Kythos AI vulnerability intelligence
Zero-Day Exploits / Vulnerabilities
A server-rendered, source-attributed view of confirmed CISA KEV entries and all NVD CVEs published in the rolling 48-hour UTC window.
Important distinction: CISA KEV means exploitation has been observed; it does not mean every entry was a zero-day. An NVD publication in the past 48 hours does not mean exploitation has occurred. Source records describe third-party products and do not identify Kythos AI customers, contracts, affiliations, or work history.
Confirmed exploitation intelligence
Zero-Day Exploits / Vulnerabilities
Complete CISA Known Exploited Vulnerabilities catalog, ordered by the date CISA added each entry. Every result is known to be exploited; entries are not necessarily zero-days.
Entries 673–696 of 1,769
CVE-2024-3273: D-Link Multiple NAS Devices Command Injection Vulnerability
D-Link · Multiple NAS Devices
D-Link DNS-320L, DNS-325, DNS-327L, and DNS-340L contain a command injection vulnerability. When combined with CVE-2024-3272, this can lead to remote, unauthorized code execution.
Required action: This vulnerability affects legacy D-Link products. All associated hardware revisions have reached their end-of-life (EOL) or end-of-service (EOS) life cycle and should be retired and replaced per vendor instructions.
CVE-2024-3272: D-Link Multiple NAS Devices Use of Hard-Coded Credentials Vulnerability
D-Link · Multiple NAS Devices
D-Link DNS-320L, DNS-325, DNS-327L, and DNS-340L contains a hard-coded credential that allows an attacker to conduct authenticated command injection, leading to remote, unauthorized code execution.
Required action: This vulnerability affects legacy D-Link products. All associated hardware revisions have reached their end-of-life (EOL) or end-of-service (EOS) life cycle and should be retired and replaced per vendor instructions.
CVE-2024-29748: Android Pixel Privilege Escalation Vulnerability
Android · Pixel
Android Pixel contains a privilege escalation vulnerability that allows an attacker to interrupt a factory reset triggered by a device admin app.
Required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
CVE-2024-29745: Android Pixel Information Disclosure Vulnerability
Android · Pixel
Android Pixel contains an information disclosure vulnerability in the fastboot firmware used to support unlocking, flashing, and locking affected devices.
Required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
CVE-2023-24955: Microsoft SharePoint Server Code Injection Vulnerability
Microsoft · SharePoint Server
Microsoft SharePoint Server contains a code injection vulnerability that allows an authenticated attacker with Site Owner privileges to execute code remotely.
Required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
CVE-2023-48788: Fortinet FortiClient EMS SQL Injection Vulnerability
Fortinet · FortiClient EMS
Fortinet FortiClient EMS contains a SQL injection vulnerability that allows an unauthenticated attacker to execute commands as SYSTEM via specifically crafted requests.
Required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
CVE-2021-44529: Ivanti Endpoint Manager Cloud Service Appliance (EPM CSA) Code Injection Vulnerability
Ivanti · Endpoint Manager Cloud Service Appliance (EPM CSA)
Ivanti Endpoint Manager Cloud Service Appliance (EPM CSA) contains a code injection vulnerability that allows an unauthenticated user to execute malicious code with limited permissions (nobody).
Required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
CVE-2019-7256: Nice Linear eMerge E3-Series OS Command Injection Vulnerability
Nice · Linear eMerge E3-Series
Nice Linear eMerge E3-Series contains an OS command injection vulnerability that allows an attacker to conduct remote code execution.
Required action: Contact the vendor for guidance on remediating firmware, per their advisory.
CVE-2024-27198: JetBrains TeamCity Authentication Bypass Vulnerability
JetBrains · TeamCity
JetBrains TeamCity contains an authentication bypass vulnerability that allows an attacker to perform admin actions.
Required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
CVE-2024-23296: Apple Multiple Products Memory Corruption Vulnerability
Apple · Multiple Products
Apple iOS, iPadOS, macOS, tvOS, and watchOS RTKit contain a memory corruption vulnerability that allows an attacker with arbitrary kernel read and write capability to bypass kernel memory protections.
Required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
CVE-2024-23225: Apple Multiple Products Memory Corruption Vulnerability
Apple · Multiple Products
Apple iOS, iPadOS, macOS, tvOS, watchOS, and visionOS kernel contain a memory corruption vulnerability that allows an attacker with arbitrary kernel read and write capability to bypass kernel memory protections.
Required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
CVE-2023-21237: Android Pixel Information Disclosure Vulnerability
Android · Pixel
Android Pixel contains a vulnerability in the Framework component, where the UI may be misleading or insufficient, providing a means to hide a foreground service notification. This could enable a local attacker to disclose sensitive information.
Required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
CVE-2021-36380: Sunhillo SureLine OS Command Injection Vulnerablity
Sunhillo · SureLine
Sunhillo SureLine contains an OS command injection vulnerability that allows an attacker to cause a denial-of-service or utilize the device for persistence on the network via shell metacharacters in ipAddr or dnsAddr in /cgi/networkDiag.cgi.
Required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
CVE-2024-21338: Microsoft Windows Kernel Exposed IOCTL with Insufficient Access Control Vulnerability
Microsoft · Windows
Microsoft Windows Kernel contains an exposed IOCTL with insufficient access control vulnerability within the IOCTL (input and output control) dispatcher in appid.sys that allows a local attacker to achieve privilege escalation.
Required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
CVE-2023-29360: Microsoft Streaming Service Untrusted Pointer Dereference Vulnerability
Microsoft · Streaming Service
Microsoft Streaming Service contains an untrusted pointer dereference vulnerability that allows for privilege escalation, enabling a local attacker to gain SYSTEM privileges.
Required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
CVE-2024-1709: ConnectWise ScreenConnect Authentication Bypass Vulnerability
ConnectWise · ScreenConnect
ConnectWise ScreenConnect contains an authentication bypass vulnerability that allows an attacker with network access to the management interface to create a new, administrator-level account on affected devices.
Required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
CVE-2024-21410: Microsoft Exchange Server Privilege Escalation Vulnerability
Microsoft · Exchange Server
Microsoft Exchange Server contains an unspecified vulnerability that allows for privilege escalation.
Required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
CVE-2020-3259: Cisco ASA and FTD Information Disclosure Vulnerability
Cisco · Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD)
Cisco Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) contain an information disclosure vulnerability. An attacker could retrieve memory contents on an affected device, which could lead to the disclosure of confidential information due to a buffer tracking issue when the…
Required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
CVE-2024-21412: Microsoft Windows Internet Shortcut Files Security Feature Bypass Vulnerability
Microsoft · Windows
Microsoft Windows Internet Shortcut Files contains an unspecified vulnerability that allows for a security feature bypass.
Required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
CVE-2024-21351: Microsoft Windows SmartScreen Security Feature Bypass Vulnerability
Microsoft · Windows
Microsoft Windows SmartScreen contains a security feature bypass vulnerability that allows an attacker to bypass the SmartScreen user experience and inject code to potentially gain code execution, which could lead to some data exposure, lack of system availability, or both.
Required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
CVE-2023-43770: Roundcube Webmail Persistent Cross-Site Scripting (XSS) Vulnerability
Roundcube · Webmail
Roundcube Webmail contains a persistent cross-site scripting (XSS) vulnerability that can lead to information disclosure via malicious link references in plain/text messages.
Required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
CVE-2024-21762: Fortinet FortiOS Out-of-Bound Write Vulnerability
Fortinet · FortiOS
Fortinet FortiOS contains an out-of-bound write vulnerability that allows a remote unauthenticated attacker to execute code or commands via specially crafted HTTP requests.
Required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
CVE-2023-4762: Google Chromium V8 Type Confusion Vulnerability
Google · Chromium V8
Google Chromium V8 contains a type confusion vulnerability that allows a remote attacker to execute code via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.
Required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
CVE-2024-21893: Ivanti Connect Secure, Policy Secure, and Neurons Server-Side Request Forgery (SSRF) Vulnerability
Ivanti · Connect Secure, Policy Secure, and Neurons
Ivanti Connect Secure (ICS, formerly known as Pulse Connect Secure), Ivanti Policy Secure, and Ivanti Neurons contain a server-side request forgery (SSRF) vulnerability in the SAML component that allows an attacker to access certain restricted resources without authentication.
Required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Complete fixed-window snapshot
CVEs — Past 48 Hours
All unique CVEs returned by NVD for the displayed UTC publication window. The snapshot is accepted only when its normalized unique-item count exactly equals the API totalResults value.
Entries 529–552 of 1,013
CVE-2026-17211
IBM API Connect [network address omitted] through [network address omitted] and [network address omitted] through [network address omitted] could allow a remote authenticated attacker to cause a denial of service due to incorrect type conversion. A value is converted incorrectly between two different types, which could…
CVE-2026-17202
IBM API Connect [network address omitted] through [network address omitted] could allow a remote attacker to enumerate usernames due to observable differences in response behavior.
CVE-2026-17190
IBM API Connect [network address omitted] through [network address omitted] and [network address omitted] through [network address omitted] could allow a remote authenticated attacker to execute arbitrary JavaScript due to cross-site scripting. HTML content supplied by a provider is not sufficiently sanitized before it is displayed,…
CVE-2026-17188
IBM API Connect [network address omitted] through [network address omitted] could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery. When service definitions are imported, references to external resources are not sufficiently restricted, so the server could be made to request…
CVE-2026-17187
IBM API Connect [network address omitted] through [network address omitted] could allow a remote authenticated attacker to obtain sensitive information due to improper validation of user-supplied URLs.
CVE-2026-17172
IBM API Connect [network address omitted] through [network address omitted] and [network address omitted] through [network address omitted] could allow a remote authenticated attacker to bypass security restrictions due to improper authentication. Information supplied by the client is not sufficiently verified, which could allow a caller…
CVE-2026-17167
IBM API Connect [network address omitted] through [network address omitted] could allow a remote authenticated attacker to falsify audit log information due to reliance on untrusted inputs. Information supplied by the client is relied on when recording the source of a request, so audit records could…
CVE-2026-17158
IBM API Connect [network address omitted] through [network address omitted] and [network address omitted] through [network address omitted] could allow a remote authenticated attacker to gain elevated privileges due to improper authentication.
CVE-2026-17155
IBM API Connect [network address omitted] through [network address omitted] could allow a remote authenticated attacker to execute arbitrary scripts due to improper neutralization of user-controlled input.
CVE-2026-17154
IBM API Connect [network address omitted] through [network address omitted] could allow a remote authenticated attacker to perform cross-site scripting due to improper neutralization of user-supplied input.
CVE-2026-17150
IBM API Connect [network address omitted] through [network address omitted] and [network address omitted] through [network address omitted] could allow a remote authenticated attacker to execute arbitrary code and access sensitive information from other tenants due to insufficient input validation. Uploaded custom module content is not…
CVE-2026-17147
IBM API Connect [network address omitted] through [network address omitted] and [network address omitted] through [network address omitted] could allow a remote authenticated attacker to execute arbitrary code and perform unauthorized administrative actions due to a path traversal vulnerability.
CVE-2026-17146
IBM API Connect [network address omitted] through [network address omitted] and [network address omitted] through [network address omitted] could allow a remote authenticated attacker to execute arbitrary JavaScript and obtain sensitive information due to improper input validation.
CVE-2026-17144
IBM API Connect [network address omitted] through [network address omitted] and [network address omitted] through [network address omitted] could allow a remote authenticated attacker to obtain sensitive information due to improper input validation.
CVE-2026-17143
IBM API Connect [network address omitted] through [network address omitted] and [network address omitted] through [network address omitted] could allow a remote authenticated attacker to perform HTML injection due to improper neutralization of user-supplied input.
CVE-2026-17140
IBM API Connect [network address omitted] through [network address omitted] and [network address omitted] through [network address omitted] could allow a remote authenticated attacker to execute arbitrary code due to improper control of generation of code. Input supplied by a user can influence code generated by…
CVE-2026-17139
IBM API Connect [network address omitted] through [network address omitted] and [network address omitted] through [network address omitted] could allow a remote authenticated attacker to execute arbitrary scripts due to cross-site scripting. Certain URL fields are not sufficiently validated, so malicious script content could run in…
CVE-2026-17137
IBM API Connect [network address omitted] through [network address omitted] could allow a local attacker to obtain sensitive information due to improper use of cryptography. The encryption applied to stored data is not implemented with sufficient strength, which weakens its protection.
CVE-2026-17134
IBM API Connect [network address omitted] through [network address omitted] could allow a remote authenticated attacker to execute arbitrary SQL commands due to SQL injection.
CVE-2026-17132
IBM API Connect [network address omitted] through [network address omitted] could allow a remote authenticated attacker to execute arbitrary SQL commands due to improper neutralization of special elements used in an SQL command.
CVE-2026-17131
IBM API Connect [network address omitted] through [network address omitted] could allow a remote attacker to obtain sensitive information due to server-side request forgery. Restrictions on outbound requests can be bypassed, so the server could be made to contact unintended destinations and return the response.
CVE-2026-17129
IBM API Connect [network address omitted] through [network address omitted] could allow a remote authenticated attacker to obtain sensitive information and cause a denial of service due to an insecure direct object reference.
CVE-2026-17128
IBM API Connect [network address omitted] through [network address omitted] could allow a remote authenticated attacker to obtain sensitive information due to the insertion of sensitive information into log files.
CVE-2026-17117
IBM API Connect [network address omitted] through [network address omitted] and [network address omitted] through [network address omitted] could allow a remote authenticated attacker to execute arbitrary code due to improperly controlled modification of object attributes. A user could set a field that should only be…