Kythos AI vulnerability intelligence
Zero-Day Exploits / Vulnerabilities
A server-rendered, source-attributed view of confirmed CISA KEV entries and all NVD CVEs published in the rolling 48-hour UTC window.
Important distinction: CISA KEV means exploitation has been observed; it does not mean every entry was a zero-day. An NVD publication in the past 48 hours does not mean exploitation has occurred. Source records describe third-party products and do not identify Kythos AI customers, contracts, affiliations, or work history.
Confirmed exploitation intelligence
Zero-Day Exploits / Vulnerabilities
Complete CISA Known Exploited Vulnerabilities catalog, ordered by the date CISA added each entry. Every result is known to be exploited; entries are not necessarily zero-days.
Entries 937–960 of 1,769
CVE-2022-36804: Atlassian Bitbucket Server and Data Center Command Injection Vulnerability
Atlassian · Bitbucket Server and Data Center
Multiple API endpoints of Atlassian Bitbucket Server and Data Center contain a command injection vulnerability where an attacker with access to a public Bitbucket repository, or with read permissions to a private one, can execute code by sending a malicious HTTP request.
Required action: Apply updates per vendor instructions.
CVE-2022-3236: Sophos Firewall Code Injection Vulnerability
Sophos · Firewall
A code injection vulnerability in the User Portal and Webadmin of Sophos Firewall allows for remote code execution.
Required action: Apply updates per vendor instructions.
CVE-2022-35405: Zoho ManageEngine Multiple Products Remote Code Execution Vulnerability
Zoho · ManageEngine
Zoho ManageEngine PAM360, Password Manager Pro, and Access Manager Plus contain an unspecified vulnerability that allows for remote code execution.
Required action: Apply updates per vendor instructions.
CVE-2022-40139: Trend Micro Apex One and Apex One as a Service Improper Validation Vulnerability
Trend Micro · Apex One and Apex One as a Service
Trend Micro Apex One and Apex One as a Service contain an improper validation of rollback mechanism components that could lead to remote code execution.
Required action: Apply updates per vendor instructions.
CVE-2013-6282: Linux Kernel Improper Input Validation Vulnerability
Linux · Kernel
The get_user and put_user API functions of the Linux kernel fail to validate the target address when being used on ARM v6k/v7 platforms. This allows an application to read and write kernel memory which could lead to privilege escalation.
Required action: Apply updates per vendor instructions.
CVE-2013-2597: Code Aurora ACDB Audio Driver Stack-based Buffer Overflow Vulnerability
Code Aurora · ACDB Audio Driver
The Code Aurora audio calibration database (acdb) audio driver contains a stack-based buffer overflow vulnerability that allows for privilege escalation. Code Aurora is used in third-party products such as Qualcomm and Android.
Required action: Apply updates per vendor instructions.
CVE-2013-2596: Linux Kernel Integer Overflow Vulnerability
Linux · Kernel
Linux kernel fb_mmap function in drivers/video/fbmem.c contains an integer overflow vulnerability that allows for privilege escalation.
Required action: Apply updates per vendor instructions.
CVE-2013-2094: Linux Kernel Privilege Escalation Vulnerability
Linux · Kernel
Linux kernel fails to check all 64 bits of attr.config passed by user space, resulting to out-of-bounds access of the perf_swevent_enabled array in sw_perf_event_destroy(). Explotation allows for privilege escalation.
Required action: Apply updates per vendor instructions.
CVE-2010-2568: Microsoft Windows Remote Code Execution Vulnerability
Microsoft · Windows
Microsoft Windows incorrectly parses shortcuts in such a way that malicious code may be executed when the operating system displays the icon of a malicious shortcut file. An attacker who successfully exploited this vulnerability could execute code as the logged-on user.
Required action: Apply updates per vendor instructions.
CVE-2022-37969: Microsoft Windows Common Log File System (CLFS) Driver Privilege Escalation Vulnerability
Microsoft · Windows
Microsoft Windows Common Log File System (CLFS) driver contains an unspecified vulnerability that allows for privilege escalation.
Required action: Apply updates per vendor instructions.
CVE-2022-32917: Apple iOS, iPadOS, and macOS Remote Code Execution Vulnerability
Apple · iOS, iPadOS, and macOS
Apple kernel, which is included in iOS, iPadOS, and macOS, contains an unspecified vulnerability where an application may be able to execute code with kernel privileges.
Required action: Apply updates per vendor instructions.
CVE-2022-3075: Google Chromium Mojo Insufficient Data Validation Vulnerability
Google · Chromium Mojo
Google Chromium Mojo contains an insufficient data validation vulnerability that allows a remote attacker, who has compromised the renderer process, to potentially perform a sandbox escape via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including,…
Required action: Apply updates per vendor instructions.
CVE-2022-27593: QNAP Photo Station Externally Controlled Reference Vulnerability
QNAP · Photo Station
Certain QNAP NAS running Photo Station with internet exposure contain an externally controlled reference to a resource vulnerability which can allow an attacker to modify system files. This vulnerability was observed being utilized in a Deadbolt ransomware campaign.
Required action: Apply updates per vendor instructions.
CVE-2022-26258: D-Link DIR-820L Remote Code Execution Vulnerability
D-Link · DIR-820L
D-Link DIR-820L contains an unspecified vulnerability in Device Name parameter in /lan.asp which allows for remote code execution.
Required action: The impacted product is end-of-life and should be disconnected if still in use.
CVE-2020-9934: Apple iOS, iPadOS, and macOS Input Validation Vulnerability
Apple · iOS, iPadOS, and macOS
Apple iOS, iPadOS, and macOS contain an unspecified vulnerability involving input validation which can allow a local attacker to view sensitive user information.
Required action: Apply updates per vendor instructions.
CVE-2018-7445: MikroTik RouterOS Stack-Based Buffer Overflow Vulnerability
MikroTik · RouterOS
In MikroTik RouterOS, a stack-based buffer overflow occurs when processing NetBIOS session request messages. Remote attackers with access to the service can exploit this vulnerability and gain code execution on the system.
Required action: Apply updates per vendor instructions.
CVE-2018-6530: D-Link Multiple Routers OS Command Injection Vulnerability
D-Link · Multiple Routers
Multiple D-Link routers contain an unspecified vulnerability that allows for execution of OS commands.
Required action: The vendor D-Link published an advisory stating the fix under CVE-2018-20114 properly patches KEV entry CVE-2018-6530. If the device is still supported, apply updates per vendor instructions. If the affected device has since entered its…
CVE-2018-2628: Oracle WebLogic Server Unspecified Vulnerability
Oracle · WebLogic Server
Oracle WebLogic Server contains an unspecified vulnerability which can allow an unauthenticated attacker with T3 network access to compromise the server.
Required action: Apply updates per vendor instructions.
CVE-2018-13374: Fortinet FortiOS and FortiADC Improper Access Control Vulnerability
Fortinet · FortiOS and FortiADC
Fortinet FortiOS and FortiADC contain an improper access control vulnerability that allows attackers to obtain the LDAP server login credentials configured in FortiGate by pointing a LDAP server connectivity test request to a rogue LDAP server.
Required action: Apply updates per vendor instructions.
CVE-2017-5521: NETGEAR Multiple Devices Exposure of Sensitive Information Vulnerability
NETGEAR · Multiple Devices
Multiple NETGEAR devices are prone to admin password disclosure via simple crafted requests to the web management server.
Required action: Apply updates per vendor instructions. If the affected device has since entered end-of-life, it should be disconnected if still in use.
CVE-2011-4723: D-Link DIR-300 Router Cleartext Storage of a Password Vulnerability
D-Link · DIR-300 Router
The D-Link DIR-300 router stores cleartext passwords, which allows context-dependent attackers to obtain sensitive information.
Required action: The impacted product is end-of-life and should be disconnected if still in use.
CVE-2011-1823: Android OS Privilege Escalation Vulnerability
Android · Android OS
The vold volume manager daemon in Android kernel trusts messages from a PF_NETLINK socket, which allows an attacker to execute code and gain root privileges. This vulnerability is associated with GingerBreak and Exploit.AndroidOS.Lotoor.
Required action: Apply updates per vendor instructions.
CVE-2022-26352: dotCMS Unrestricted Upload of File Vulnerability
dotCMS · dotCMS
dotCMS ContentResource API contains an unrestricted upload of file with a dangerous type vulnerability that allows for directory traversal, in which the file is saved outside of the intended storage location. Exploitation allows for remote code execution.
Required action: Apply updates per vendor instructions.
CVE-2022-24706: Apache CouchDB Insecure Default Initialization of Resource Vulnerability
Apache · CouchDB
Apache CouchDB contains an insecure default initialization of resource vulnerability which can allow an attacker to escalate to administrative privileges.
Required action: Apply updates per vendor instructions.
Complete fixed-window snapshot
CVEs — Past 48 Hours
All unique CVEs returned by NVD for the displayed UTC publication window. The snapshot is accepted only when its normalized unique-item count exactly equals the API totalResults value.
Entries 961–984 of 1,041
CVE-2026-123299
In JetBrains Hub before 2026.2.52519 information disclosure via user search queries was possible
CVE-2026-123298
In JetBrains Hub before 2026.2.52556 sMTP command injection via email verification was possible
CVE-2026-123297
In JetBrains Hub before 2026.2.52519 two-factor authentication bypass was possible via the password reset flow
CVE-2026-123296
In JetBrains Hub before 2026.2.52519 privilege escalation via forged email verification was possible
CVE-2026-123295
In JetBrains Hub before 2026.2.52519 enforced two-factor authentication could be disabled via the profile update endpoint
CVE-2026-123294
In JetBrains Hub before 2026.2.52556 privilege escalation was possible by changing email authentication details during the verification flow
CVE-2026-123293
In JetBrains IntelliJ IDEA before 2026.3, 2026.2.4 code execution was possible in untrusted projects via the Terraform tool path setting
CVE-2026-123292
In JetBrains Datalore before 2026.4 aPI tokens and sessions of removed or banned users remained valid
CVE-2026-123291
In JetBrains Datalore before 2026.4 improper owner validation allowed reading another workspace's issues and runs notebook
CVE-2026-123290
In JetBrains Datalore before 2026.4 hidden notebook code was exposed to unauthenticated users via the public interactive report content endpoint
CVE-2026-123289
In JetBrains Datalore before 2026.4 improper authorisation allowed notebook viewers to modify files
CVE-2026-123288
In JetBrains Datalore before 2026.4 stored XSS in notebook charts was possible via Vega editor link
CVE-2026-123287
In JetBrains Datalore before 2026.4 private notebook files could be downloaded without authentication via published interactive reports
CVE-2026-123286
In JetBrains Datalore before 2026.4 improper authorisation allowed read the notebook owner's file storage session token
CVE-2026-123285
In JetBrains Datalore before 2026.3 command execution was possible in the database task container via JVM options injection
CVE-2026-123284
In JetBrains Datalore before 2026.4 improper authorisation on workspace moves allowed view-only collaborators to modify shared content
CVE-2026-123283
In JetBrains Datalore before 2026.4 account takeover was possible via SSO sign-in to a pre-registered account
CVE-2026-123282
In JetBrains Datalore before 2026.4 missing expiration validation of account tokens allowed a new authenticated session
CVE-2026-123281
In JetBrains Datalore before 2026.4 notebook code could execute commands in the sidecar container via the mount broker
CVE-2026-123280
In JetBrains Datalore before 2026.2.4 unauthenticated users could execute code via published interactive reports
CVE-2026-123279
In JetBrains Datalore before 2026.4 code execution was possible in a notebook's computation by view-only collaborators
CVE-2026-123278
In JetBrains IntelliJ IDEA before 2026.3 code execution was possible via the unauthenticated JDBC worker RMI endpoint
CVE-2026-123277
In JetBrains CLion before 2026.3, 2026.2.4.1 missing authentication allowed local users to obtain the debug session environment on Linux
CVE-2026-123276
In JetBrains CLion before 2026.3, 2026.2.4.1 code execution was possible in Safe Mode via a crafted GDB server debug profile