Kythos AI

CVE watch Past 48 hours+

Latest 48 of 1022 in cacheBrowse CVEs
NVD checked Nov 8, 06:27 UTCSource: NVD · Refreshed every 2 hours · Publication may lag

Kythos AI vulnerability intelligence

Zero-Day Exploits / Vulnerabilities

A server-rendered, source-attributed view of confirmed CISA KEV entries and all NVD CVEs published in the rolling 48-hour UTC window.

Important distinction: CISA KEV means exploitation has been observed; it does not mean every entry was a zero-day. An NVD publication in the past 48 hours does not mean exploitation has occurred. Source records describe third-party products and do not identify Kythos AI customers, contracts, affiliations, or work history.

CISA KEV catalogNVD 48-hour CVEsKythos AI RSS feed

Confirmed exploitation intelligence

Zero-Day Exploits / Vulnerabilities

Complete CISA Known Exploited Vulnerabilities catalog, ordered by the date CISA added each entry. Every result is known to be exploited; entries are not necessarily zero-days.

Current snapshot

Entries 1,177–1,200 of 1,769

CISA KEV

CVE-2013-3660: Microsoft Win32k Privilege Escalation Vulnerability

Microsoft · Win32k

The EPATHOBJ[network address omitted]pprFlattenRec function in win32k.sys in the kernel-mode drivers in Microsoft does not properly initialize a pointer for the next object in a certain list, which allows local users to gain privileges.

Federal remediation due Apr 18, 2022Ransomware use: Not confirmed by CISA

Required action: Apply updates per vendor instructions.

View in the CISA KEV catalog →

CISA KEV

CVE-2013-2465: Oracle Java SE Unspecified Vulnerability

Oracle · Java SE

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE allows remote attackers to affect confidentiality, integrity, and availability via Unknown vectors related to 2D

Federal remediation due Apr 18, 2022Ransomware use: Known

Required action: Apply updates per vendor instructions.

View in the CISA KEV catalog →

CISA KEV

CVE-2013-1690: Mozilla Firefox and Thunderbird Denial-of-Service Vulnerability

Mozilla · Firefox and Thunderbird

Mozilla Firefox and Thunderbird do not properly handle onreadystatechange events in conjunction with page reloading, which allows remote attackers to cause a denial-of-service (DoS) or possibly execute malicious code via a crafted web site.

Federal remediation due Apr 18, 2022Ransomware use: Not confirmed by CISA

Required action: Apply updates per vendor instructions.

View in the CISA KEV catalog →

CISA KEV

CVE-2012-5076: Oracle Java SE Sandbox Bypass Vulnerability

Oracle · Java SE

The default Java security properties configuration did not restrict access to the com.sun.org.glassfish.external and com.sun.org.glassfish.gmbal packages. An untrusted Java application or applet could use these flaws to bypass Java sandbox restrictions.

Federal remediation due Apr 18, 2022Ransomware use: Not confirmed by CISA

Required action: Apply updates per vendor instructions.

View in the CISA KEV catalog →

CISA KEV

CVE-2011-2005: Microsoft Ancillary Function Driver (afd.sys) Improper Input Validation Vulnerability

Microsoft · Ancillary Function Driver (afd.sys)

afd.sys in the Ancillary Function Driver in Microsoft Windows does not properly validate user-mode input passed to kernel mode, which allows local users to gain privileges via a crafted application.

Federal remediation due Apr 18, 2022Ransomware use: Not confirmed by CISA

Required action: Apply updates per vendor instructions.

View in the CISA KEV catalog →

Source: Official CISA KEV JSONCatalog released Nov 6, 2026, 7:44 PM GMT+0000Site snapshot: Showing 24 of 1,769Source text normalized: network addresses and restricted context omittedRefresh interval: 30 minutes

Complete fixed-window snapshot

CVEs — Past 48 Hours

All unique CVEs returned by NVD for the displayed UTC publication window. The snapshot is accepted only when its normalized unique-item count exactly equals the API totalResults value.

Current snapshot

Entries 937–960 of 1,041

NVD CVE

CVE-2026-123324

In JetBrains YouTrack before 2026.2.19562 information disclosure via shared mailbox message history was possible

CVSS 7.7 HIGHStatus: Awaiting AnalysisCWE-863

Review the NVD record →

NVD CVE

CVE-2026-123323

In JetBrains YouTrack before 2025.3.170763, 2026.1.14150, 2026.2.19656 improper URL validation in the app widget host allowed apps to send REST requests without user confirmation

CVSS 8.4 HIGHStatus: Awaiting AnalysisCWE-862

Review the NVD record →

NVD CVE

CVE-2026-123322

In JetBrains WebStorm before 2026.3, 2026.2.4 code execution was possible in untrusted projects via the Angular CLI schematics loader

CVSS 6.3 MEDIUMStatus: Awaiting AnalysisCWE-829

Review the NVD record →

NVD CVE

CVE-2026-123321

In JetBrains WebStorm before 2026.3, 2026.2.3 code execution via Grunt and Gulp task loading was possible in untrusted projects

CVSS 7.8 HIGHStatus: Awaiting AnalysisCWE-829

Review the NVD record →

NVD CVE

CVE-2026-123320

In JetBrains Toolbox App before 3.9 insufficient warning in the login dialog allowed connecting to a malicious server

CVSS 3.1 LOWStatus: Awaiting AnalysisCWE-357

Review the NVD record →

NVD CVE

CVE-2026-123319

In JetBrains Ktor before 3.6.1 missing Domain attribute validation in client cookie storage allowed cookie injection

CVSS 3.7 LOWStatus: Awaiting AnalysisCWE-565

Review the NVD record →

NVD CVE

CVE-2026-123318

In JetBrains Ktor before 3.6.1 hTTP request smuggling was possible in the CIO engine

CVSS 4.8 MEDIUMStatus: Awaiting AnalysisCWE-444

Review the NVD record →

NVD CVE

CVE-2026-123317

In JetBrains Ktor before 3.6.1 session forgery was possible via tampered encrypted session cookies

CVSS 8.1 HIGHStatus: Awaiting AnalysisCWE-354

Review the NVD record →

NVD CVE

CVE-2026-123316

In JetBrains Junie CLI before 26.6.29 sensitive environment variables were exposed in session event logs

CVSS 5.5 MEDIUMStatus: Awaiting AnalysisCWE-532

Review the NVD record →

NVD CVE

CVE-2026-123315

In JetBrains Junie CLI before 26.8.24 command execution was possible via the Allow Similar Commands option

CVSS 7.0 HIGHStatus: Awaiting AnalysisCWE-625

Review the NVD record →

NVD CVE

CVE-2026-123314

In JetBrains IntelliJ IDEA before 2026.3, 2026.2.4 xXE attack was possible via an XML response to an HTTP Client request

CVSS 3.1 LOWStatus: Awaiting AnalysisCWE-611

Review the NVD record →

NVD CVE

CVE-2026-123313

In JetBrains IntelliJ IDEA before 2026.3 improper checks could enable disabled plugins via external dependency settings

CVSS 3.3 LOWStatus: Awaiting AnalysisCWE-829

Review the NVD record →

NVD CVE

CVE-2026-123312

In JetBrains IntelliJ IDEA before 2026.3, 2026.2.4 sSRF was possible via annotations.xml files during indexing

CVSS 3.3 LOWStatus: Awaiting AnalysisCWE-827

Review the NVD record →

NVD CVE

CVE-2026-123311

In JetBrains IntelliJ IDEA before 2026.3, 2026.2.4 command execution via a hidden run control in the Markdown preview was possible

CVSS 5.3 MEDIUMStatus: Awaiting AnalysisCWE-1021

Review the NVD record →

NVD CVE

CVE-2026-123310

In JetBrains IntelliJ IDEA before 2026.3 kotlin scripts could trigger dependency downloads from arbitrary repositories in untrusted projects

CVSS 5.4 MEDIUMStatus: Awaiting AnalysisCWE-918

Review the NVD record →

NVD CVE

CVE-2026-123309

In JetBrains IntelliJ IDEA before 2026.3, 2026.2.4 stored XSS was possible on the built-in web server via Markdown preview

CVSS 6.1 MEDIUMStatus: Awaiting AnalysisCWE-79

Review the NVD record →

NVD CVE

CVE-2026-123308

In JetBrains IntelliJ IDEA before 2026.3 code execution via the document import was possible in untrusted projects

CVSS 6.3 MEDIUMStatus: Awaiting AnalysisCWE-829

Review the NVD record →

NVD CVE

CVE-2026-123307

In JetBrains IntelliJ IDEA before 2026.3, 2026.2.4 unauthenticated connection to an arbitrary host via run configurations was possible

CVSS 6.8 MEDIUMStatus: Awaiting AnalysisCWE-918

Review the NVD record →

NVD CVE

CVE-2026-123306

In JetBrains IntelliJ IDEA before 2026.3 improper checks allowed server certificates to be added to the trust store during headless runs

CVSS 7.4 HIGHStatus: Awaiting AnalysisCWE-295

Review the NVD record →

NVD CVE

CVE-2026-123305

In JetBrains IntelliJ IDEA before 2026.3 path traversal was possible via unpacking Dev Container archives from a remote host

CVSS 7.5 HIGHStatus: Awaiting AnalysisCWE-23

Review the NVD record →

NVD CVE

CVE-2026-123304

In JetBrains IntelliJ IDEA before 2026.3 code execution in untrusted projects via a configured ShellCheck path

CVSS 7.8 HIGHStatus: Awaiting AnalysisCWE-829

Review the NVD record →

NVD CVE

CVE-2026-123302

In JetBrains IntelliJ IDEA before 2026.3, 2026.2.4, 2026.1.5.1, 2025.3.6.2 code execution was possible in untrusted projects via script engine discovery

CVSS 7.8 HIGHStatus: Awaiting AnalysisCWE-829

Review the NVD record →

NVD CVE

CVE-2026-123301

In JetBrains IntelliJ IDEA before 2026.3 dOM-based XSS in the OpenAPI preview error view was possible

CVSS 8.2 HIGHStatus: Awaiting AnalysisCWE-79

Review the NVD record →

NVD CVE

CVE-2026-123300

In JetBrains Hub before 2026.2.52519 missing authorisation allowed users with read-only access to modify auth module group mappings

CVSS 2.7 LOWStatus: Awaiting AnalysisCWE-862

Review the NVD record →

Source: Official NVD CVE API 2.0UTC window Nov 6, 2026 06:27–Nov 8, 2026 06:27API response: Site snapshot: Showing 24 of 1,041Source text normalized: network addresses and restricted context omittedRefresh interval: 2 hours