Kythos AI vulnerability intelligence
Zero-Day Exploits / Vulnerabilities
A server-rendered, source-attributed view of confirmed CISA KEV entries and all NVD CVEs published in the rolling 48-hour UTC window.
Important distinction: CISA KEV means exploitation has been observed; it does not mean every entry was a zero-day. An NVD publication in the past 48 hours does not mean exploitation has occurred. Source records describe third-party products and do not identify Kythos AI customers, contracts, affiliations, or work history.
Confirmed exploitation intelligence
Zero-Day Exploits / Vulnerabilities
Complete CISA Known Exploited Vulnerabilities catalog, ordered by the date CISA added each entry. Every result is known to be exploited; entries are not necessarily zero-days.
Entries 1,129–1,152 of 1,769
CVE-2019-16057: D-Link DNS-320 Remote Code Execution Vulnerability
D-Link · DNS-320 Storage Device
The login_mgr.cgi script in D-Link DNS-320 is vulnerable to remote code execution.
Required action: The impacted product is end-of-life and should be disconnected if still in use.
CVE-2018-7841: Schneider Electric U.motion Builder SQL Injection Vulnerability
Schneider Electric · U.motion Builder
A SQL Injection vulnerability exists in U.motion Builder software which could cause unwanted code execution when an improper set of characters is entered.
Required action: The impacted product is end-of-life and should be disconnected if still in use.
CVE-2016-4523: Trihedral VTScada (formerly VTS) Denial-of-Service Vulnerability
Trihedral · VTScada (formerly VTS)
The WAP interface in Trihedral VTScada (formerly VTS) allows remote attackers to cause a denial-of-service (DoS).
Required action: Apply updates per vendor instructions.
CVE-2014-0780: InduSoft Web Studio NTWebServer Directory Traversal Vulnerability
InduSoft · Web Studio
InduSoft Web Studio NTWebServer contains a directory traversal vulnerability that allows remote attackers to read administrative passwords in APP files, allowing for remote code execution.
Required action: Apply updates per vendor instructions.
CVE-2010-5330: Ubiquiti AirOS Command Injection Vulnerability
Ubiquiti · AirOS
Certain Ubiquiti devices contain a command injection vulnerability via a GET request to stainfo.cgi.
Required action: Apply updates per vendor instructions.
CVE-2007-3010: Alcatel OmniPCX Enterprise Remote Code Execution Vulnerability
Alcatel · OmniPCX Enterprise
masterCGI in the Unified Maintenance Tool in Alcatel OmniPCX Enterprise Communication Server allows remote attackers to execute arbitrary commands.
Required action: Apply updates per vendor instructions.
CVE-2022-22954: VMware Workspace ONE Access and Identity Manager Server-Side Template Injection Vulnerability
VMware · Workspace ONE Access and Identity Manager
VMware Workspace ONE Access and Identity Manager allow for remote code execution due to server-side template injection.
Required action: Apply updates per vendor instructions.
CVE-2022-24521: Microsoft Windows CLFS Driver Privilege Escalation Vulnerability
Microsoft · Windows
Microsoft Windows Common Log File System (CLFS) Driver contains an unspecified vulnerability that allows for privilege escalation.
Required action: Apply updates per vendor instructions.
CVE-2018-7602: Drupal Core Remote Code Execution Vulnerability
Drupal · Core
A remote code execution vulnerability exists within multiple subsystems of Drupal that can allow attackers to exploit multiple attack vectors on a Drupal site.
Required action: Apply updates per vendor instructions.
CVE-2018-20753: Kaseya VSA Remote Code Execution Vulnerability
Kaseya · Virtual System/Server Administrator (VSA)
Kaseya VSA RMM allows unprivileged remote attackers to execute PowerShell payloads on all managed devices.
Required action: Apply updates per vendor instructions.
CVE-2015-5123: Adobe Flash Player Use-After-Free Vulnerability
Adobe · Flash Player
Use-after-free vulnerability in the BitmapData class in the ActionScript 3 (AS3) implementation in Adobe Flash Player allows remote attackers to execute code or cause a denial-of-service (DoS).
Required action: The impacted product is end-of-life and should be disconnected if still in use.
CVE-2015-5122: Adobe Flash Player Use-After-Free Vulnerability
Adobe · Flash Player
Use-after-free vulnerability in the DisplayObject class in the ActionScript 3 (AS3) implementation in Adobe Flash Player allows remote attackers to execute code or cause a denial-of-service (DoS).
Required action: The impacted product is end-of-life and should be disconnected if still in use.
CVE-2015-3113: Adobe Flash Player Heap-Based Buffer Overflow Vulnerability
Adobe · Flash Player
Heap-based buffer overflow vulnerability in Adobe Flash Player allows remote attackers to execute code.
Required action: The impacted product is end-of-life and should be disconnected if still in use.
CVE-2015-2502: Microsoft Internet Explorer Memory Corruption Vulnerability
Microsoft · Internet Explorer
Microsoft Internet Explorer contains a memory corruption vulnerability that allows an attacker to execute code or cause a denial-of-service (DoS).
Required action: Apply updates per vendor instructions.
CVE-2015-0313: Adobe Flash Player Use-After-Free Vulnerability
Adobe · Flash Player
Use-after-free vulnerability in Adobe Flash Player allows remote attackers to execute code.
Required action: The impacted product is end-of-life and should be disconnected if still in use.
CVE-2015-0311: Adobe Flash Player Remote Code Execution Vulnerability
Adobe · Flash Player
Unspecified vulnerability in Adobe Flash Player allows remote attackers to execute code.
Required action: The impacted product is end-of-life and should be disconnected if still in use.
CVE-2014-9163: Adobe Flash Player Stack-Based Buffer Overflow Vulnerability
Adobe · Flash Player
Stack-based buffer overflow in Adobe Flash Player allows attackers to execute code remotely.
Required action: The impacted product is end-of-life and should be disconnected if still in use.
CVE-2022-23176: WatchGuard Firebox and XTM Privilege Escalation Vulnerability
WatchGuard · Firebox and XTM
WatchGuard Firebox and XTM appliances allow a remote attacker with unprivileged credentials to access the system with a privileged management session via exposed management access.
Required action: Apply updates per vendor instructions.
CVE-2021-42287: Microsoft Active Directory Domain Services Privilege Escalation Vulnerability
Microsoft · Active Directory
Microsoft Active Directory Domain Services contains an unspecified vulnerability that allows for privilege escalation.
Required action: Apply updates per vendor instructions.
CVE-2021-42278: Microsoft Active Directory Domain Services Privilege Escalation Vulnerability
Microsoft · Active Directory
Microsoft Active Directory Domain Services contains an unspecified vulnerability that allows for privilege escalation.
Required action: Apply updates per vendor instructions.
CVE-2021-39793: Google Pixel Out-of-Bounds Write Vulnerability
Google · Pixel
Google Pixel contains a possible out-of-bounds write due to a logic error in the code that could lead to local escalation of privilege.
Required action: Apply updates per vendor instructions.
CVE-2021-27852: Checkbox Survey Deserialization of Untrusted Data Vulnerability
Checkbox · Checkbox Survey
Deserialization of Untrusted Data vulnerability in CheckboxWeb.dll of Checkbox Survey allows an unauthenticated remote attacker to execute arbitrary code.
Required action: Versions 6 and earlier for this product are end-of-life and must be removed from agency networks. Versions 7 and later are not considered vulnerable.
CVE-2021-22600: Linux Kernel Privilege Escalation Vulnerability
Linux · Kernel
Linux Kernel contains a flaw in the packet socket (AF_PACKET) implementation which could lead to incorrectly freeing memory. A local user could exploit this for denial-of-service (DoS) or possibly for privilege escalation.
Required action: Apply updates per vendor instructions.
CVE-2020-2509: QNAP Network-Attached Storage (NAS) Command Injection Vulnerability
QNAP · QNAP Network-Attached Storage (NAS)
QNAP NAS devices contain a command injection vulnerability which could allow attackers to perform remote code execution.
Required action: Apply updates per vendor instructions.
Complete fixed-window snapshot
CVEs — Past 48 Hours
All unique CVEs returned by NVD for the displayed UTC publication window. The snapshot is accepted only when its normalized unique-item count exactly equals the API totalResults value.
Entries 961–984 of 1,041
CVE-2026-123299
In JetBrains Hub before 2026.2.52519 information disclosure via user search queries was possible
CVE-2026-123298
In JetBrains Hub before 2026.2.52556 sMTP command injection via email verification was possible
CVE-2026-123297
In JetBrains Hub before 2026.2.52519 two-factor authentication bypass was possible via the password reset flow
CVE-2026-123296
In JetBrains Hub before 2026.2.52519 privilege escalation via forged email verification was possible
CVE-2026-123295
In JetBrains Hub before 2026.2.52519 enforced two-factor authentication could be disabled via the profile update endpoint
CVE-2026-123294
In JetBrains Hub before 2026.2.52556 privilege escalation was possible by changing email authentication details during the verification flow
CVE-2026-123293
In JetBrains IntelliJ IDEA before 2026.3, 2026.2.4 code execution was possible in untrusted projects via the Terraform tool path setting
CVE-2026-123292
In JetBrains Datalore before 2026.4 aPI tokens and sessions of removed or banned users remained valid
CVE-2026-123291
In JetBrains Datalore before 2026.4 improper owner validation allowed reading another workspace's issues and runs notebook
CVE-2026-123290
In JetBrains Datalore before 2026.4 hidden notebook code was exposed to unauthenticated users via the public interactive report content endpoint
CVE-2026-123289
In JetBrains Datalore before 2026.4 improper authorisation allowed notebook viewers to modify files
CVE-2026-123288
In JetBrains Datalore before 2026.4 stored XSS in notebook charts was possible via Vega editor link
CVE-2026-123287
In JetBrains Datalore before 2026.4 private notebook files could be downloaded without authentication via published interactive reports
CVE-2026-123286
In JetBrains Datalore before 2026.4 improper authorisation allowed read the notebook owner's file storage session token
CVE-2026-123285
In JetBrains Datalore before 2026.3 command execution was possible in the database task container via JVM options injection
CVE-2026-123284
In JetBrains Datalore before 2026.4 improper authorisation on workspace moves allowed view-only collaborators to modify shared content
CVE-2026-123283
In JetBrains Datalore before 2026.4 account takeover was possible via SSO sign-in to a pre-registered account
CVE-2026-123282
In JetBrains Datalore before 2026.4 missing expiration validation of account tokens allowed a new authenticated session
CVE-2026-123281
In JetBrains Datalore before 2026.4 notebook code could execute commands in the sidecar container via the mount broker
CVE-2026-123280
In JetBrains Datalore before 2026.2.4 unauthenticated users could execute code via published interactive reports
CVE-2026-123279
In JetBrains Datalore before 2026.4 code execution was possible in a notebook's computation by view-only collaborators
CVE-2026-123278
In JetBrains IntelliJ IDEA before 2026.3 code execution was possible via the unauthenticated JDBC worker RMI endpoint
CVE-2026-123277
In JetBrains CLion before 2026.3, 2026.2.4.1 missing authentication allowed local users to obtain the debug session environment on Linux
CVE-2026-123276
In JetBrains CLion before 2026.3, 2026.2.4.1 code execution was possible in Safe Mode via a crafted GDB server debug profile