Kythos AI vulnerability intelligence
Zero-Day Exploits / Vulnerabilities
A server-rendered, source-attributed view of confirmed CISA KEV entries and all NVD CVEs published in the rolling 48-hour UTC window.
Important distinction: CISA KEV means exploitation has been observed; it does not mean every entry was a zero-day. An NVD publication in the past 48 hours does not mean exploitation has occurred. Source records describe third-party products and do not identify Kythos AI customers, contracts, affiliations, or work history.
Confirmed exploitation intelligence
Zero-Day Exploits / Vulnerabilities
Complete CISA Known Exploited Vulnerabilities catalog, ordered by the date CISA added each entry. Every result is known to be exploited; entries are not necessarily zero-days.
Entries 1,129–1,152 of 1,769
CVE-2019-16057: D-Link DNS-320 Remote Code Execution Vulnerability
D-Link · DNS-320 Storage Device
The login_mgr.cgi script in D-Link DNS-320 is vulnerable to remote code execution.
Required action: The impacted product is end-of-life and should be disconnected if still in use.
CVE-2018-7841: Schneider Electric U.motion Builder SQL Injection Vulnerability
Schneider Electric · U.motion Builder
A SQL Injection vulnerability exists in U.motion Builder software which could cause unwanted code execution when an improper set of characters is entered.
Required action: The impacted product is end-of-life and should be disconnected if still in use.
CVE-2016-4523: Trihedral VTScada (formerly VTS) Denial-of-Service Vulnerability
Trihedral · VTScada (formerly VTS)
The WAP interface in Trihedral VTScada (formerly VTS) allows remote attackers to cause a denial-of-service (DoS).
Required action: Apply updates per vendor instructions.
CVE-2014-0780: InduSoft Web Studio NTWebServer Directory Traversal Vulnerability
InduSoft · Web Studio
InduSoft Web Studio NTWebServer contains a directory traversal vulnerability that allows remote attackers to read administrative passwords in APP files, allowing for remote code execution.
Required action: Apply updates per vendor instructions.
CVE-2010-5330: Ubiquiti AirOS Command Injection Vulnerability
Ubiquiti · AirOS
Certain Ubiquiti devices contain a command injection vulnerability via a GET request to stainfo.cgi.
Required action: Apply updates per vendor instructions.
CVE-2007-3010: Alcatel OmniPCX Enterprise Remote Code Execution Vulnerability
Alcatel · OmniPCX Enterprise
masterCGI in the Unified Maintenance Tool in Alcatel OmniPCX Enterprise Communication Server allows remote attackers to execute arbitrary commands.
Required action: Apply updates per vendor instructions.
CVE-2022-22954: VMware Workspace ONE Access and Identity Manager Server-Side Template Injection Vulnerability
VMware · Workspace ONE Access and Identity Manager
VMware Workspace ONE Access and Identity Manager allow for remote code execution due to server-side template injection.
Required action: Apply updates per vendor instructions.
CVE-2022-24521: Microsoft Windows CLFS Driver Privilege Escalation Vulnerability
Microsoft · Windows
Microsoft Windows Common Log File System (CLFS) Driver contains an unspecified vulnerability that allows for privilege escalation.
Required action: Apply updates per vendor instructions.
CVE-2018-7602: Drupal Core Remote Code Execution Vulnerability
Drupal · Core
A remote code execution vulnerability exists within multiple subsystems of Drupal that can allow attackers to exploit multiple attack vectors on a Drupal site.
Required action: Apply updates per vendor instructions.
CVE-2018-20753: Kaseya VSA Remote Code Execution Vulnerability
Kaseya · Virtual System/Server Administrator (VSA)
Kaseya VSA RMM allows unprivileged remote attackers to execute PowerShell payloads on all managed devices.
Required action: Apply updates per vendor instructions.
CVE-2015-5123: Adobe Flash Player Use-After-Free Vulnerability
Adobe · Flash Player
Use-after-free vulnerability in the BitmapData class in the ActionScript 3 (AS3) implementation in Adobe Flash Player allows remote attackers to execute code or cause a denial-of-service (DoS).
Required action: The impacted product is end-of-life and should be disconnected if still in use.
CVE-2015-5122: Adobe Flash Player Use-After-Free Vulnerability
Adobe · Flash Player
Use-after-free vulnerability in the DisplayObject class in the ActionScript 3 (AS3) implementation in Adobe Flash Player allows remote attackers to execute code or cause a denial-of-service (DoS).
Required action: The impacted product is end-of-life and should be disconnected if still in use.
CVE-2015-3113: Adobe Flash Player Heap-Based Buffer Overflow Vulnerability
Adobe · Flash Player
Heap-based buffer overflow vulnerability in Adobe Flash Player allows remote attackers to execute code.
Required action: The impacted product is end-of-life and should be disconnected if still in use.
CVE-2015-2502: Microsoft Internet Explorer Memory Corruption Vulnerability
Microsoft · Internet Explorer
Microsoft Internet Explorer contains a memory corruption vulnerability that allows an attacker to execute code or cause a denial-of-service (DoS).
Required action: Apply updates per vendor instructions.
CVE-2015-0313: Adobe Flash Player Use-After-Free Vulnerability
Adobe · Flash Player
Use-after-free vulnerability in Adobe Flash Player allows remote attackers to execute code.
Required action: The impacted product is end-of-life and should be disconnected if still in use.
CVE-2015-0311: Adobe Flash Player Remote Code Execution Vulnerability
Adobe · Flash Player
Unspecified vulnerability in Adobe Flash Player allows remote attackers to execute code.
Required action: The impacted product is end-of-life and should be disconnected if still in use.
CVE-2014-9163: Adobe Flash Player Stack-Based Buffer Overflow Vulnerability
Adobe · Flash Player
Stack-based buffer overflow in Adobe Flash Player allows attackers to execute code remotely.
Required action: The impacted product is end-of-life and should be disconnected if still in use.
CVE-2022-23176: WatchGuard Firebox and XTM Privilege Escalation Vulnerability
WatchGuard · Firebox and XTM
WatchGuard Firebox and XTM appliances allow a remote attacker with unprivileged credentials to access the system with a privileged management session via exposed management access.
Required action: Apply updates per vendor instructions.
CVE-2021-42287: Microsoft Active Directory Domain Services Privilege Escalation Vulnerability
Microsoft · Active Directory
Microsoft Active Directory Domain Services contains an unspecified vulnerability that allows for privilege escalation.
Required action: Apply updates per vendor instructions.
CVE-2021-42278: Microsoft Active Directory Domain Services Privilege Escalation Vulnerability
Microsoft · Active Directory
Microsoft Active Directory Domain Services contains an unspecified vulnerability that allows for privilege escalation.
Required action: Apply updates per vendor instructions.
CVE-2021-39793: Google Pixel Out-of-Bounds Write Vulnerability
Google · Pixel
Google Pixel contains a possible out-of-bounds write due to a logic error in the code that could lead to local escalation of privilege.
Required action: Apply updates per vendor instructions.
CVE-2021-27852: Checkbox Survey Deserialization of Untrusted Data Vulnerability
Checkbox · Checkbox Survey
Deserialization of Untrusted Data vulnerability in CheckboxWeb.dll of Checkbox Survey allows an unauthenticated remote attacker to execute arbitrary code.
Required action: Versions 6 and earlier for this product are end-of-life and must be removed from agency networks. Versions 7 and later are not considered vulnerable.
CVE-2021-22600: Linux Kernel Privilege Escalation Vulnerability
Linux · Kernel
Linux Kernel contains a flaw in the packet socket (AF_PACKET) implementation which could lead to incorrectly freeing memory. A local user could exploit this for denial-of-service (DoS) or possibly for privilege escalation.
Required action: Apply updates per vendor instructions.
CVE-2020-2509: QNAP Network-Attached Storage (NAS) Command Injection Vulnerability
QNAP · QNAP Network-Attached Storage (NAS)
QNAP NAS devices contain a command injection vulnerability which could allow attackers to perform remote code execution.
Required action: Apply updates per vendor instructions.
Complete fixed-window snapshot
CVEs — Past 48 Hours
All unique CVEs returned by NVD for the displayed UTC publication window. The snapshot is accepted only when its normalized unique-item count exactly equals the API totalResults value.
Entries 193–216 of 1,041
CVE-2026-123963
A security vulnerability has been detected in OpenBMB Internet of Agents up to 9d78e88e47160eb42ee1ee8538c05e1c2c47877a. The impacted element is the function register of the file im_server/app.py of the component Agent Registry. Such manipulation of the argument desc/name leads to missing authentication. The attack can be launched remotely.…
CVE-2026-123861
Authorization Bypass Through User-Controlled Key vulnerability in CrocoBlock JetFormBuilder – Hierarchical Select jet-form-builder-hierarchical-select allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects JetFormBuilder – Hierarchical Select: from n/a through 1.0.10.
CVE-2026-123860
Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Crocoblock JetFormBuilder jetformbuilder allows Code Injection.This issue affects JetFormBuilder: from n/a through 3.6.8.
CVE-2026-123483
Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Crocoblock JetFormBuilder jetformbuilder allows Code Injection.This issue affects JetFormBuilder: from n/a through 3.6.8.
CVE-2026-123477
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetEngine jet-engine allows Stored XSS.This issue affects JetEngine: from n/a through [network address omitted].
CVE-2026-123474
Missing Authorization vulnerability in LeapWorx Premium Blocks – Gutenberg Blocks for WordPress premium-blocks-for-gutenberg allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Premium Blocks – Gutenberg Blocks for WordPress: from n/a through 2.3.18.
CVE-2026-123467
Missing Authorization vulnerability in StylemixThemes Motors motors-car-dealership-classified-listings allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Motors: from n/a through 1.4.128.
CVE-2026-123462
Missing Authorization vulnerability in myCred myCred mycred allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects myCred: from n/a through 4.0.2.
CVE-2026-123183
Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in PluginUs.Net Active Products Tables for WooCommerce profit-products-tables-for-woocommerce allows Code Injection.This issue affects Active Products Tables for WooCommerce: from n/a through 2.1.6.
CVE-2026-122669
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Everest Forms Everest Forms everest-forms allows Stored XSS.This issue affects Everest Forms: from n/a through 3.6.3.
CVE-2026-122663
Missing Authorization vulnerability in VillaTheme CURCY woo-multi-currency allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects CURCY: from n/a through 2.2.20.
CVE-2026-122660
Missing Authorization vulnerability in BAKKBONE Australia FloristPress bakkbone-florist-companion allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects FloristPress: from n/a through 7.8.5.
CVE-2026-122659
Missing Authorization vulnerability in WP ManageNinja LLC Fluent Booking fluent-booking allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Fluent Booking: from n/a through 2.5.0.
CVE-2026-122041
The Checkout Field Editor for WooCommerce (Pro) plugin for WordPress is vulnerable to unauthorized deletion of arbitrary attachments due to a missing capability/ownership check in the ajax_remove_uploaded() function in versions up to, and including, 3.8.0. The handler is registered for both wp_ajax and wp_ajax_nopriv and is…
CVE-2026-121784
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Magepeople inc. WpBookingly service-booking-manager allows Stored XSS.This issue affects WpBookingly: from n/a through 1.4.3.
CVE-2026-121777
Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Cool Plugins Cool Formkit Lite extensions-for-elementor-form allows Code Injection.This issue affects Cool Formkit Lite: from n/a through 2.7.10.
CVE-2026-121775
Missing Authorization vulnerability in VillaTheme CURCY woo-multi-currency allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects CURCY: from n/a through 2.2.20.
CVE-2026-121579
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Unlimited Elements Unlimited Elements For Elementor (Free Widgets, Addons, Templates) unlimited-elements-for-elementor allows Stored XSS.This issue affects Unlimited Elements For Elementor (Free Widgets, Addons, Templates): from n/a through 2.0.26.
CVE-2026-121575
Missing Authorization vulnerability in WP User Manager WP User Manager wp-user-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP User Manager: from n/a through 2.10.4.
CVE-2026-120841
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Magepeople inc. WpTravelly tour-booking-manager allows PHP Local File Inclusion.This issue affects WpTravelly: from n/a through 2.3.8.
CVE-2026-120839
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Magepeople inc. WpTravelly tour-booking-manager allows PHP Local File Inclusion.This issue affects WpTravelly: from n/a through 2.3.8.
CVE-2026-120579
The Active Woot Products Tables for WooCommerce. 100% FREE plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'help_title' parameter in all versions up to, and including, 2.1.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with…
CVE-2026-119156
The Download Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'wpdm_reg[first_name], wpdm_reg[last_name], wpdm_reg[user_login]' parameter in all versions up to, and including, 7.5.9 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts…
CVE-2026-109973
The Image Hover Effects Ultimate Visual Composer (Flipbox – Awesomes Flip Boxes Image Overlay) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'flip-box-image-upload-url-01-alt' parameter in versions up to, and including, 3.1.1. This is due to the plugin saving the image-alt field through sanitize_text_field()…