Kythos AI vulnerability intelligence

Zero-Day Exploits / Vulnerabilities

A server-rendered, source-attributed view of confirmed CISA KEV entries and all NVD CVEs published in the rolling 48-hour UTC window.

Important distinction: CISA KEV means exploitation has been observed; it does not mean every entry was a zero-day. An NVD publication in the past 48 hours does not mean exploitation has occurred. Source records describe third-party products and do not identify Kythos AI customers, contracts, affiliations, or work history.

CISA KEV catalog NVD 48-hour CVEs Kythos AI RSS feed

Confirmed exploitation intelligence

Zero-Day Exploits / Vulnerabilities

Complete CISA Known Exploited Vulnerabilities catalog, ordered by the date CISA added each entry. Every result is known to be exploited; entries are not necessarily zero-days.

Current snapshot

Entries 1,129–1,152 of 1,768

CISA KEVAdded Apr 15, 2022

CVE-2018-7841: Schneider Electric U.motion Builder SQL Injection Vulnerability

Schneider Electric · U.motion Builder

A SQL Injection vulnerability exists in U.motion Builder software which could cause unwanted code execution when an improper set of characters is entered.

Federal remediation due May 6, 2022Ransomware use: Not confirmed by CISA

Required action: The impacted product is end-of-life and should be disconnected if still in use.

View in the CISA KEV catalog →

CISA KEVAdded Apr 15, 2022

CVE-2016-4523: Trihedral VTScada (formerly VTS) Denial-of-Service Vulnerability

Trihedral · VTScada (formerly VTS)

The WAP interface in Trihedral VTScada (formerly VTS) allows remote attackers to cause a denial-of-service (DoS).

Federal remediation due May 6, 2022Ransomware use: Not confirmed by CISA

Required action: Apply updates per vendor instructions.

View in the CISA KEV catalog →

CISA KEVAdded Apr 15, 2022

CVE-2014-0780: InduSoft Web Studio NTWebServer Directory Traversal Vulnerability

InduSoft · Web Studio

InduSoft Web Studio NTWebServer contains a directory traversal vulnerability that allows remote attackers to read administrative passwords in APP files, allowing for remote code execution.

Federal remediation due May 6, 2022Ransomware use: Not confirmed by CISA

Required action: Apply updates per vendor instructions.

View in the CISA KEV catalog →

CISA KEVAdded Apr 15, 2022

CVE-2010-5330: Ubiquiti AirOS Command Injection Vulnerability

Ubiquiti · AirOS

Certain Ubiquiti devices contain a command injection vulnerability via a GET request to stainfo.cgi.

Federal remediation due May 6, 2022Ransomware use: Not confirmed by CISA

Required action: Apply updates per vendor instructions.

View in the CISA KEV catalog →

CISA KEVAdded Apr 15, 2022

CVE-2007-3010: Alcatel OmniPCX Enterprise Remote Code Execution Vulnerability

Alcatel · OmniPCX Enterprise

masterCGI in the Unified Maintenance Tool in Alcatel OmniPCX Enterprise Communication Server allows remote attackers to execute arbitrary commands.

Federal remediation due May 6, 2022Ransomware use: Not confirmed by CISA

Required action: Apply updates per vendor instructions.

View in the CISA KEV catalog →

CISA KEVAdded Apr 14, 2022

CVE-2022-22954: VMware Workspace ONE Access and Identity Manager Server-Side Template Injection Vulnerability

VMware · Workspace ONE Access and Identity Manager

VMware Workspace ONE Access and Identity Manager allow for remote code execution due to server-side template injection.

Federal remediation due May 5, 2022Ransomware use: Known

Required action: Apply updates per vendor instructions.

View in the CISA KEV catalog →

CISA KEVAdded Apr 13, 2022

CVE-2022-24521: Microsoft Windows CLFS Driver Privilege Escalation Vulnerability

Microsoft · Windows

Microsoft Windows Common Log File System (CLFS) Driver contains an unspecified vulnerability that allows for privilege escalation.

Federal remediation due May 4, 2022Ransomware use: Known

Required action: Apply updates per vendor instructions.

View in the CISA KEV catalog →

CISA KEVAdded Apr 13, 2022

CVE-2018-7602: Drupal Core Remote Code Execution Vulnerability

Drupal · Core

A remote code execution vulnerability exists within multiple subsystems of Drupal that can allow attackers to exploit multiple attack vectors on a Drupal site.

Federal remediation due May 4, 2022Ransomware use: Known

Required action: Apply updates per vendor instructions.

View in the CISA KEV catalog →

CISA KEVAdded Apr 13, 2022

CVE-2018-20753: Kaseya VSA Remote Code Execution Vulnerability

Kaseya · Virtual System/Server Administrator (VSA)

Kaseya VSA RMM allows unprivileged remote attackers to execute PowerShell payloads on all managed devices.

Federal remediation due May 4, 2022Ransomware use: Known

Required action: Apply updates per vendor instructions.

View in the CISA KEV catalog →

CISA KEVAdded Apr 13, 2022

CVE-2015-5123: Adobe Flash Player Use-After-Free Vulnerability

Adobe · Flash Player

Use-after-free vulnerability in the BitmapData class in the ActionScript 3 (AS3) implementation in Adobe Flash Player allows remote attackers to execute code or cause a denial-of-service (DoS).

Federal remediation due May 4, 2022Ransomware use: Not confirmed by CISA

Required action: The impacted product is end-of-life and should be disconnected if still in use.

View in the CISA KEV catalog →

CISA KEVAdded Apr 13, 2022

CVE-2015-5122: Adobe Flash Player Use-After-Free Vulnerability

Adobe · Flash Player

Use-after-free vulnerability in the DisplayObject class in the ActionScript 3 (AS3) implementation in Adobe Flash Player allows remote attackers to execute code or cause a denial-of-service (DoS).

Federal remediation due May 4, 2022Ransomware use: Not confirmed by CISA

Required action: The impacted product is end-of-life and should be disconnected if still in use.

View in the CISA KEV catalog →

CISA KEVAdded Apr 13, 2022

CVE-2015-3113: Adobe Flash Player Heap-Based Buffer Overflow Vulnerability

Adobe · Flash Player

Heap-based buffer overflow vulnerability in Adobe Flash Player allows remote attackers to execute code.

Federal remediation due May 4, 2022Ransomware use: Not confirmed by CISA

Required action: The impacted product is end-of-life and should be disconnected if still in use.

View in the CISA KEV catalog →

CISA KEVAdded Apr 13, 2022

CVE-2015-2502: Microsoft Internet Explorer Memory Corruption Vulnerability

Microsoft · Internet Explorer

Microsoft Internet Explorer contains a memory corruption vulnerability that allows an attacker to execute code or cause a denial-of-service (DoS).

Federal remediation due May 4, 2022Ransomware use: Not confirmed by CISA

Required action: Apply updates per vendor instructions.

View in the CISA KEV catalog →

CISA KEVAdded Apr 13, 2022

CVE-2015-0313: Adobe Flash Player Use-After-Free Vulnerability

Adobe · Flash Player

Use-after-free vulnerability in Adobe Flash Player allows remote attackers to execute code.

Federal remediation due May 4, 2022Ransomware use: Not confirmed by CISA

Required action: The impacted product is end-of-life and should be disconnected if still in use.

View in the CISA KEV catalog →

CISA KEVAdded Apr 13, 2022

CVE-2015-0311: Adobe Flash Player Remote Code Execution Vulnerability

Adobe · Flash Player

Unspecified vulnerability in Adobe Flash Player allows remote attackers to execute code.

Federal remediation due May 4, 2022Ransomware use: Not confirmed by CISA

Required action: The impacted product is end-of-life and should be disconnected if still in use.

View in the CISA KEV catalog →

CISA KEVAdded Apr 13, 2022

CVE-2014-9163: Adobe Flash Player Stack-Based Buffer Overflow Vulnerability

Adobe · Flash Player

Stack-based buffer overflow in Adobe Flash Player allows attackers to execute code remotely.

Federal remediation due May 4, 2022Ransomware use: Not confirmed by CISA

Required action: The impacted product is end-of-life and should be disconnected if still in use.

View in the CISA KEV catalog →

CISA KEVAdded Apr 11, 2022

CVE-2022-23176: WatchGuard Firebox and XTM Privilege Escalation Vulnerability

WatchGuard · Firebox and XTM

WatchGuard Firebox and XTM appliances allow a remote attacker with unprivileged credentials to access the system with a privileged management session via exposed management access.

Federal remediation due May 2, 2022Ransomware use: Not confirmed by CISA

Required action: Apply updates per vendor instructions.

View in the CISA KEV catalog →

CISA KEVAdded Apr 11, 2022

CVE-2021-42287: Microsoft Active Directory Domain Services Privilege Escalation Vulnerability

Microsoft · Active Directory

Microsoft Active Directory Domain Services contains an unspecified vulnerability that allows for privilege escalation.

Federal remediation due May 2, 2022Ransomware use: Known

Required action: Apply updates per vendor instructions.

View in the CISA KEV catalog →

CISA KEVAdded Apr 11, 2022

CVE-2021-42278: Microsoft Active Directory Domain Services Privilege Escalation Vulnerability

Microsoft · Active Directory

Microsoft Active Directory Domain Services contains an unspecified vulnerability that allows for privilege escalation.

Federal remediation due May 2, 2022Ransomware use: Known

Required action: Apply updates per vendor instructions.

View in the CISA KEV catalog →

CISA KEVAdded Apr 11, 2022

CVE-2021-39793: Google Pixel Out-of-Bounds Write Vulnerability

Google · Pixel

Google Pixel contains a possible out-of-bounds write due to a logic error in the code that could lead to local escalation of privilege.

Federal remediation due May 2, 2022Ransomware use: Not confirmed by CISA

Required action: Apply updates per vendor instructions.

View in the CISA KEV catalog →

CISA KEVAdded Apr 11, 2022

CVE-2021-27852: Checkbox Survey Deserialization of Untrusted Data Vulnerability

Checkbox · Checkbox Survey

Deserialization of Untrusted Data vulnerability in CheckboxWeb.dll of Checkbox Survey allows an unauthenticated remote attacker to execute arbitrary code.

Federal remediation due May 2, 2022Ransomware use: Not confirmed by CISA

Required action: Versions 6 and earlier for this product are end-of-life and must be removed from agency networks. Versions 7 and later are not considered vulnerable.

View in the CISA KEV catalog →

CISA KEVAdded Apr 11, 2022

CVE-2021-22600: Linux Kernel Privilege Escalation Vulnerability

Linux · Kernel

Linux Kernel contains a flaw in the packet socket (AF_PACKET) implementation which could lead to incorrectly freeing memory. A local user could exploit this for denial-of-service (DoS) or possibly for privilege escalation.

Federal remediation due May 2, 2022Ransomware use: Not confirmed by CISA

Required action: Apply updates per vendor instructions.

View in the CISA KEV catalog →

CISA KEVAdded Apr 11, 2022

CVE-2020-2509: QNAP Network-Attached Storage (NAS) Command Injection Vulnerability

QNAP · QNAP Network-Attached Storage (NAS)

QNAP NAS devices contain a command injection vulnerability which could allow attackers to perform remote code execution.

Federal remediation due May 2, 2022Ransomware use: Not confirmed by CISA

Required action: Apply updates per vendor instructions.

View in the CISA KEV catalog →

CISA KEVAdded Apr 11, 2022

CVE-2017-11317: Telerik UI for ASP.NET AJAX Unrestricted File Upload Vulnerability

Telerik · User Interface (UI) for ASP.NET AJAX

Telerik.Web.UI in Progress Telerik UI for ASP.NET AJAX allows remote attackers to perform arbitrary file uploads or execute arbitrary code.

Federal remediation due May 2, 2022Ransomware use: Not confirmed by CISA

Required action: Apply updates per vendor instructions.

View in the CISA KEV catalog →

Source: Official CISA KEV JSONCatalog released Nov 4, 2026, 8:00 PM GMT+0000Site snapshot: Nov 6, 2026, 7:47 AM GMT+0000Showing 24 of 1,768Source text normalized: network addresses and restricted context omittedRefresh interval: 30 minutes

Complete fixed-window snapshot

CVEs — Past 48 Hours

All unique CVEs returned by NVD for the displayed UTC publication window. The snapshot is accepted only when its normalized unique-item count exactly equals the API totalResults value.

Current snapshot

Entries 481–504 of 1,025