Kythos AI vulnerability intelligence
Zero-Day Exploits / Vulnerabilities
A server-rendered, source-attributed view of confirmed CISA KEV entries and all NVD CVEs published in the rolling 48-hour UTC window.
Important distinction: CISA KEV means exploitation has been observed; it does not mean every entry was a zero-day. An NVD publication in the past 48 hours does not mean exploitation has occurred. Source records describe third-party products and do not identify Kythos AI customers, contracts, affiliations, or work history.
Confirmed exploitation intelligence
Zero-Day Exploits / Vulnerabilities
Complete CISA Known Exploited Vulnerabilities catalog, ordered by the date CISA added each entry. Every result is known to be exploited; entries are not necessarily zero-days.
Entries 97–120 of 1,769
CVE-2026-72530: TrueConf Server Code Injection Vulnerability
TrueConf · Server
TrueConf Server contains a code injection vulnerability that could allow an unauthorized remote attacker with network access via port 4307/TCP to use a specially crafted script to break out of the isolated environment and execute arbitrary code on the host system.
Required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable…
CVE-2026-72529: TrueConf Server Missing Authentication for Critical Function Vulnerability
TrueConf · Server
TrueConf Server contains a missing authentication for critical function vulnerability which could allow a remote unauthorized attacker with network access via port 4307/TCP to execute an arbitrary script.
Required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable…
CVE-2026-64849: MLflow Server-Side Request Forgery Vulnerability
MLflow · MLflow
MLflow contains a server-side request forgery vulnerability that can allow attackers to reach internal or cloud metadata services and receive response_status and response_body.
Required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable…
CVE-2026-65400: Apple macOS Improper Authentication Vulnerability
Apple · macOS
Apple macOS contains an improper authentication vulnerability that could allow an attacker on the network to authenticate to Screen Sharing without valid credentials.
Required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable…
CVE-2026-59310: Broadcom VMware vCenter Path Traversal Vulnerability
Broadcom · VMware vCenter
Broadcom VMware vCenter contains a path traversal vulnerability which could allow a threat actor with network access to vCenter to execute arbitrary code.
Required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable…
CVE-2026-55040: Microsoft SharePoint Weak Authentication Vulnerability
Microsoft · SharePoint
Microsoft SharePoint contains a weak authentication vulnerability which allows an unauthorized attacker to bypass a security feature over a network.
Required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable…
CVE-2026-33824: Microsoft Internet Key Exchange (IKE) Service Extensions Double Free Vulnerability
Microsoft · Internet Key Exchange (IKE) Service Extensions
Microsoft Internet Key Exchange (IKE) Service Extensions contains a double free vulnerability that could enable remote code execution.
Required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable…
CVE-2025-62593: Ray-Project Ray Code Injection Vulnerability
Ray-Project · Ray
Ray-Project Ray contains a code injection vulnerability that could allow remote code execution. Developers using Ray as a development tool may be exposed to this vulnerability exploitable through Firefox and Safari.
Required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable…
CVE-2026-72898: Metabase SQL Injection Vulnerability
Metabase · Metabase
Metabase contains a SQL Injection vulnerability that allows an unauthenticated remote attacker to inject arbitrary SQL into the Metabase application database, which can give them administrator access to the instance. From there, the attacker could change the application configuration, steal stored credentials…
Required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable…
CVE-2026-68820: Microsoft Windows Ancillary Function Driver for WinSock Use-After-Free Vulnerability
Microsoft · Windows Ancillary Function Driver for WinSock
Microsoft Windows Ancillary Function Driver for WinSock contains a use-after-free vulnerability that allows an authorized attacker to elevate privileges locally.
Required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable…
CVE-2026-20349: Cisco Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) Heap Inspection Vulnerability
Cisco · Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD)
Cisco Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) contain a heap inspection vulnerability that could allow an unauthenticated, remote attacker to cause the device to reload unexpectedly, resulting in a denial of service (DoS) condition.
Required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable…
CVE-2026-8037: Progress LoadMaster Command Injection Vulnerability
Progress · LoadMaster
Progress LoadMaster contains a command injection vulnerability that allows an un-authenticated attacker to execute arbitrary commands on the LoadMaster appliance by exploiting unsanitized input in multiple command endpoints.
Required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable…
CVE-2026-63077: JetBrains TeamCity Deserialization of Untrusted Data Vulnerability
JetBrains · TeamCity
JetBrains TeamCity contains a deserialization of untrusted data vulnerability that could allow unauthenticated remote code execution via the agent polling protocol.
Required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable…
CVE-2026-9198: IBM Langflow Code Injection Vulnerability
IBM · Langflow
Langflow contains a code injection vulnerability that allows unauthenticated attackers to achieve full remote code execution on default Langflow deployments.
Required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable…
CVE-2026-34486: Apache Tomcat Missing Encryption of Sensitive Data Vulnerability
Apache · Tomcat
Apache Tomcat contains a missing encryption of sensitive data vulnerability that allows the bypass of the EncryptInterceptor. This vulnerability can be chained with CVE‑2025‑24813.
Required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable…
CVE-2026-18556: N-able N-central Authentication Bypass Using an Alternate Path or Channel Vulnerability
N-able · N-central
N-able N-central contains an authentication bypass using an alternate path or channel that allows for authentication bypass.
Required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable…
CVE-2026-18577: N-able N-central Authentication Bypass Using an Alternate Path or Channel Vulnerability
N-able · N-central
N-able N-central contains an authentication bypass using an alternate path or channel allows for authentication bypass and account takeover in N-central. This vulnerability is the result of an incomplete patch for CVE-2026-18556.
Required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable…
CVE-2026-20316: Cisco Secure Firewall Management Center Use of Hard-coded Password Vulnerability
Cisco · Secure Firewall Management Center (FMC)
Cisco Secure Firewall Management Center (FMC) formerly known as Firepower Management Center contains a use of hard-coded password vulnerability that could allow an unauthenticated, remote attacker to log in to an affected device using a low-privileged account to access sensitive data within…
Required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable…
CVE-2026-16812: Arista VeloCloud Orchestrator On-Prem OS Command Injection Vulnerability
Arista · VeloCloud Orchestrator
Arista VeloCloud Orchestrator On-Prem contains an OS command injection vulnerability that may allow a remote attacker to access privileged internal functionality and impact the VCO host. Successful exploitation may compromise the confidentiality, integrity, and availability of the orchestrator and data managed by…
Required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable…
CVE-2025-68686: Fortinet FortiOS Exposure of Sensitive Information to an Unauthorized Actor Vulnerability
Fortinet · FortiOS
Fortinet FortiOS contains an exposure of sensitive information to an unauthorized actor vulnerability. This may allow a remote unauthenticated attacker to bypass the patch developed for the symbolic link persistency mechanism observed in some post-exploit cases, via crafted HTTP requests. An attacker…
Required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable…
CVE-2026-50522: Microsoft SharePoint Deserialization of Untrusted Data Vulnerability
Microsoft · SharePoint
Microsoft SharePoint contains a deserialization of untrusted data vulnerability which could allow an unauthorized attacker to execute code over a network.
Required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable…
CVE-2026-16232: Check Point SmartConsole Improper Authentication Vulnerability
Check Point · SmartConsole
Check Point SmartConsole contains an improper authentication vulnerability which could allow an unauthenticated remote attacker to obtain an application login token and use it to authenticate with full administrative privileges.
Required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable…
CVE-2026-63030: WordPress Core Interpretation Conflict Vulnerability
WordPress · Core
WordPress Core contains an interpretation conflict vulnerability that could allow an attacker to perform SQL Injection and achieve Remote Code Execution. This vulnerability can be chained with CVE-2026-60137.
Required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable…
CVE-2026-60137: WordPress Core SQL Injection Vulnerability
WordPress · Core
WordPress Core contains a SQL injection vulnerability when a plugin or theme passes untrusted input to the parameter. This vulnerability can be chained with CVE-2026-63030 to allow an unauthenticated attacker to gain remote code execution on default WordPress installations.
Required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable…
Complete fixed-window snapshot
CVEs — Past 48 Hours
All unique CVEs returned by NVD for the displayed UTC publication window. The snapshot is accepted only when its normalized unique-item count exactly equals the API totalResults value.
Entries 529–552 of 1,041
CVE-2026-17211
IBM API Connect [network address omitted] through [network address omitted] and [network address omitted] through [network address omitted] could allow a remote authenticated attacker to cause a denial of service due to incorrect type conversion. A value is converted incorrectly between two different types, which could…
CVE-2026-17202
IBM API Connect [network address omitted] through [network address omitted] could allow a remote attacker to enumerate usernames due to observable differences in response behavior.
CVE-2026-17190
IBM API Connect [network address omitted] through [network address omitted] and [network address omitted] through [network address omitted] could allow a remote authenticated attacker to execute arbitrary JavaScript due to cross-site scripting. HTML content supplied by a provider is not sufficiently sanitized before it is displayed,…
CVE-2026-17188
IBM API Connect [network address omitted] through [network address omitted] could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery. When service definitions are imported, references to external resources are not sufficiently restricted, so the server could be made to request…
CVE-2026-17187
IBM API Connect [network address omitted] through [network address omitted] could allow a remote authenticated attacker to obtain sensitive information due to improper validation of user-supplied URLs.
CVE-2026-17172
IBM API Connect [network address omitted] through [network address omitted] and [network address omitted] through [network address omitted] could allow a remote authenticated attacker to bypass security restrictions due to improper authentication. Information supplied by the client is not sufficiently verified, which could allow a caller…
CVE-2026-17167
IBM API Connect [network address omitted] through [network address omitted] could allow a remote authenticated attacker to falsify audit log information due to reliance on untrusted inputs. Information supplied by the client is relied on when recording the source of a request, so audit records could…
CVE-2026-17158
IBM API Connect [network address omitted] through [network address omitted] and [network address omitted] through [network address omitted] could allow a remote authenticated attacker to gain elevated privileges due to improper authentication.
CVE-2026-17155
IBM API Connect [network address omitted] through [network address omitted] could allow a remote authenticated attacker to execute arbitrary scripts due to improper neutralization of user-controlled input.
CVE-2026-17154
IBM API Connect [network address omitted] through [network address omitted] could allow a remote authenticated attacker to perform cross-site scripting due to improper neutralization of user-supplied input.
CVE-2026-17150
IBM API Connect [network address omitted] through [network address omitted] and [network address omitted] through [network address omitted] could allow a remote authenticated attacker to execute arbitrary code and access sensitive information from other tenants due to insufficient input validation. Uploaded custom module content is not…
CVE-2026-17147
IBM API Connect [network address omitted] through [network address omitted] and [network address omitted] through [network address omitted] could allow a remote authenticated attacker to execute arbitrary code and perform unauthorized administrative actions due to a path traversal vulnerability.
CVE-2026-17146
IBM API Connect [network address omitted] through [network address omitted] and [network address omitted] through [network address omitted] could allow a remote authenticated attacker to execute arbitrary JavaScript and obtain sensitive information due to improper input validation.
CVE-2026-17144
IBM API Connect [network address omitted] through [network address omitted] and [network address omitted] through [network address omitted] could allow a remote authenticated attacker to obtain sensitive information due to improper input validation.
CVE-2026-17143
IBM API Connect [network address omitted] through [network address omitted] and [network address omitted] through [network address omitted] could allow a remote authenticated attacker to perform HTML injection due to improper neutralization of user-supplied input.
CVE-2026-17140
IBM API Connect [network address omitted] through [network address omitted] and [network address omitted] through [network address omitted] could allow a remote authenticated attacker to execute arbitrary code due to improper control of generation of code. Input supplied by a user can influence code generated by…
CVE-2026-17139
IBM API Connect [network address omitted] through [network address omitted] and [network address omitted] through [network address omitted] could allow a remote authenticated attacker to execute arbitrary scripts due to cross-site scripting. Certain URL fields are not sufficiently validated, so malicious script content could run in…
CVE-2026-17137
IBM API Connect [network address omitted] through [network address omitted] could allow a local attacker to obtain sensitive information due to improper use of cryptography. The encryption applied to stored data is not implemented with sufficient strength, which weakens its protection.
CVE-2026-17134
IBM API Connect [network address omitted] through [network address omitted] could allow a remote authenticated attacker to execute arbitrary SQL commands due to SQL injection.
CVE-2026-17132
IBM API Connect [network address omitted] through [network address omitted] could allow a remote authenticated attacker to execute arbitrary SQL commands due to improper neutralization of special elements used in an SQL command.
CVE-2026-17131
IBM API Connect [network address omitted] through [network address omitted] could allow a remote attacker to obtain sensitive information due to server-side request forgery. Restrictions on outbound requests can be bypassed, so the server could be made to contact unintended destinations and return the response.
CVE-2026-17129
IBM API Connect [network address omitted] through [network address omitted] could allow a remote authenticated attacker to obtain sensitive information and cause a denial of service due to an insecure direct object reference.
CVE-2026-17128
IBM API Connect [network address omitted] through [network address omitted] could allow a remote authenticated attacker to obtain sensitive information due to the insertion of sensitive information into log files.
CVE-2026-17117
IBM API Connect [network address omitted] through [network address omitted] and [network address omitted] through [network address omitted] could allow a remote authenticated attacker to execute arbitrary code due to improperly controlled modification of object attributes. A user could set a field that should only be…