Kythos AI vulnerability intelligence
Zero-Day Exploits / Vulnerabilities
A server-rendered, source-attributed view of confirmed CISA KEV entries and all NVD CVEs published in the rolling 48-hour UTC window.
Important distinction: CISA KEV means exploitation has been observed; it does not mean every entry was a zero-day. An NVD publication in the past 48 hours does not mean exploitation has occurred. Source records describe third-party products and do not identify Kythos AI customers, contracts, affiliations, or work history.
Confirmed exploitation intelligence
Zero-Day Exploits / Vulnerabilities
Complete CISA Known Exploited Vulnerabilities catalog, ordered by the date CISA added each entry. Every result is known to be exploited; entries are not necessarily zero-days.
Entries 1,129–1,152 of 1,769
CVE-2019-16057: D-Link DNS-320 Remote Code Execution Vulnerability
D-Link · DNS-320 Storage Device
The login_mgr.cgi script in D-Link DNS-320 is vulnerable to remote code execution.
Required action: The impacted product is end-of-life and should be disconnected if still in use.
CVE-2018-7841: Schneider Electric U.motion Builder SQL Injection Vulnerability
Schneider Electric · U.motion Builder
A SQL Injection vulnerability exists in U.motion Builder software which could cause unwanted code execution when an improper set of characters is entered.
Required action: The impacted product is end-of-life and should be disconnected if still in use.
CVE-2016-4523: Trihedral VTScada (formerly VTS) Denial-of-Service Vulnerability
Trihedral · VTScada (formerly VTS)
The WAP interface in Trihedral VTScada (formerly VTS) allows remote attackers to cause a denial-of-service (DoS).
Required action: Apply updates per vendor instructions.
CVE-2014-0780: InduSoft Web Studio NTWebServer Directory Traversal Vulnerability
InduSoft · Web Studio
InduSoft Web Studio NTWebServer contains a directory traversal vulnerability that allows remote attackers to read administrative passwords in APP files, allowing for remote code execution.
Required action: Apply updates per vendor instructions.
CVE-2010-5330: Ubiquiti AirOS Command Injection Vulnerability
Ubiquiti · AirOS
Certain Ubiquiti devices contain a command injection vulnerability via a GET request to stainfo.cgi.
Required action: Apply updates per vendor instructions.
CVE-2007-3010: Alcatel OmniPCX Enterprise Remote Code Execution Vulnerability
Alcatel · OmniPCX Enterprise
masterCGI in the Unified Maintenance Tool in Alcatel OmniPCX Enterprise Communication Server allows remote attackers to execute arbitrary commands.
Required action: Apply updates per vendor instructions.
CVE-2022-22954: VMware Workspace ONE Access and Identity Manager Server-Side Template Injection Vulnerability
VMware · Workspace ONE Access and Identity Manager
VMware Workspace ONE Access and Identity Manager allow for remote code execution due to server-side template injection.
Required action: Apply updates per vendor instructions.
CVE-2022-24521: Microsoft Windows CLFS Driver Privilege Escalation Vulnerability
Microsoft · Windows
Microsoft Windows Common Log File System (CLFS) Driver contains an unspecified vulnerability that allows for privilege escalation.
Required action: Apply updates per vendor instructions.
CVE-2018-7602: Drupal Core Remote Code Execution Vulnerability
Drupal · Core
A remote code execution vulnerability exists within multiple subsystems of Drupal that can allow attackers to exploit multiple attack vectors on a Drupal site.
Required action: Apply updates per vendor instructions.
CVE-2018-20753: Kaseya VSA Remote Code Execution Vulnerability
Kaseya · Virtual System/Server Administrator (VSA)
Kaseya VSA RMM allows unprivileged remote attackers to execute PowerShell payloads on all managed devices.
Required action: Apply updates per vendor instructions.
CVE-2015-5123: Adobe Flash Player Use-After-Free Vulnerability
Adobe · Flash Player
Use-after-free vulnerability in the BitmapData class in the ActionScript 3 (AS3) implementation in Adobe Flash Player allows remote attackers to execute code or cause a denial-of-service (DoS).
Required action: The impacted product is end-of-life and should be disconnected if still in use.
CVE-2015-5122: Adobe Flash Player Use-After-Free Vulnerability
Adobe · Flash Player
Use-after-free vulnerability in the DisplayObject class in the ActionScript 3 (AS3) implementation in Adobe Flash Player allows remote attackers to execute code or cause a denial-of-service (DoS).
Required action: The impacted product is end-of-life and should be disconnected if still in use.
CVE-2015-3113: Adobe Flash Player Heap-Based Buffer Overflow Vulnerability
Adobe · Flash Player
Heap-based buffer overflow vulnerability in Adobe Flash Player allows remote attackers to execute code.
Required action: The impacted product is end-of-life and should be disconnected if still in use.
CVE-2015-2502: Microsoft Internet Explorer Memory Corruption Vulnerability
Microsoft · Internet Explorer
Microsoft Internet Explorer contains a memory corruption vulnerability that allows an attacker to execute code or cause a denial-of-service (DoS).
Required action: Apply updates per vendor instructions.
CVE-2015-0313: Adobe Flash Player Use-After-Free Vulnerability
Adobe · Flash Player
Use-after-free vulnerability in Adobe Flash Player allows remote attackers to execute code.
Required action: The impacted product is end-of-life and should be disconnected if still in use.
CVE-2015-0311: Adobe Flash Player Remote Code Execution Vulnerability
Adobe · Flash Player
Unspecified vulnerability in Adobe Flash Player allows remote attackers to execute code.
Required action: The impacted product is end-of-life and should be disconnected if still in use.
CVE-2014-9163: Adobe Flash Player Stack-Based Buffer Overflow Vulnerability
Adobe · Flash Player
Stack-based buffer overflow in Adobe Flash Player allows attackers to execute code remotely.
Required action: The impacted product is end-of-life and should be disconnected if still in use.
CVE-2022-23176: WatchGuard Firebox and XTM Privilege Escalation Vulnerability
WatchGuard · Firebox and XTM
WatchGuard Firebox and XTM appliances allow a remote attacker with unprivileged credentials to access the system with a privileged management session via exposed management access.
Required action: Apply updates per vendor instructions.
CVE-2021-42287: Microsoft Active Directory Domain Services Privilege Escalation Vulnerability
Microsoft · Active Directory
Microsoft Active Directory Domain Services contains an unspecified vulnerability that allows for privilege escalation.
Required action: Apply updates per vendor instructions.
CVE-2021-42278: Microsoft Active Directory Domain Services Privilege Escalation Vulnerability
Microsoft · Active Directory
Microsoft Active Directory Domain Services contains an unspecified vulnerability that allows for privilege escalation.
Required action: Apply updates per vendor instructions.
CVE-2021-39793: Google Pixel Out-of-Bounds Write Vulnerability
Google · Pixel
Google Pixel contains a possible out-of-bounds write due to a logic error in the code that could lead to local escalation of privilege.
Required action: Apply updates per vendor instructions.
CVE-2021-27852: Checkbox Survey Deserialization of Untrusted Data Vulnerability
Checkbox · Checkbox Survey
Deserialization of Untrusted Data vulnerability in CheckboxWeb.dll of Checkbox Survey allows an unauthenticated remote attacker to execute arbitrary code.
Required action: Versions 6 and earlier for this product are end-of-life and must be removed from agency networks. Versions 7 and later are not considered vulnerable.
CVE-2021-22600: Linux Kernel Privilege Escalation Vulnerability
Linux · Kernel
Linux Kernel contains a flaw in the packet socket (AF_PACKET) implementation which could lead to incorrectly freeing memory. A local user could exploit this for denial-of-service (DoS) or possibly for privilege escalation.
Required action: Apply updates per vendor instructions.
CVE-2020-2509: QNAP Network-Attached Storage (NAS) Command Injection Vulnerability
QNAP · QNAP Network-Attached Storage (NAS)
QNAP NAS devices contain a command injection vulnerability which could allow attackers to perform remote code execution.
Required action: Apply updates per vendor instructions.
Complete fixed-window snapshot
CVEs — Past 48 Hours
All unique CVEs returned by NVD for the displayed UTC publication window. The snapshot is accepted only when its normalized unique-item count exactly equals the API totalResults value.
Entries 457–480 of 1,013
CVE-2026-17336
IBM API Connect [network address omitted] through [network address omitted] could allow a remote authenticated attacker to execute arbitrary SQL commands due to improper neutralization of special elements used in an SQL command.
CVE-2026-17335
IBM API Connect [network address omitted] through [network address omitted] could allow a remote authenticated attacker to execute arbitrary code due to path traversal. File paths in uploaded content are not sufficiently validated, which could allow files to be written outside the intended location and code…
CVE-2026-17334
IBM API Connect [network address omitted] through [network address omitted] could allow a remote authenticated attacker to obtain sensitive information due to improper authorization via user-controlled keys.
CVE-2026-17333
IBM API Connect [network address omitted] through [network address omitted] and [network address omitted] through [network address omitted] could allow a remote attacker to bypass authentication and inject unauthorized configuration changes due to improper certificate validation.
CVE-2026-17332
IBM API Connect [network address omitted] through [network address omitted] could allow a remote attacker to bypass security restrictions due to improper certificate validation.
CVE-2026-17331
IBM API Connect [network address omitted] through [network address omitted] could allow a remote attacker to read arbitrary files on the server due to external control of a file name or path.
CVE-2026-17330
IBM API Connect [network address omitted] through [network address omitted] could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery.
CVE-2026-17329
IBM API Connect [network address omitted] through [network address omitted] could allow a remote attacker to obtain sensitive information due to improper validation of endpoint URLs.
CVE-2026-17328
IBM API Connect [network address omitted] through [network address omitted] could allow a remote authenticated attacker to obtain sensitive information due to improper input validation. Input checks are incomplete, which could allow them to be bypassed.
CVE-2026-17327
IBM API Connect [network address omitted] through [network address omitted] could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery.
CVE-2026-17326
IBM API Connect [network address omitted] through [network address omitted] and [network address omitted] through [network address omitted] could allow a remote authenticated attacker to bypass security restrictions due to improper authentication.
CVE-2026-17325
IBM API Connect [network address omitted] through [network address omitted] could allow a remote authenticated attacker to obtain sensitive information due to improper validation of user-supplied URLs.
CVE-2026-17324
IBM API Connect [network address omitted] through [network address omitted] could allow a remote attacker to access sensitive configuration data and perform unauthorized actions due to missing authentication for a critical function.
CVE-2026-17323
IBM API Connect [network address omitted] through [network address omitted] could allow a remote attacker to obtain sensitive information due to XML external entity (XXE) injection.
CVE-2026-17322
IBM API Connect [network address omitted] through [network address omitted] and [network address omitted] through [network address omitted] could allow a local attacker to obtain sensitive credentials and compromise accounts due to insertion of sensitive information into log files.
CVE-2026-17321
IBM API Connect [network address omitted] through [network address omitted] could allow a remote authenticated attacker to delete or overwrite arbitrary control-plane assets due to an insecure direct object reference.
CVE-2026-17320
IBM API Connect [network address omitted] through [network address omitted] could allow a remote authenticated attacker to obtain sensitive information due to an insecure direct object reference.
CVE-2026-17319
IBM API Connect [network address omitted] through [network address omitted] could allow a remote authenticated attacker to modify tool configuration and cause a denial of service due to improper authorization. Information supplied by the client is relied on when deciding what a user is allowed to…
CVE-2026-17318
IBM API Connect [network address omitted] through [network address omitted] and [network address omitted] through [network address omitted] could allow a remote authenticated attacker to obtain sensitive information due to improper authorization.
CVE-2026-17317
IBM API Connect [network address omitted] through [network address omitted] could allow a remote authenticated attacker to access internal resources and cause a denial of service due to server-side request forgery.
CVE-2026-17316
IBM API Connect [network address omitted] through [network address omitted] could allow a remote attacker to perform server-side request forgery due to improper validation of user-supplied input.
CVE-2026-17315
IBM API Connect [network address omitted] through [network address omitted] could allow a remote attacker to obtain sensitive information due to improper validation of user-supplied URLs.
CVE-2026-17314
IBM API Connect [network address omitted] through [network address omitted] could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery.
CVE-2026-17313
IBM API Connect [network address omitted] through [network address omitted] could allow a remote attacker to obtain sensitive information and take control of gateway configuration due to authentication bypass via an alternate path.