Kythos AI vulnerability intelligence
Zero-Day Exploits / Vulnerabilities
A server-rendered, source-attributed view of confirmed CISA KEV entries and all NVD CVEs published in the rolling 48-hour UTC window.
Important distinction: CISA KEV means exploitation has been observed; it does not mean every entry was a zero-day. An NVD publication in the past 48 hours does not mean exploitation has occurred. Source records describe third-party products and do not identify Kythos AI customers, contracts, affiliations, or work history.
Confirmed exploitation intelligence
Zero-Day Exploits / Vulnerabilities
Complete CISA Known Exploited Vulnerabilities catalog, ordered by the date CISA added each entry. Every result is known to be exploited; entries are not necessarily zero-days.
Entries 745–768 of 1,769
CVE-2023-46604: Apache ActiveMQ Deserialization of Untrusted Data Vulnerability
Apache · ActiveMQ
Apache ActiveMQ contains a deserialization of untrusted data vulnerability that may allow a remote attacker with network access to a broker to run shell commands by manipulating serialized class types in the OpenWire protocol to cause the broker to instantiate any class…
Required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
CVE-2023-46748: F5 BIG-IP Configuration Utility SQL Injection Vulnerability
F5 · BIG-IP Configuration Utility
F5 BIG-IP Configuration utility contains an SQL injection vulnerability that may allow an authenticated attacker with network access through the BIG-IP management port and/or self IP addresses to execute system commands. This vulnerability can be used in conjunction with CVE-2023-46747.
Required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
CVE-2023-46747: F5 BIG-IP Configuration Utility Authentication Bypass Vulnerability
F5 · BIG-IP Configuration Utility
F5 BIG-IP Configuration utility contains an authentication bypass using an alternate path or channel vulnerability due to undisclosed requests that may allow an unauthenticated attacker with network access to the BIG-IP system through the management port and/or self IP addresses to execute…
Required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
CVE-2023-5631: Roundcube Webmail Persistent Cross-Site Scripting (XSS) Vulnerability
Roundcube · Webmail
Roundcube Webmail contains a persistent cross-site scripting (XSS) vulnerability that allows a remote attacker to run malicious JavaScript code.
Required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
CVE-2023-20273: Cisco IOS XE Web UI Command Injection Vulnerability
Cisco · Cisco IOS XE Web UI
Cisco IOS XE contains a command injection vulnerability in the web user interface. When chained with CVE-2023-20198, the attacker can leverage the new local user to elevate privilege to root and write the implant to the file system. Cisco identified CVE-2023-20273 as…
Required action: Verify that instances of Cisco IOS XE Web UI are in compliance with BOD 23-02 and apply mitigations per vendor instructions. For affected products (Cisco IOS XE Web UI exposed to the internet or to…
CVE-2023-4966: Citrix NetScaler ADC and NetScaler Gateway Buffer Overflow Vulnerability
Citrix · NetScaler ADC and NetScaler Gateway
Citrix NetScaler ADC and NetScaler Gateway contain a buffer overflow vulnerability that allows for sensitive information disclosure when configured as a Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) or AAA virtual server.
Required action: Apply mitigations and kill all active and persistent sessions per vendor instructions [https://www.netscaler.com/blog/news/cve-2023-4966-critical-security-update-now-available-for-netscaler-adc-and-netscaler-gateway/] OR discontinue use of the product if mitigations are unavailable.
CVE-2023-20198: Cisco IOS XE Web UI Privilege Escalation Vulnerability
Cisco · IOS XE Web UI
Cisco IOS XE Web UI contains a privilege escalation vulnerability in the web user interface that could allow a remote, unauthenticated attacker to create an account with privilege level 15 access. The attacker can then use that account to gain control of…
Required action: Verify that instances of Cisco IOS XE Web UI are in compliance with BOD 23-02 and apply mitigations per vendor instructions. For affected products (Cisco IOS XE Web UI exposed to the internet or to…
CVE-2023-44487: HTTP/2 Rapid Reset Attack Vulnerability
IETF · HTTP/2
HTTP/2 contains a rapid reset vulnerability that allows for a distributed denial-of-service attack (DDoS).
Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
CVE-2023-41763: Microsoft Skype for Business Privilege Escalation Vulnerability
Microsoft · Skype for Business
Microsoft Skype for Business contains an unspecified vulnerability that allows for privilege escalation.
Required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
CVE-2023-36563: Microsoft WordPad Information Disclosure Vulnerability
Microsoft · WordPad
Microsoft WordPad contains an unspecified vulnerability that allows for information disclosure.
Required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
CVE-2023-21608: Adobe Acrobat and Reader Use-After-Free Vulnerability
Adobe · Acrobat and Reader
Adobe Acrobat and Reader contains a use-after-free vulnerability that allows for code execution in the context of the current user.
Required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
CVE-2023-20109: Cisco IOS and IOS XE Group Encrypted Transport VPN Out-of-Bounds Write Vulnerability
Cisco · IOS and IOS XE
Cisco IOS and IOS XE contain an out-of-bounds write vulnerability in the Group Encrypted Transport VPN (GET VPN) feature that could allow an authenticated, remote attacker who has administrative control of either a group member or a key server to execute malicious…
Required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
CVE-2023-42824: Apple iOS and iPadOS Kernel Privilege Escalation Vulnerability
Apple · iOS and iPadOS
Apple iOS and iPadOS contain an unspecified vulnerability that allows for local privilege escalation.
Required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
CVE-2023-40044: Progress WS_FTP Server Deserialization of Untrusted Data Vulnerability
Progress · WS_FTP Server
Progress WS_FTP Server contains a deserialization of untrusted data vulnerability in the Ad Hoc Transfer module that allows an authenticated attacker to execute remote commands on the underlying operating system.
Required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
CVE-2023-22515: Atlassian Confluence Data Center and Server Broken Access Control Vulnerability
Atlassian · Confluence Data Center and Server
Atlassian Confluence Data Center and Server contains a broken access control vulnerability that allows an attacker to create unauthorized Confluence administrator accounts and access Confluence.
Required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Check all affected Confluence instances for evidence of compromise per vendor instructions and report any positive findings to CISA.
CVE-2023-42793: JetBrains TeamCity Authentication Bypass Vulnerability
JetBrains · TeamCity
JetBrains TeamCity contains an authentication bypass vulnerability that allows for remote code execution on TeamCity Server.
Required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
CVE-2023-28229: Microsoft Windows CNG Key Isolation Service Privilege Escalation Vulnerability
Microsoft · Windows CNG Key Isolation Service
Microsoft Windows Cryptographic Next Generation (CNG) Key Isolation Service contains an unspecified vulnerability that allows an attacker to gain specific limited SYSTEM privileges.
Required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
CVE-2023-4211: Arm Mali GPU Kernel Driver Use-After-Free Vulnerability
Arm · Mali GPU Kernel Driver
Arm Mali GPU Kernel Driver contains a use-after-free vulnerability that allows a local, non-privileged user to make improper GPU memory processing operations to gain access to already freed memory.
Required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
CVE-2023-5217: Google Chromium libvpx Heap Buffer Overflow Vulnerability
Google · Chromium libvpx
Google Chromium libvpx contains a heap buffer overflow vulnerability in vp8 encoding that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could impact web browsers using libvpx, including but not limited to Google Chrome.
Required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
CVE-2018-14667: Red Hat JBoss RichFaces Framework Expression Language Injection Vulnerability
Red Hat · JBoss RichFaces Framework
Red Hat JBoss RichFaces Framework contains an expression language injection vulnerability via the UserResource resource. A remote, unauthenticated attacker could exploit this vulnerability to execute malicious code using a chain of Java serialized objects via org.ajax4jsf.resource.UserResource$UriData.
Required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
CVE-2023-41993: Apple Multiple Products WebKit Code Execution Vulnerability
Apple · Multiple Products
Apple iOS, iPadOS, macOS, and Safari WebKit contain an unspecified vulnerability that leads to code execution when processing maliciously crafted web content. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which…
Required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
CVE-2023-41992: Apple Multiple Products Kernel Privilege Escalation Vulnerability
Apple · Multiple Products
Apple iOS, iPadOS, macOS, and watchOS contain an unspecified vulnerability that allows for local privilege escalation.
Required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
CVE-2023-41991: Apple Multiple Products Improper Certificate Validation Vulnerability
Apple · Multiple Products
Apple iOS, iPadOS, macOS, and watchOS contain an improper certificate validation vulnerability that can allow a malicious app to bypass signature validation.
Required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
CVE-2023-41179: Trend Micro Apex One and Worry-Free Business Security Remote Code Execution Vulnerability
Trend Micro · Apex One and Worry-Free Business Security
Trend Micro Apex One and Worry-Free Business Security contain an unspecified vulnerability in the third-party anti-virus uninstaller that could allow an attacker to manipulate the module to conduct remote code execution. An attacker must first obtain administrative console access on the target…
Required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Complete fixed-window snapshot
CVEs — Past 48 Hours
All unique CVEs returned by NVD for the displayed UTC publication window. The snapshot is accepted only when its normalized unique-item count exactly equals the API totalResults value.
Entries 457–480 of 1,013
CVE-2026-17336
IBM API Connect [network address omitted] through [network address omitted] could allow a remote authenticated attacker to execute arbitrary SQL commands due to improper neutralization of special elements used in an SQL command.
CVE-2026-17335
IBM API Connect [network address omitted] through [network address omitted] could allow a remote authenticated attacker to execute arbitrary code due to path traversal. File paths in uploaded content are not sufficiently validated, which could allow files to be written outside the intended location and code…
CVE-2026-17334
IBM API Connect [network address omitted] through [network address omitted] could allow a remote authenticated attacker to obtain sensitive information due to improper authorization via user-controlled keys.
CVE-2026-17333
IBM API Connect [network address omitted] through [network address omitted] and [network address omitted] through [network address omitted] could allow a remote attacker to bypass authentication and inject unauthorized configuration changes due to improper certificate validation.
CVE-2026-17332
IBM API Connect [network address omitted] through [network address omitted] could allow a remote attacker to bypass security restrictions due to improper certificate validation.
CVE-2026-17331
IBM API Connect [network address omitted] through [network address omitted] could allow a remote attacker to read arbitrary files on the server due to external control of a file name or path.
CVE-2026-17330
IBM API Connect [network address omitted] through [network address omitted] could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery.
CVE-2026-17329
IBM API Connect [network address omitted] through [network address omitted] could allow a remote attacker to obtain sensitive information due to improper validation of endpoint URLs.
CVE-2026-17328
IBM API Connect [network address omitted] through [network address omitted] could allow a remote authenticated attacker to obtain sensitive information due to improper input validation. Input checks are incomplete, which could allow them to be bypassed.
CVE-2026-17327
IBM API Connect [network address omitted] through [network address omitted] could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery.
CVE-2026-17326
IBM API Connect [network address omitted] through [network address omitted] and [network address omitted] through [network address omitted] could allow a remote authenticated attacker to bypass security restrictions due to improper authentication.
CVE-2026-17325
IBM API Connect [network address omitted] through [network address omitted] could allow a remote authenticated attacker to obtain sensitive information due to improper validation of user-supplied URLs.
CVE-2026-17324
IBM API Connect [network address omitted] through [network address omitted] could allow a remote attacker to access sensitive configuration data and perform unauthorized actions due to missing authentication for a critical function.
CVE-2026-17323
IBM API Connect [network address omitted] through [network address omitted] could allow a remote attacker to obtain sensitive information due to XML external entity (XXE) injection.
CVE-2026-17322
IBM API Connect [network address omitted] through [network address omitted] and [network address omitted] through [network address omitted] could allow a local attacker to obtain sensitive credentials and compromise accounts due to insertion of sensitive information into log files.
CVE-2026-17321
IBM API Connect [network address omitted] through [network address omitted] could allow a remote authenticated attacker to delete or overwrite arbitrary control-plane assets due to an insecure direct object reference.
CVE-2026-17320
IBM API Connect [network address omitted] through [network address omitted] could allow a remote authenticated attacker to obtain sensitive information due to an insecure direct object reference.
CVE-2026-17319
IBM API Connect [network address omitted] through [network address omitted] could allow a remote authenticated attacker to modify tool configuration and cause a denial of service due to improper authorization. Information supplied by the client is relied on when deciding what a user is allowed to…
CVE-2026-17318
IBM API Connect [network address omitted] through [network address omitted] and [network address omitted] through [network address omitted] could allow a remote authenticated attacker to obtain sensitive information due to improper authorization.
CVE-2026-17317
IBM API Connect [network address omitted] through [network address omitted] could allow a remote authenticated attacker to access internal resources and cause a denial of service due to server-side request forgery.
CVE-2026-17316
IBM API Connect [network address omitted] through [network address omitted] could allow a remote attacker to perform server-side request forgery due to improper validation of user-supplied input.
CVE-2026-17315
IBM API Connect [network address omitted] through [network address omitted] could allow a remote attacker to obtain sensitive information due to improper validation of user-supplied URLs.
CVE-2026-17314
IBM API Connect [network address omitted] through [network address omitted] could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery.
CVE-2026-17313
IBM API Connect [network address omitted] through [network address omitted] could allow a remote attacker to obtain sensitive information and take control of gateway configuration due to authentication bypass via an alternate path.