Kythos AI

CVE watch Past 48 hours+

Latest 48 of 994 in cacheBrowse CVEs
NVD checked Nov 8, 06:27 UTCSource: NVD · Refreshed every 2 hours · Publication may lag

Kythos AI vulnerability intelligence

Zero-Day Exploits / Vulnerabilities

A server-rendered, source-attributed view of confirmed CISA KEV entries and all NVD CVEs published in the rolling 48-hour UTC window.

Important distinction: CISA KEV means exploitation has been observed; it does not mean every entry was a zero-day. An NVD publication in the past 48 hours does not mean exploitation has occurred. Source records describe third-party products and do not identify Kythos AI customers, contracts, affiliations, or work history.

CISA KEV catalogNVD 48-hour CVEsKythos AI RSS feed

Confirmed exploitation intelligence

Zero-Day Exploits / Vulnerabilities

Complete CISA Known Exploited Vulnerabilities catalog, ordered by the date CISA added each entry. Every result is known to be exploited; entries are not necessarily zero-days.

Current snapshot

Entries 841–864 of 1,769

CISA KEV

CVE-2016-8735: Apache Tomcat Remote Code Execution Vulnerability

Apache · Tomcat

Apache Tomcat contains an unspecified vulnerability that allows for remote code execution if JmxRemoteLifecycleListener is used and an attacker can reach Java Management Extension (JMX) ports. This CVE exists because this listener wasn't updated for consistency with the Oracle patched issues for…

Federal remediation due Jun 2, 2023Ransomware use: Not confirmed by CISA

Required action: Apply updates per vendor instructions.

View in the CISA KEV catalog →

CISA KEV

CVE-2016-3427: Oracle Java SE and JRockit Unspecified Vulnerability

Oracle · Java SE and JRockit

Oracle Java SE and JRockit contains an unspecified vulnerability that allows remote attackers to affect confidentiality, integrity, and availability via vectors related to Java Management Extensions (JMX). This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets.…

Federal remediation due Jun 2, 2023Ransomware use: Not confirmed by CISA

Required action: Apply updates per vendor instructions.

View in the CISA KEV catalog →

CISA KEV

CVE-2014-0196: Linux Kernel Race Condition Vulnerability

Linux · Kernel

Linux Kernel contains a race condition vulnerability within the n_tty_write function that allows local users to cause a denial-of-service (DoS) or gain privileges via read and write operations with long strings.

Federal remediation due Jun 2, 2023Ransomware use: Not confirmed by CISA

Required action: The impacted product is end-of-life and should be disconnected if still in use.

View in the CISA KEV catalog →

CISA KEV

CVE-2010-3904: Linux Kernel Improper Input Validation Vulnerability

Linux · Kernel

Linux Kernel contains an improper input validation vulnerability in the Reliable Datagram Sockets (RDS) protocol implementation that allows local users to gain privileges via crafted use of the sendmsg and recvmsg system calls.

Federal remediation due Jun 2, 2023Ransomware use: Not confirmed by CISA

Required action: The impacted product is end-of-life and should be disconnected if still in use.

View in the CISA KEV catalog →

CISA KEV

CVE-2023-2136: Google Chrome Skia Integer Overflow Vulnerability

Google · Chromium Skia

Google Chromium Skia contains an integer overflow vulnerability that allows a remote attacker, who has compromised the renderer process, to potentially perform a sandbox escape via a crafted HTML page. This vulnerability affects Google Chrome and ChromeOS, Android, Flutter, and possibly other…

Federal remediation due May 12, 2023Ransomware use: Not confirmed by CISA

Required action: Apply updates per vendor instructions.

View in the CISA KEV catalog →

CISA KEV

CVE-2017-6742: Cisco IOS and IOS XE Software SNMP Remote Code Execution Vulnerability

Cisco · IOS and IOS XE Software

The Simple Network Management Protocol (SNMP) subsystem of Cisco IOS and IOS XE contains a vulnerability that could allow an authenticated, remote attacker to remotely execute code on an affected system or cause an affected system to reload.

Federal remediation due May 10, 2023Ransomware use: Not confirmed by CISA

Required action: Apply updates per vendor instructions.

View in the CISA KEV catalog →

CISA KEV

CVE-2023-2033: Google Chromium V8 Type Confusion Vulnerability

Google · Chromium V8

Google Chromium V8 Engine contains a type confusion vulnerability that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft…

Federal remediation due May 8, 2023Ransomware use: Not confirmed by CISA

Required action: Apply updates per vendor instructions.

View in the CISA KEV catalog →

CISA KEV

CVE-2023-28205: Apple Multiple Products WebKit Use-After-Free Vulnerability

Apple · Multiple Products

Apple iOS, iPadOS, macOS, and Safari WebKit contain a use-after-free vulnerability that leads to code execution when processing maliciously crafted web content. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which…

Federal remediation due May 1, 2023Ransomware use: Not confirmed by CISA

Required action: Apply updates per vendor instructions.

View in the CISA KEV catalog →

Source: Official CISA KEV JSONCatalog released Nov 6, 2026, 7:44 PM GMT+0000Site snapshot: Showing 24 of 1,769Source text normalized: network addresses and restricted context omittedRefresh interval: 30 minutes

Complete fixed-window snapshot

CVEs — Past 48 Hours

All unique CVEs returned by NVD for the displayed UTC publication window. The snapshot is accepted only when its normalized unique-item count exactly equals the API totalResults value.

Current snapshot

Entries 241–264 of 1,041

NVD CVE

CVE-2026-116537

The Link Library plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'link_description' parameter in all versions up to, and including, 7.10.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages…

CVSS 7.2 HIGHStatus: DeferredCWE-79

Review the NVD record →

NVD CVE

CVE-2026-115548

The Quttera ThreatSign – Web Malware Scanner for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'HTTP_USER_AGENT' parameter in all versions up to, and including, [network address omitted] due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated…

CVSS 7.2 HIGHStatus: DeferredCWE-79

Review the NVD record →

NVD CVE

CVE-2026-111370

The WP Visitor Statistics (Real Time Traffic) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'os (also browser, res)' parameter in all versions up to, and including, 8.9.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers…

CVSS 7.2 HIGHStatus: DeferredCWE-79

Review the NVD record →

NVD CVE

CVE-2026-111317

The JetFormBuilder — Dynamic Blocks Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the '' parameter in all versions up to, and including, 3.6.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary…

CVSS 7.2 HIGHStatus: DeferredCWE-79

Review the NVD record →

NVD CVE

CVE-2026-109991

The FunnelKit Payment Gateway for Stripe WooCommerce plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, [network address omitted] via the 'order-pay (WP query var from /checkout/order-pay//)' parameter due to missing validation on a user controlled key. This…

CVSS 7.5 HIGHStatus: DeferredCWE-639

Review the NVD record →

NVD CVE

CVE-2026-109230

The WP Visitor Statistics (Real Time Traffic) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'browser' parameter in all versions up to, and including, 8.7.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary…

CVSS 7.2 HIGHStatus: DeferredCWE-79

Review the NVD record →

NVD CVE

CVE-2026-109214

The User Frontend – Membership, User Registration, User Profile, User Directory & Content Restriction with Frontend Post Submission plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ' (default: 'category')' parameter in all versions up to, and including, 4.3.13 due to insufficient input sanitization…

CVSS 7.2 HIGHStatus: DeferredCWE-79

Review the NVD record →

NVD CVE

CVE-2026-104768

The AutomatorWP – No-Code Workflow Automation, Integration & Webhooks Plugin, now with AI plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 6.0.4. This is due to missing privilege-ceiling validation in the `create_user()` function within the anonymous-user action (and equally…

CVSS 7.5 HIGHStatus: DeferredCWE-269

Review the NVD record →

NVD CVE

CVE-2026-104760

The weDocs: AI Powered Knowledge Base, Docs, Documentation, Wiki & AI Chatbot plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'modalPlaceholder' Block Attribute in all versions up to, and including, 2.6.1 due to insufficient input sanitization and output escaping. This makes it possible for…

CVSS 6.4 MEDIUMStatus: DeferredCWE-79

Review the NVD record →

NVD CVE

CVE-2026-104746

The Motors – Car Dealership & Classified Listings Plugin plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the stm_listings_ajax_save_user_data function in all versions up to, and including, 1.4.125 This makes it possible for authenticated attackers, with subscriber-level access…

CVSS 8.1 HIGHStatus: DeferredCWE-22

Review the NVD record →

NVD CVE

CVE-2026-104014

The Naimur Email OTP Verification for WooCommerce plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 2.1.0. This is due to the plugin's password-reset finalization endpoint (the wp_ajax_nopriv_ceovw_update_new_password action handled by CEOVW_AJAX[network address omitted]update_new_password()) authorizing the reset solely by the presence…

CVSS 9.8 CRITICALStatus: DeferredCWE-287

Review the NVD record →

NVD CVE

CVE-2026-103914

The Dynific Addons for Elementor plugin for WordPress is vulnerable to SQL Injection via the 'q' parameter in versions up to, and including, 1.3. This is due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query in…

CVSS 6.5 MEDIUMStatus: DeferredCWE-89

Review the NVD record →

NVD CVE

CVE-2026-102564

The The Dynific Addons for Elementor (formerly Anywhere Elementor) plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 1.3.0 This is due to the software allowing users to execute an action that does not properly validate a value before…

CVSS 6.5 MEDIUMStatus: DeferredCWE-94

Review the NVD record →

NVD CVE

CVE-2026-123961

A security vulnerability has been detected in TOTOLINK CA300-PoE 6.2c.884. This impacts the function setWiFiBasicConfig of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument KeyStr leads to buffer overflow. The attack may be initiated remotely. The exploit has been disclosed publicly and may be used.

CVSS 8.6 HIGHStatus: DeferredCWE-119CWE-120

Review the NVD record →

NVD CVE

CVE-2026-123470

Missing Authorization vulnerability in HivePress HivePress hivepress allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects HivePress: from n/a through 1.8.1.

CVSS 4.3 MEDIUMStatus: DeferredCWE-862

Review the NVD record →

NVD CVE

CVE-2026-123468

Missing Authorization vulnerability in StylemixThemes Motors motors-car-dealership-classified-listings allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Motors: from n/a through 1.4.128.

CVSS 4.3 MEDIUMStatus: DeferredCWE-862

Review the NVD record →

NVD CVE

CVE-2026-123148

Missing Authorization vulnerability in TMS IvyForms ivyforms allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects IvyForms: from n/a through 1.5.1.

CVSS 5.3 MEDIUMStatus: DeferredCWE-862

Review the NVD record →

NVD CVE

CVE-2026-121783

Cross-Site Request Forgery (CSRF) vulnerability in Passionate Programmer Peter WP Data Access wp-data-access allows Cross Site Request Forgery.This issue affects WP Data Access: from n/a through 5.5.90.

CVSS 6.5 MEDIUMStatus: DeferredCWE-352

Review the NVD record →

NVD CVE

CVE-2026-121724

Missing Authorization vulnerability in WebberZone Contextual Related Posts contextual-related-posts allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Contextual Related Posts: from n/a through 4.5.3.

CVSS 4.3 MEDIUMStatus: DeferredCWE-862

Review the NVD record →

NVD CVE

CVE-2026-121571

Missing Authorization vulnerability in WP Desk Autopay dla WooCommerce pay-wp allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Autopay dla WooCommerce: from n/a through 2.3.0.

CVSS 5.3 MEDIUMStatus: DeferredCWE-862

Review the NVD record →

NVD CVE

CVE-2026-120857

Missing Authorization vulnerability in VideoWhisper.com 2Way VideoCalls and Random Chat webcam-2way-videochat allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects 2Way VideoCalls and Random Chat: from n/a through 6.1.9.

CVSS 5.3 MEDIUMStatus: DeferredCWE-862

Review the NVD record →

NVD CVE

CVE-2026-120837

Missing Authorization vulnerability in Everest Forms Everest Forms everest-forms allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Everest Forms: from n/a through 3.6.3.

CVSS 4.3 MEDIUMStatus: DeferredCWE-862

Review the NVD record →

NVD CVE

CVE-2026-120365

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Aguila Technologies WP Customer Area customer-area allows Stored XSS.This issue affects WP Customer Area: from n/a through 8.4.3.

CVSS 6.5 MEDIUMStatus: DeferredCWE-79

Review the NVD record →

NVD CVE

CVE-2026-120364

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Untapwp Vidplex vidplex allows Stored XSS.This issue affects Vidplex: from n/a through 1.0.3.

CVSS 6.5 MEDIUMStatus: DeferredCWE-79

Review the NVD record →

Source: Official NVD CVE API 2.0UTC window Nov 6, 2026 06:27–Nov 8, 2026 06:27API response: Site snapshot: Showing 24 of 1,041Source text normalized: network addresses and restricted context omittedRefresh interval: 2 hours