachable by any URL, resulting in code…
Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
CVE-2023-44221: SonicWall SMA100 Appliances OS Command Injection Vulnerability
SonicWall · SMA100 Appliances
SonicWall SMA100 appliances contain an OS command injection vulnerability in the SSL-VPN management interface that allows a remote, authenticated attacker with administrative privilege to inject arbitrary commands as a 'nobody' user.
Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
CVE-2025-31324: SAP NetWeaver Unrestricted File Upload Vulnerability
SAP · NetWeaver
SAP NetWeaver Visual Composer Metadata Uploader contains an unrestricted file upload vulnerability that allows an unauthenticated agent to upload potentially malicious executable binaries.
Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
CVE-2025-42599: Qualitia Active! Mail Stack-Based Buffer Overflow Vulnerability
Qualitia · Active! Mail
Qualitia Active! Mail contains a stack-based buffer overflow vulnerability that allows a remote, unauthenticated attacker to execute arbitrary or trigger a denial-of-service via a specially crafted request.
Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
CVE-2025-3928: Commvault Web Server Unspecified Vulnerability
Commvault · Web Server
Commvault Web Server contains an unspecified vulnerability that allows a remote, authenticated attacker to create and execute webshells.
Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
CVE-2025-1976: Broadcom Brocade Fabric OS Code Injection Vulnerability
Broadcom · Brocade Fabric OS
Broadcom Brocade Fabric OS contains a code injection vulnerability that allows a local user with administrative privileges to execute arbitrary code with full root privileges.
Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
CVE-2025-31201: Apple Multiple Products Arbitrary Read and Write Vulnerability
Apple · Multiple Products
Apple iOS, iPadOS, macOS, and other Apple products contain an arbitrary read and write vulnerability that allows an attacker to bypass Pointer Authentication.
Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
CVE-2025-31200: Apple Multiple Products Memory Corruption Vulnerability
Apple · Multiple Products
Apple iOS, iPadOS, macOS, and other Apple products contain a memory corruption vulnerability that allows for code execution when processing an audio stream in a maliciously crafted media file.
Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
CVE-2025-24054: Microsoft Windows NTLM Hash Disclosure Spoofing Vulnerability
Microsoft · Windows
Microsoft Windows NTLM contains an external control of file name or path vulnerability that allows an unauthorized attacker to perform spoofing over a network.
Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
CVE-2021-20035: SonicWall SMA100 Appliances OS Command Injection Vulnerability
SonicWall · SMA100 Appliances
SonicWall SMA100 appliances contain an OS command injection vulnerability in the management interface that allows a remote authenticated attacker to inject arbitrary commands as a 'nobody' user, which could potentially lead to code execution.
Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
CVE-2024-53197: Linux Kernel Out-of-Bounds Access Vulnerability
Linux · Kernel
Linux Kernel contains an out-of-bounds access vulnerability in the USB-audio driver that allows an attacker with physical access to the system to use a malicious USB device to potentially manipulate system memory, escalate privileges, or execute arbitrary code.
Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
CVE-2024-53150: Linux Kernel Out-of-Bounds Read Vulnerability
Linux · Kernel
Linux Kernel contains an out-of-bounds read vulnerability in the USB-audio driver that allows a local, privileged attacker to obtain potentially sensitive information.
Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
CVE-2025-30406: Gladinet CentreStack and Triofox Use of Hard-coded Cryptographic Key Vulnerability
Gladinet · CentreStack
Gladinet CentreStack and Triofox contains a use of hard-coded cryptographic key vulnerability in the way that the application manages keys used for ViewState integrity verification. Successful exploitation allows an attacker to forge ViewState payloads for server-side deserialization, allowing for remote code execution.
Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
CVE-2025-29824: Microsoft Windows Common Log File System (CLFS) Driver Use-After-Free Vulnerability
Microsoft · Windows
Microsoft Windows Common Log File System (CLFS) Driver contains a use-after-free vulnerability that allows an authorized attacker to elevate privileges locally.
Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
CVE-2025-31161: CrushFTP Authentication Bypass Vulnerability
CrushFTP · CrushFTP
CrushFTP contains an authentication bypass vulnerability in the HTTP authorization header that allows a remote unauthenticated attacker to authenticate to any known or guessable user account (e.g., crushadmin), potentially leading to a full compromise.
Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
CVE-2025-22457: Ivanti Connect Secure, Policy Secure, and ZTA Gateways Stack-Based Buffer Overflow Vulnerability
Ivanti · Connect Secure, Policy Secure, and ZTA Gateways
Ivanti Connect Secure, Policy Secure, and ZTA Gateways contains a stack-based buffer overflow vulnerability that allows a remote unauthenticated attacker to achieve remote code execution.
Required action: Apply mitigations as set forth in the CISA instructions linked below.
Complete fixed-window snapshot
CVEs — Past 48 Hours
All unique CVEs returned by NVD for the displayed UTC publication window. The snapshot is accepted only when its normalized unique-item count exactly equals the API totalResults value.
Entries 529–552 of 1,041
CVE-2026-17211
IBM API Connect [network address omitted] through [network address omitted] and [network address omitted] through [network address omitted] could allow a remote authenticated attacker to cause a denial of service due to incorrect type conversion. A value is converted incorrectly between two different types, which could…
CVE-2026-17202
IBM API Connect [network address omitted] through [network address omitted] could allow a remote attacker to enumerate usernames due to observable differences in response behavior.
CVE-2026-17190
IBM API Connect [network address omitted] through [network address omitted] and [network address omitted] through [network address omitted] could allow a remote authenticated attacker to execute arbitrary JavaScript due to cross-site scripting. HTML content supplied by a provider is not sufficiently sanitized before it is displayed,…
CVE-2026-17188
IBM API Connect [network address omitted] through [network address omitted] could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery. When service definitions are imported, references to external resources are not sufficiently restricted, so the server could be made to request…
CVE-2026-17187
IBM API Connect [network address omitted] through [network address omitted] could allow a remote authenticated attacker to obtain sensitive information due to improper validation of user-supplied URLs.
CVE-2026-17172
IBM API Connect [network address omitted] through [network address omitted] and [network address omitted] through [network address omitted] could allow a remote authenticated attacker to bypass security restrictions due to improper authentication. Information supplied by the client is not sufficiently verified, which could allow a caller…
CVE-2026-17167
IBM API Connect [network address omitted] through [network address omitted] could allow a remote authenticated attacker to falsify audit log information due to reliance on untrusted inputs. Information supplied by the client is relied on when recording the source of a request, so audit records could…
CVE-2026-17158
IBM API Connect [network address omitted] through [network address omitted] and [network address omitted] through [network address omitted] could allow a remote authenticated attacker to gain elevated privileges due to improper authentication.
CVE-2026-17155
IBM API Connect [network address omitted] through [network address omitted] could allow a remote authenticated attacker to execute arbitrary scripts due to improper neutralization of user-controlled input.
CVE-2026-17154
IBM API Connect [network address omitted] through [network address omitted] could allow a remote authenticated attacker to perform cross-site scripting due to improper neutralization of user-supplied input.
CVE-2026-17150
IBM API Connect [network address omitted] through [network address omitted] and [network address omitted] through [network address omitted] could allow a remote authenticated attacker to execute arbitrary code and access sensitive information from other tenants due to insufficient input validation. Uploaded custom module content is not…
CVE-2026-17147
IBM API Connect [network address omitted] through [network address omitted] and [network address omitted] through [network address omitted] could allow a remote authenticated attacker to execute arbitrary code and perform unauthorized administrative actions due to a path traversal vulnerability.
CVE-2026-17146
IBM API Connect [network address omitted] through [network address omitted] and [network address omitted] through [network address omitted] could allow a remote authenticated attacker to execute arbitrary JavaScript and obtain sensitive information due to improper input validation.
CVE-2026-17144
IBM API Connect [network address omitted] through [network address omitted] and [network address omitted] through [network address omitted] could allow a remote authenticated attacker to obtain sensitive information due to improper input validation.
CVE-2026-17143
IBM API Connect [network address omitted] through [network address omitted] and [network address omitted] through [network address omitted] could allow a remote authenticated attacker to perform HTML injection due to improper neutralization of user-supplied input.
CVE-2026-17140
IBM API Connect [network address omitted] through [network address omitted] and [network address omitted] through [network address omitted] could allow a remote authenticated attacker to execute arbitrary code due to improper control of generation of code. Input supplied by a user can influence code generated by…
CVE-2026-17139
IBM API Connect [network address omitted] through [network address omitted] and [network address omitted] through [network address omitted] could allow a remote authenticated attacker to execute arbitrary scripts due to cross-site scripting. Certain URL fields are not sufficiently validated, so malicious script content could run in…
CVE-2026-17137
IBM API Connect [network address omitted] through [network address omitted] could allow a local attacker to obtain sensitive information due to improper use of cryptography. The encryption applied to stored data is not implemented with sufficient strength, which weakens its protection.
CVE-2026-17134
IBM API Connect [network address omitted] through [network address omitted] could allow a remote authenticated attacker to execute arbitrary SQL commands due to SQL injection.
CVE-2026-17132
IBM API Connect [network address omitted] through [network address omitted] could allow a remote authenticated attacker to execute arbitrary SQL commands due to improper neutralization of special elements used in an SQL command.
CVE-2026-17131
IBM API Connect [network address omitted] through [network address omitted] could allow a remote attacker to obtain sensitive information due to server-side request forgery. Restrictions on outbound requests can be bypassed, so the server could be made to contact unintended destinations and return the response.
CVE-2026-17129
IBM API Connect [network address omitted] through [network address omitted] could allow a remote authenticated attacker to obtain sensitive information and cause a denial of service due to an insecure direct object reference.
CVE-2026-17128
IBM API Connect [network address omitted] through [network address omitted] could allow a remote authenticated attacker to obtain sensitive information due to the insertion of sensitive information into log files.
CVE-2026-17117
IBM API Connect [network address omitted] through [network address omitted] and [network address omitted] through [network address omitted] could allow a remote authenticated attacker to execute arbitrary code due to improperly controlled modification of object attributes. A user could set a field that should only be…