Kythos AI vulnerability intelligence
Zero-Day Exploits / Vulnerabilities
A server-rendered, source-attributed view of confirmed CISA KEV entries and all NVD CVEs published in the rolling 48-hour UTC window.
Important distinction: CISA KEV means exploitation has been observed; it does not mean every entry was a zero-day. An NVD publication in the past 48 hours does not mean exploitation has occurred. Source records describe third-party products and do not identify Kythos AI customers, contracts, affiliations, or work history.
Confirmed exploitation intelligence
Zero-Day Exploits / Vulnerabilities
Complete CISA Known Exploited Vulnerabilities catalog, ordered by the date CISA added each entry. Every result is known to be exploited; entries are not necessarily zero-days.
Entries 865–888 of 1,769
CVE-2019-1388: Microsoft Windows Certificate Dialog Privilege Escalation Vulnerability
Microsoft · Windows
Microsoft Windows Certificate Dialog contains a privilege escalation vulnerability, allowing attackers to run processes in an elevated context.
Required action: Apply updates per vendor instructions.
CVE-2022-27926: Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting (XSS) Vulnerability
Synacor · Zimbra Collaboration Suite (ZCS)
Synacor Zimbra Collaboration Suite (ZCS) contains a cross-site scripting vulnerability by allowing an endpoint URL to accept parameters without sanitizing.
Required action: Apply updates per vendor instructions.
CVE-2023-0266: Linux Kernel Use-After-Free Vulnerability
Linux · Kernel
Linux kernel contains a use-after-free vulnerability that allows for privilege escalation to gain ring0 access from the system user.
Required action: Apply updates per vendor instructions.
CVE-2022-42948: Fortra Cobalt Strike User Interface Remote Code Execution Vulnerability
Fortra · Cobalt Strike
Fortra Cobalt Strike User Interface contains an unspecified vulnerability rooted in Java Swing that may allow remote code execution.
Required action: Apply updates per vendor instructions.
CVE-2022-39197: Fortra Cobalt Strike Teamserver Cross-Site Scripting (XSS) Vulnerability
Fortra · Cobalt Strike
Fortra Cobalt Strike contains a cross-site scripting (XSS) vulnerability in Teamserver that would allow an attacker to set a malformed username in the Beacon configuration, allowing them to execute code remotely.
Required action: Apply updates per vendor instructions.
CVE-2022-38181: Arm Mali GPU Kernel Driver Use-After-Free Vulnerability
Arm · Mali Graphics Processing Unit (GPU)
Arm Mali GPU Kernel Driver contains a use-after-free vulnerability that may allow a non-privileged user to gain root privilege and/or disclose information.
Required action: Apply updates per vendor instructions.
CVE-2022-3038: Google Chromium Network Service Use-After-Free Vulnerability
Google · Chromium Network Service
Google Chromium Network Service contains a use-after-free vulnerability that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge,…
Required action: Apply updates per vendor instructions.
CVE-2022-22706: Arm Mali GPU Kernel Driver Unspecified Vulnerability
Arm · Mali Graphics Processing Unit (GPU)
Arm Mali GPU Kernel Driver contains an unspecified vulnerability that allows a non-privileged user to achieve write access to read-only memory pages.
Required action: Apply updates per vendor instructions.
CVE-2021-30900: Apple iOS, iPadOS, and macOS Out-of-Bounds Write Vulnerability
Apple · iOS, iPadOS, and macOS
Apple GPU drivers, included in iOS, iPadOS, and macOS, contain an out-of-bounds write vulnerability that may allow a malicious application to execute code with kernel privileges.
Required action: Apply updates per vendor instructions.
CVE-2017-7494: Samba Remote Code Execution Vulnerability
Samba · Samba
Samba contains a remote code execution vulnerability, allowing a malicious client to upload a shared library to a writable share and then cause the server to load and execute it.
Required action: Apply updates per vendor instructions.
CVE-2013-3163: Microsoft Internet Explorer Memory Corruption Vulnerability
Microsoft · Internet Explorer
Microsoft Internet Explorer contains a memory corruption vulnerability that allows remote attackers to execute code or cause a denial of service via a crafted website.
Required action: The impacted product is end-of-life and should be disconnected if still in use.
CVE-2023-26360: Adobe ColdFusion Deserialization of Untrusted Data Vulnerability
Adobe · ColdFusion
Adobe ColdFusion contains a deserialization of untrusted data vulnerability that allows for remote code execution.
Required action: Apply updates per vendor instructions.
CVE-2023-24880: Microsoft Windows SmartScreen Security Feature Bypass Vulnerability
Microsoft · Windows
Microsoft Windows SmartScreen contains a security feature bypass vulnerability that could allow an attacker to evade Mark of the Web (MOTW) defenses via a specially crafted malicious file.
Required action: Apply updates per vendor instructions.
CVE-2023-23397: Microsoft Office Outlook Privilege Escalation Vulnerability
Microsoft · Office
Microsoft Office Outlook contains a privilege escalation vulnerability that allows for a NTLM Relay attack against another service to authenticate as the user.
Required action: Apply updates per vendor instructions.
CVE-2022-41328: Fortinet FortiOS Path Traversal Vulnerability
Fortinet · FortiOS
Fortinet FortiOS contains a path traversal vulnerability that may allow a local privileged attacker to read and write files via crafted CLI commands.
Required action: Apply updates per vendor instructions.
CVE-2021-39144: XStream Remote Code Execution Vulnerability
XStream · XStream
XStream contains a remote code execution vulnerability that allows an attacker to manipulate the processed input stream and replace or inject objects that result in the execution of a local command on the server. This vulnerability can affect multiple products, including but…
Required action: Apply updates per vendor instructions.
CVE-2020-5741: Plex Media Server Remote Code Execution Vulnerability
Plex · Media Server
Plex Media Server contains a remote code execution vulnerability that allows an attacker with access to the server administrator's Plex account to upload a malicious file via the Camera Upload feature and have the media server execute it.
Required action: Apply updates per vendor instructions.
CVE-2022-35914: Teclib GLPI Remote Code Execution Vulnerability
Teclib · GLPI
Teclib GLPI contains a remote code execution vulnerability in the third-party library, htmlawed.
Required action: Apply updates per vendor instructions.
CVE-2022-33891: Apache Spark Command Injection Vulnerability
Apache · Spark
Apache Spark contains a command injection vulnerability via Spark User Interface (UI) when Access Control Lists (ACLs) are enabled.
Required action: Apply updates per vendor instructions.
CVE-2022-28810: Zoho ManageEngine ADSelfService Plus Remote Code Execution Vulnerability
Zoho · ManageEngine
Zoho ManageEngine ADSelfService Plus contains an unspecified vulnerability allowing for remote code execution when performing a password change or reset.
Required action: Apply updates per vendor instructions.
CVE-2022-36537: ZK Framework AuUploader Unspecified Vulnerability
ZK Framework · AuUploader
ZK Framework AuUploader servlets contain an unspecified vulnerability that could allow an attacker to retrieve the content of a file located in the web context. The ZK Framework is an open-source Java framework. This vulnerability can impact multiple products, including but not…
Required action: Apply updates per vendor instructions.
CVE-2022-47986: IBM Aspera Faspex Code Execution Vulnerability
IBM · Aspera Faspex
IBM Aspera Faspex could allow a remote attacker to execute code on the system, caused by a YAML deserialization flaw.
Required action: Apply updates per vendor instructions.
CVE-2022-41223: Mitel MiVoice Connect Code Injection Vulnerability
Mitel · MiVoice Connect
The Director component in Mitel MiVoice Connect allows an authenticated attacker with internal network access to execute code within the context of the application.
Required action: Apply updates per vendor instructions.
CVE-2022-40765: Mitel MiVoice Connect Command Injection Vulnerability
Mitel · MiVoice Connect
The Mitel Edge Gateway component of MiVoice Connect allows an authenticated attacker with internal network access to execute commands within the context of the system.
Required action: Apply updates per vendor instructions.
Complete fixed-window snapshot
CVEs — Past 48 Hours
All unique CVEs returned by NVD for the displayed UTC publication window. The snapshot is accepted only when its normalized unique-item count exactly equals the API totalResults value.
Entries 433–456 of 1,013
CVE-2026-17368
IBM API Connect [network address omitted] through [network address omitted] and [network address omitted] through [network address omitted] could allow a remote authenticated attacker to perform network reconnaissance and obtain sensitive credentials due to server-side request forgery. The server can be made to send requests to…
CVE-2026-17367
IBM API Connect [network address omitted] through [network address omitted] and [network address omitted] through [network address omitted] could allow a remote authenticated attacker to obtain sensitive information due to insufficiently protected credentials.
CVE-2026-17366
IBM API Connect [network address omitted] through [network address omitted] and [network address omitted] through [network address omitted] could allow a remote authenticated attacker to obtain sensitive information due to broken object-level authorization.
CVE-2026-17365
IBM API Connect [network address omitted] through [network address omitted] and [network address omitted] through [network address omitted] could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery.
CVE-2026-17363
IBM API Connect [network address omitted] through [network address omitted] and [network address omitted] through [network address omitted] could allow a remote authenticated attacker to obtain sensitive information due to SQL injection.
CVE-2026-17361
IBM API Connect [network address omitted] through [network address omitted] could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery.
CVE-2026-17360
IBM API Connect [network address omitted] through [network address omitted] could allow a remote attacker to gain full administrative control due to the use of hard-coded credentials.
CVE-2026-17359
IBM API Connect [network address omitted] through [network address omitted] and [network address omitted] through [network address omitted] could allow a remote authenticated attacker to execute arbitrary code due to improper control of generation of code. A user-supplied value can influence code that the product generates,…
CVE-2026-17358
IBM API Connect [network address omitted] through [network address omitted] and [network address omitted] through [network address omitted] could allow a remote authenticated attacker to bypass authentication across tenants due to improper authentication. Authentication checks are not sufficiently isolated between tenants, which could allow a user…
CVE-2026-17357
IBM API Connect [network address omitted] through [network address omitted] and [network address omitted] through [network address omitted] could allow a remote authenticated attacker to access internal network services due to server-side request forgery.
CVE-2026-17356
IBM API Connect [network address omitted] through [network address omitted] could allow a local attacker to obtain sensitive information due to the use of a hard-coded cryptographic key.
CVE-2026-17355
IBM API Connect [network address omitted] through [network address omitted] could allow a remote authenticated attacker to obtain sensitive information from internal network resources due to server-side request forgery. Destination checks on outbound requests can be bypassed, which could allow the server to reach internal systems…
CVE-2026-17354
IBM API Connect [network address omitted] through [network address omitted] could allow a remote authenticated attacker to perform arbitrary file writes due to path traversal.
CVE-2026-17353
IBM API Connect [network address omitted] through [network address omitted] could allow a remote authenticated attacker to obtain sensitive information and bypass security restrictions due to server-side request forgery.
CVE-2026-17352
IBM API Connect [network address omitted] through [network address omitted] could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery.
CVE-2026-17345
IBM API Connect [network address omitted] through [network address omitted] and [network address omitted] through [network address omitted] could allow a remote authenticated attacker to obtain sensitive information due to improper neutralization of special elements used in an SQL command.
CVE-2026-17344
IBM API Connect [network address omitted] through [network address omitted] could allow a remote attacker to obtain sensitive information due to server-side request forgery. A service that can be reached without authentication could be made to send requests to unintended destinations.
CVE-2026-17343
IBM API Connect [network address omitted] through [network address omitted] could allow a remote authenticated attacker to bypass authorization checks to access or modify sensitive information due to improper authorization.
CVE-2026-17342
IBM API Connect [network address omitted] through [network address omitted] and [network address omitted] through [network address omitted] could allow a remote authenticated attacker to execute arbitrary code due to improper control of generation of code.
CVE-2026-17341
IBM API Connect [network address omitted] through [network address omitted] could allow a remote attacker to perform server-side request forgery and relay unauthorized email messages due to improper neutralization of user-supplied input.
CVE-2026-17340
IBM API Connect [network address omitted] through [network address omitted] could allow a remote attacker to execute arbitrary code due to a path traversal vulnerability.
CVE-2026-17339
IBM API Connect [network address omitted] through [network address omitted] could allow a remote authenticated attacker to access or delete resources belonging to other tenants due to path traversal.
CVE-2026-17338
IBM API Connect [network address omitted] through [network address omitted] could allow a remote authenticated attacker to obtain sensitive information due to broken object-level authorization.
CVE-2026-17337
IBM API Connect [network address omitted] through [network address omitted] could allow a remote authenticated attacker to bypass authentication due to improper certificate validation. A certificate check is not performed reliably in all cases, which could allow a connection to be accepted without proper authentication.