Kythos AI vulnerability intelligence
Zero-Day Exploits / Vulnerabilities
A server-rendered, source-attributed view of confirmed CISA KEV entries and all NVD CVEs published in the rolling 48-hour UTC window.
Important distinction: CISA KEV means exploitation has been observed; it does not mean every entry was a zero-day. An NVD publication in the past 48 hours does not mean exploitation has occurred. Source records describe third-party products and do not identify Kythos AI customers, contracts, affiliations, or work history.
Confirmed exploitation intelligence
Zero-Day Exploits / Vulnerabilities
Complete CISA Known Exploited Vulnerabilities catalog, ordered by the date CISA added each entry. Every result is known to be exploited; entries are not necessarily zero-days.
Entries 457–480 of 1,769
CVE-2025-24813: Apache Tomcat Path Equivalence Vulnerability
Apache · Tomcat
Apache Tomcat contains a path equivalence vulnerability that allows a remote attacker to execute code, disclose information, or inject malicious content via a partial PUT request. This vulnerability can be chained with CVE‑2026‑34486.
Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
CVE-2024-20439: Cisco Smart Licensing Utility Static Credential Vulnerability
Cisco · Smart Licensing Utility
Cisco Smart Licensing Utility contains a static credential vulnerability that allows an unauthenticated, remote attacker to log in to an affected system and gain administrative credentials.
Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
CVE-2025-2783: Google Chromium Mojo Sandbox Escape Vulnerability
Google · Chromium Mojo
Google Chromium Mojo on Windows contains a sandbox escape vulnerability caused by a logic error, which results from an incorrect handle being provided in unspecified circumstances. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google…
Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
CVE-2019-9875: Sitecore CMS and Experience Platform (XP) Deserialization Vulnerability
Sitecore · CMS and Experience Platform (XP)
Sitecore CMS and Experience Platform (XP) contain a deserialization vulnerability in the Sitecore.Security.AntiCSRF module that allows an authenticated attacker to execute arbitrary code by sending a serialized .NET object in the HTTP POST parameter __CSRFTOKEN.
Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
CVE-2019-9874: Sitecore CMS and Experience Platform (XP) Deserialization Vulnerability
Sitecore · CMS and Experience Platform (XP)
Sitecore CMS and Experience Platform (XP) contain a deserialization vulnerability in the Sitecore.Security.AntiCSRF module that allows an unauthenticated attacker to execute arbitrary code by sending a serialized .NET object in the HTTP POST parameter __CSRFTOKEN.
Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
CVE-2025-30154: reviewdog/action-setup GitHub Action Embedded Malicious Code Vulnerability
reviewdog · action-setup GitHub Action
reviewdog action-setup GitHub Action contains an embedded malicious code vulnerability that dumps exposed secrets to Github Actions Workflow Logs.
Required action: Apply mitigations as set forth in the CISA instructions linked below. Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
CVE-2025-1316: Edimax IC-7100 IP Camera OS Command Injection Vulnerability
Edimax · IC-7100 IP Camera
Edimax IC-7100 IP camera contains an OS command injection vulnerability due to improper input sanitization that allows an attacker to achieve remote code execution via specially crafted requests. The impacted product could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product…
Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
CVE-2024-48248: NAKIVO Backup and Replication Absolute Path Traversal Vulnerability
NAKIVO · Backup and Replication
NAKIVO Backup and Replication contains an absolute path traversal vulnerability that enables an attacker to read arbitrary files.
Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
CVE-2017-12637: SAP NetWeaver Directory Traversal Vulnerability
SAP · NetWeaver
SAP NetWeaver Application Server (AS) Java contains a directory traversal vulnerability in scheduler/ui/js/ffffffffbca41eb4/UIUtilJavaScriptJS that allows a remote attacker to read arbitrary files via a .. (dot dot) in the query string.
Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
CVE-2025-30066: tj-actions/changed-files GitHub Action Embedded Malicious Code Vulnerability
tj-actions · changed-files GitHub Action
tj-actions/changed-files GitHub Action contains an embedded malicious code vulnerability that allows a remote attacker to discover secrets by reading Github Actions Workflow Logs. These secrets may include, but are not limited to, valid AWS access keys, GitHub personal access tokens (PATs), npm…
Required action: Apply mitigations as set forth in the CISA instructions linked below. Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
CVE-2025-24472: Fortinet FortiOS and FortiProxy Authentication Bypass Vulnerability
Fortinet · FortiOS and FortiProxy
Fortinet FortiOS and FortiProxy contain an authentication bypass vulnerability that allows a remote attacker to gain super-admin privileges via crafted CSF proxy requests.
Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
CVE-2025-24201: Apple Multiple Products WebKit Out-of-Bounds Write Vulnerability
Apple · Multiple Products
Apple iOS, iPadOS, macOS, and other Apple products contain an out-of-bounds write vulnerability in WebKit that may allow maliciously crafted web content to break out of Web Content sandbox. This vulnerability could impact HTML parsers that use WebKit, including but not limited…
Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
CVE-2025-21590: Juniper Junos OS Improper Isolation or Compartmentalization Vulnerability
Juniper · Junos OS
Juniper Junos OS contains an improper isolation or compartmentalization vulnerability. This vulnerability could allows a local attacker with high privileges to inject arbitrary code.
Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
CVE-2025-26633: Microsoft Windows Management Console (MMC) Improper Neutralization Vulnerability
Microsoft · Windows
Microsoft Windows Management Console (MMC) contains an improper neutralization vulnerability that allows an unauthorized attacker to bypass a security feature locally.
Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
CVE-2025-24993: Microsoft Windows NTFS Heap-Based Buffer Overflow Vulnerability
Microsoft · Windows
Microsoft Windows New Technology File System (NTFS) contains a heap-based buffer overflow vulnerability that allows an unauthorized attacker to execute code locally.
Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
CVE-2025-24991: Microsoft Windows NTFS Out-Of-Bounds Read Vulnerability
Microsoft · Windows
Microsoft Windows New Technology File System (NTFS) contains an out-of-bounds read vulnerability that allows an authorized attacker to disclose information locally.
Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
CVE-2025-24985: Microsoft Windows Fast FAT File System Driver Integer Overflow Vulnerability
Microsoft · Windows
Microsoft Windows Fast FAT File System Driver contains an integer overflow or wraparound vulnerability that allows an unauthorized attacker to execute code locally.
Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
CVE-2025-24984: Microsoft Windows NTFS Information Disclosure Vulnerability
Microsoft · Windows
Microsoft Windows New Technology File System (NTFS) contains an insertion of sensitive Information into log file vulnerability that allows an unauthorized attacker to disclose information with a physical attack. An attacker who successfully exploited this vulnerability could potentially read portions of heap…
Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
CVE-2025-24983: Microsoft Windows Win32k Use-After-Free Vulnerability
Microsoft · Windows
Microsoft Windows Win32 Kernel Subsystem contains a use-after-free vulnerability that allows an authorized attacker to elevate privileges locally.
Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
CVE-2025-25181: Advantive VeraCore SQL Injection Vulnerability
Advantive · VeraCore
Advantive VeraCore contains a SQL injection vulnerability in timeoutWarning.asp that allows a remote attacker to execute arbitrary SQL commands via the PmSess1 parameter.
Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
CVE-2024-57968: Advantive VeraCore Unrestricted File Upload Vulnerability
Advantive · VeraCore
Advantive VeraCore contains an unrestricted file upload vulnerability that allows a remote unauthenticated attacker to upload files to unintended folders via upload.apsx.
Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
CVE-2024-13161: Ivanti Endpoint Manager (EPM) Absolute Path Traversal Vulnerability
Ivanti · Endpoint Manager (EPM)
Ivanti Endpoint Manager (EPM) contains an absolute path traversal vulnerability that allows a remote unauthenticated attacker to leak sensitive information.
Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
CVE-2024-13160: Ivanti Endpoint Manager (EPM) Absolute Path Traversal Vulnerability
Ivanti · Endpoint Manager (EPM)
Ivanti Endpoint Manager (EPM) contains an absolute path traversal vulnerability that allows a remote unauthenticated attacker to leak sensitive information.
Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
CVE-2024-13159: Ivanti Endpoint Manager (EPM) Absolute Path Traversal Vulnerability
Ivanti · Endpoint Manager (EPM)
Ivanti Endpoint Manager (EPM) contains an absolute path traversal vulnerability that allows a remote unauthenticated attacker to leak sensitive information.
Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Complete fixed-window snapshot
CVEs — Past 48 Hours
All unique CVEs returned by NVD for the displayed UTC publication window. The snapshot is accepted only when its normalized unique-item count exactly equals the API totalResults value.
Entries 433–456 of 1,041
CVE-2026-17368
IBM API Connect [network address omitted] through [network address omitted] and [network address omitted] through [network address omitted] could allow a remote authenticated attacker to perform network reconnaissance and obtain sensitive credentials due to server-side request forgery. The server can be made to send requests to…
CVE-2026-17367
IBM API Connect [network address omitted] through [network address omitted] and [network address omitted] through [network address omitted] could allow a remote authenticated attacker to obtain sensitive information due to insufficiently protected credentials.
CVE-2026-17366
IBM API Connect [network address omitted] through [network address omitted] and [network address omitted] through [network address omitted] could allow a remote authenticated attacker to obtain sensitive information due to broken object-level authorization.
CVE-2026-17365
IBM API Connect [network address omitted] through [network address omitted] and [network address omitted] through [network address omitted] could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery.
CVE-2026-17363
IBM API Connect [network address omitted] through [network address omitted] and [network address omitted] through [network address omitted] could allow a remote authenticated attacker to obtain sensitive information due to SQL injection.
CVE-2026-17361
IBM API Connect [network address omitted] through [network address omitted] could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery.
CVE-2026-17360
IBM API Connect [network address omitted] through [network address omitted] could allow a remote attacker to gain full administrative control due to the use of hard-coded credentials.
CVE-2026-17359
IBM API Connect [network address omitted] through [network address omitted] and [network address omitted] through [network address omitted] could allow a remote authenticated attacker to execute arbitrary code due to improper control of generation of code. A user-supplied value can influence code that the product generates,…
CVE-2026-17358
IBM API Connect [network address omitted] through [network address omitted] and [network address omitted] through [network address omitted] could allow a remote authenticated attacker to bypass authentication across tenants due to improper authentication. Authentication checks are not sufficiently isolated between tenants, which could allow a user…
CVE-2026-17357
IBM API Connect [network address omitted] through [network address omitted] and [network address omitted] through [network address omitted] could allow a remote authenticated attacker to access internal network services due to server-side request forgery.
CVE-2026-17356
IBM API Connect [network address omitted] through [network address omitted] could allow a local attacker to obtain sensitive information due to the use of a hard-coded cryptographic key.
CVE-2026-17355
IBM API Connect [network address omitted] through [network address omitted] could allow a remote authenticated attacker to obtain sensitive information from internal network resources due to server-side request forgery. Destination checks on outbound requests can be bypassed, which could allow the server to reach internal systems…
CVE-2026-17354
IBM API Connect [network address omitted] through [network address omitted] could allow a remote authenticated attacker to perform arbitrary file writes due to path traversal.
CVE-2026-17353
IBM API Connect [network address omitted] through [network address omitted] could allow a remote authenticated attacker to obtain sensitive information and bypass security restrictions due to server-side request forgery.
CVE-2026-17352
IBM API Connect [network address omitted] through [network address omitted] could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery.
CVE-2026-17345
IBM API Connect [network address omitted] through [network address omitted] and [network address omitted] through [network address omitted] could allow a remote authenticated attacker to obtain sensitive information due to improper neutralization of special elements used in an SQL command.
CVE-2026-17344
IBM API Connect [network address omitted] through [network address omitted] could allow a remote attacker to obtain sensitive information due to server-side request forgery. A service that can be reached without authentication could be made to send requests to unintended destinations.
CVE-2026-17343
IBM API Connect [network address omitted] through [network address omitted] could allow a remote authenticated attacker to bypass authorization checks to access or modify sensitive information due to improper authorization.
CVE-2026-17342
IBM API Connect [network address omitted] through [network address omitted] and [network address omitted] through [network address omitted] could allow a remote authenticated attacker to execute arbitrary code due to improper control of generation of code.
CVE-2026-17341
IBM API Connect [network address omitted] through [network address omitted] could allow a remote attacker to perform server-side request forgery and relay unauthorized email messages due to improper neutralization of user-supplied input.
CVE-2026-17340
IBM API Connect [network address omitted] through [network address omitted] could allow a remote attacker to execute arbitrary code due to a path traversal vulnerability.
CVE-2026-17339
IBM API Connect [network address omitted] through [network address omitted] could allow a remote authenticated attacker to access or delete resources belonging to other tenants due to path traversal.
CVE-2026-17338
IBM API Connect [network address omitted] through [network address omitted] could allow a remote authenticated attacker to obtain sensitive information due to broken object-level authorization.
CVE-2026-17337
IBM API Connect [network address omitted] through [network address omitted] could allow a remote authenticated attacker to bypass authentication due to improper certificate validation. A certificate check is not performed reliably in all cases, which could allow a connection to be accepted without proper authentication.