Kythos AI vulnerability intelligence
Zero-Day Exploits / Vulnerabilities
A server-rendered, source-attributed view of confirmed CISA KEV entries and all NVD CVEs published in the rolling 48-hour UTC window.
Important distinction: CISA KEV means exploitation has been observed; it does not mean every entry was a zero-day. An NVD publication in the past 48 hours does not mean exploitation has occurred. Source records describe third-party products and do not identify Kythos AI customers, contracts, affiliations, or work history.
Confirmed exploitation intelligence
Zero-Day Exploits / Vulnerabilities
Complete CISA Known Exploited Vulnerabilities catalog, ordered by the date CISA added each entry. Every result is known to be exploited; entries are not necessarily zero-days.
Entries 1,153–1,176 of 1,768
CVE-2021-3156: Sudo Heap-Based Buffer Overflow Vulnerability
Sudo · Sudo
Sudo contains an off-by-one error that can result in a heap-based buffer overflow, which allows for privilege escalation.
Required action: Apply updates per vendor instructions.
CVE-2021-31166: Microsoft HTTP Protocol Stack Remote Code Execution Vulnerability
Microsoft · HTTP Protocol Stack
Microsoft HTTP Protocol Stack contains a vulnerability in http.sys that allows for remote code execution.
Required action: Apply updates per vendor instructions.
CVE-2017-0148: Microsoft SMBv1 Server Remote Code Execution Vulnerability
Microsoft · SMBv1 server
The SMBv1 server in Microsoft allows remote attackers to execute arbitrary code via crafted packets.
Required action: Apply updates per vendor instructions.
CVE-2022-22965: Spring Framework JDK 9+ Remote Code Execution Vulnerability
VMware · Spring Framework
Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data binding.
Required action: Apply updates per vendor instructions.
CVE-2022-22675: Apple macOS Out-of-Bounds Write Vulnerability
Apple · macOS
macOS Monterey contains an out-of-bounds write vulnerability that could allow an application to execute arbitrary code with kernel privileges.
Required action: Apply updates per vendor instructions.
CVE-2022-22674: Apple macOS Out-of-Bounds Read Vulnerability
Apple · macOS
macOS Monterey contains an out-of-bounds read vulnerability that could allow an application to read kernel memory.
Required action: Apply updates per vendor instructions.
CVE-2021-45382: D-Link Multiple Routers Remote Code Execution Vulnerability
D-Link · Multiple Routers
A remote code execution vulnerability exists in all series H/W revisions routers via the DDNS function in ncc2 binary file.
Required action: The impacted product is end-of-life and should be disconnected if still in use.
CVE-2022-26871: Trend Micro Apex Central Arbitrary File Upload Vulnerability
Trend Micro · Apex Central
An arbitrary file upload vulnerability in Trend Micro Apex Central could allow for remote code execution.
Required action: Apply updates per vendor instructions.
CVE-2022-1040: Sophos Firewall Authentication Bypass Vulnerability
Sophos · Firewall
An authentication bypass vulnerability in User Portal and Webadmin of Sophos Firewall allows for remote code execution.
Required action: Apply updates per vendor instructions.
CVE-2021-34484: Microsoft Windows User Profile Service Privilege Escalation Vulnerability
Microsoft · Windows
Microsoft Windows User Profile Service contains an unspecified vulnerability that allows for privilege escalation.
Required action: Apply updates per vendor instructions.
CVE-2021-28799: QNAP NAS Improper Authorization Vulnerability
QNAP · Network Attached Storage (NAS)
QNAP NAS running HBS 3 contains an improper authorization vulnerability which can allow remote attackers to log in to a device.
Required action: Apply updates per vendor instructions.
CVE-2021-21551: Dell dbutil Driver Insufficient Access Control Vulnerability
Dell · dbutil Driver
Dell dbutil driver contains an insufficient access control vulnerability which may lead to escalation of privileges, denial-of-service (DoS), or information disclosure.
Required action: Apply updates per vendor instructions.
CVE-2018-10562: Dasan GPON Routers Command Injection Vulnerability
Dasan · Gigabit Passive Optical Network (GPON) Routers
Dasan GPON Routers contain an authentication bypass vulnerability. When combined with CVE-2018-10561, exploitation can allow an attacker to perform remote code execution.
Required action: The impacted product is end-of-life and should be disconnected if still in use.
CVE-2018-10561: Dasan GPON Routers Authentication Bypass Vulnerability
Dasan · Gigabit Passive Optical Network (GPON) Routers
Dasan GPON Routers contain an authentication bypass vulnerability. When combined with CVE-2018-10562, exploitation can allow an attacker to perform remote code execution.
Required action: The impacted product is end-of-life and should be disconnected if still in use.
CVE-2022-1096: Google Chromium V8 Type Confusion Vulnerability
Google · Chromium V8
Google Chromium V8 Engine contains a type confusion vulnerability that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft…
Required action: Apply updates per vendor instructions.
CVE-2022-0543: Debian-specific Redis Server Lua Sandbox Escape Vulnerability
Redis · Debian-specific Redis Servers
Redis is prone to a (Debian-specific) Lua sandbox escape, which could result in remote code execution.
Required action: Apply updates per vendor instructions.
CVE-2021-38646: Microsoft Office Access Connectivity Engine Remote Code Execution Vulnerability
Microsoft · Office
Microsoft Office Access Connectivity Engine contains an unspecified vulnerability which can allow for remote code execution.
Required action: Apply updates per vendor instructions.
CVE-2021-34486: Microsoft Windows Event Tracing Privilege Escalation Vulnerability
Microsoft · Windows
Microsoft Windows Event Tracing contains an unspecified vulnerability which can allow for privilege escalation.
Required action: Apply updates per vendor instructions.
CVE-2021-26085: Atlassian Confluence Server Pre-Authorization Arbitrary File Read Vulnerability
Atlassian · Confluence Server
Affected versions of Atlassian Confluence Server allow remote attackers to view restricted resources via a pre-authorization arbitrary file read vulnerability in the /s/ endpoint.
Required action: Apply updates per vendor instructions.
CVE-2021-20028: SonicWall Secure Remote Access (SRA) SQL Injection Vulnerability
SonicWall · Secure Remote Access (SRA)
SonicWall Secure Remote Access (SRA) products contain an improper neutralization of a SQL Command leading to SQL injection.
Required action: The impacted product is end-of-life and should be disconnected if still in use.
CVE-2019-7483: SonicWall SMA100 Directory Traversal Vulnerability
SonicWall · SMA100
In SonicWall SMA100, an unauthenticated Directory Traversal vulnerability in the handleWAFRedirect CGI allows the user to test for the presence of a file on the server.
Required action: Apply updates per vendor instructions.
CVE-2018-8440: Microsoft Windows Privilege Escalation Vulnerability
Microsoft · Windows
An elevation of privilege vulnerability exists when Windows improperly handles calls to Advanced Local Procedure Call (ALPC).
Required action: Apply updates per vendor instructions.
CVE-2018-8406: Microsoft DirectX Graphics Kernel Privilege Escalation Vulnerability
Microsoft · DirectX Graphics Kernel (DXGKRNL)
An elevation of privilege vulnerability exists when the DirectX Graphics Kernel (DXGKRNL) driver improperly handles objects in memory.
Required action: Apply updates per vendor instructions.
CVE-2018-8405: Microsoft DirectX Graphics Kernel Privilege Escalation Vulnerability
Microsoft · DirectX Graphics Kernel (DXGKRNL)
An elevation of privilege vulnerability exists when the DirectX Graphics Kernel (DXGKRNL) driver improperly handles objects in memory.
Required action: Apply updates per vendor instructions.
Complete fixed-window snapshot
CVEs — Past 48 Hours
All unique CVEs returned by NVD for the displayed UTC publication window. The snapshot is accepted only when its normalized unique-item count exactly equals the API totalResults value.
Entries 577–600 of 1,033
CVE-2026-90965
The Essential Real Estate WordPress plugin before 5.3.5 does not perform a publication-status or authorization check in two of its AJAX actions, allowing unauthenticated users to retrieve the images attached to property listings that have not been published.
CVE-2026-90964
The Essential Real Estate WordPress plugin before 5.3.5 does not restrict the recipient of one of its contact email actions, allowing unauthenticated users to send emails to arbitrary addresses with an attacker-controlled sender header and message body through the site.
CVE-2026-90963
The Essential Real Estate WordPress plugin before 5.3.5 does not perform any authorization or publication-status check in one of its AJAX actions, allowing unauthenticated users to read the full contents of property listings that have not been published, together with the private name, email address, phone…
CVE-2026-88814
The YITH WooCommerce Gift Cards WordPress plugin before 4.38.1 does not lock or atomically update a gift card's balance when it is redeemed at checkout, allowing an attacker who holds a gift card code to spend more than its funded value by submitting multiple checkouts for…
CVE-2026-87856
The Subscriptions for WooCommerce WordPress plugin before 2.1.1 only enforces its membership content restrictions on standard front-end page views, allowing unauthenticated users to read the full contents of restricted posts and pages through other routes that render the same content.
CVE-2026-86795
The Community Events WordPress plugin before 1.6.0 does not have authorisation or nonce checks in one of its AJAX actions, allowing unauthenticated users to retrieve details of event submissions awaiting moderation, which are not available anywhere on the public site.
CVE-2026-86442
The WP Event Manager WordPress plugin before 3.4.2 does not verify the ownership or the post type of a user supplied post identifier in its front-end event submission flow, allowing unauthenticated attackers to read and overwrite the content of arbitrary unpublished posts and pages, and to…
CVE-2026-85570
The Tutor LMS WordPress plugin before 4.2.0 does not prevent the correct answers to quiz questions from being included in the page it serves to the student taking the quiz, and does so regardless of the setting intended to control whether answers are revealed, allowing any…
CVE-2026-85351
The FV Flowplayer Video Player WordPress plugin before 7.5.56.7212 does not validate a user-supplied URL before performing a server-side fetch whose response body is stored and served publicly, allowing users with Contributor-level access and above to perform Server-Side Request Forgery (SSRF) attacks and to read the…
CVE-2026-85347
The FV Flowplayer Video Player WordPress plugin before 7.5.56.7212 does not sanitize and escape a user-supplied value before outputting it in a page, which could allow users with the Contributor role and above to inject arbitrary web scripts that execute when a higher-privileged user views the…
CVE-2026-85346
The FV Flowplayer Video Player WordPress plugin before 7.5.56.7212 does not perform authorization or CSRF checks on several of its cloud storage media browser handlers, allowing any authenticated user with minimal permissions (such as Subscriber) to disclose the configuration and stored file listings of the site's…
CVE-2026-19256
The All In One Login WordPress plugin before 2.5.0 does not adequately restrict the number of attempts that can be made against the short numeric code used by its default-enabled passwordless email login, and does not feed those failed attempts into its own brute-force protection, allowing…
CVE-2026-16304
The WP Event Manager WordPress plugin before 3.4.2 does not properly validate ownership or the type of the user-supplied post identifiers processed by one of its frontend forms, allowing any user with a Subscriber account or above to reassign the authorship of arbitrary posts to themselves…
CVE-2026-123014
iTerm2 before 3.7.7beta2 has an argument injection vulnerability in the x-man-page: URL handler, allowing an attacker to execute arbitrary commands with the privileges of the logged-in user by inducing the user to open a crafted URL in iTerm2. Percent-encoded NUL characters survive input sanitization and are…
CVE-2026-109150
The WP PageNavi Style WordPress plugin through 1.4 does not sanitise and escape some of its settings, and has no CSRF check when they are saved, which could allow attackers to make a logged-in administrator store arbitrary JavaScript via a CSRF attack that is then executed…
CVE-2026-107787
The CatFolders WordPress plugin before 2.5.7 does not have authorisation checks on a folder maintenance action, allowing users with a role as low as subscriber to reset the per-user ownership of every media folder and disable the CatFolders WordPress plugin before 2.5.7's user restriction setting.
CVE-2026-107786
The CatFolders WordPress plugin before 2.5.7 does not properly sanitize and escape a user-controlled sort setting before using it in a SQL query, allowing authenticated users with upload capability (Author and above) to perform SQL injection attacks.
CVE-2026-107775
The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution WordPress plugin before 5.3.3 does not verify that the acting administrator is authorized to manage each selected user before enabling that user's marketplace seller status, allowing a subsite Administrator on WordPress Multisite to enable selling for users outside…
CVE-2026-107774
The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution WordPress plugin before 5.3.3 does not use a trusted site-owned sender address when relaying its store contact form, instead placing the unauthenticated submitter's supplied address directly in the message's From header rather than a Reply-To, allowing unauthenticated attackers…
CVE-2026-107773
The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution WordPress plugin before 5.3.3 does not correctly verify authorization when serving a single order and its order notes, allowing unauthenticated attackers to read customer and order information and to add or delete order notes for a subset of…
CVE-2026-105971
The Car Dealer (Dealership) and Vehicle sales WordPress plugin through 4.73 does not restrict its unauthenticated single-listing AJAX action to published content, allowing an unauthenticated attacker to read the title, content and metadata of any private, draft, pending, future or trashed post by supplying its numeric…
CVE-2026-105259
The Easy Social Icons WordPress plugin before 4.0.3 does not sanitise SVG files, which it adds to the list of file types that may be uploaded site-wide, allowing users with the Author role and above to upload a malicious SVG containing XSS payloads. Where another installed…
CVE-2026-100144
The IVPAY payments WordPress plugin through 1.0.8 does not sanitise a value from its payment callback before using it in a SQL statement, and treats an empty API key, which is its own default, as valid authentication, allowing unauthenticated attackers to read arbitrary data from the…
CVE-2025-15702
The Cloud Blocks WordPress plugin through 1.1.8 does not perform any authorisation or sanitisation when storing block asset URLs, allowing unauthenticated users to store malicious scripts that are executed in the browser of any privileged user, such as an administrator, who opens the block editor.