Kythos AI vulnerability intelligence
Zero-Day Exploits / Vulnerabilities
A server-rendered, source-attributed view of confirmed CISA KEV entries and all NVD CVEs published in the rolling 48-hour UTC window.
Important distinction: CISA KEV means exploitation has been observed; it does not mean every entry was a zero-day. An NVD publication in the past 48 hours does not mean exploitation has occurred. Source records describe third-party products and do not identify Kythos AI customers, contracts, affiliations, or work history.
Confirmed exploitation intelligence
Zero-Day Exploits / Vulnerabilities
Complete CISA Known Exploited Vulnerabilities catalog, ordered by the date CISA added each entry. Every result is known to be exploited; entries are not necessarily zero-days.
Entries 1,345–1,368 of 1,768
CVE-2016-5195: Linux Kernel Race Condition Vulnerability
Linux · Kernel
Race condition in mm/gup.c in the Linux kernel allows local users to escalate privileges.
Required action: Apply updates per vendor instructions.
CVE-2016-4117: Adobe Flash Player Arbitrary Code Execution Vulnerability
Adobe · Flash Player
An access of resource using incompatible type vulnerability exists within Adobe Flash Player that allows an attacker to perform remote code execution.
Required action: The impacted product is end-of-life and should be disconnected if still in use.
CVE-2016-1019: Adobe Flash Player Arbitrary Code Execution Vulnerability
Adobe · Flash Player
Adobe Flash Player allows remote attackers to cause a denial of service or possibly execute arbitrary code.
Required action: The impacted product is end-of-life and should be disconnected if still in use.
CVE-2016-0099: Microsoft Windows Secondary Logon Service Privilege Escalation Vulnerability
Microsoft · Windows
A privilege escalation vulnerability exists in Microsoft Windows if the Windows Secondary Logon Service fails to properly manage request handles in memory. An attacker who successfully exploited this vulnerability could run arbitrary code as an administrator.
Required action: Apply updates per vendor instructions.
CVE-2015-7645: Adobe Flash Player Arbitrary Code Execution Vulnerability
Adobe · Flash Player
Adobe Flash Player allows remote attackers to execute arbitrary code via a crafted SWF file.
Required action: The impacted product is end-of-life and should be disconnected if still in use.
CVE-2015-5119: Adobe Flash Player Use-After-Free Vulnerability
Adobe · Flash Player
A use-after-free vulnerability exists within the ActionScript 3 ByteArray class in Adobe Flash Player that allows an attacker to perform remote code execution.
Required action: The impacted product is end-of-life and should be disconnected if still in use.
CVE-2015-4902: Oracle Java SE Integrity Check Vulnerability
Oracle · Java SE
Unspecified vulnerability in Oracle Java SE allows remote attackers to affect integrity via Unknown vectors related to deployment.
Required action: Apply updates per vendor instructions.
CVE-2015-3043: Adobe Flash Player Memory Corruption Vulnerability
Adobe · Flash Player
A memory corruption vulnerability exists in Adobe Flash Player that allows an attacker to perform remote code execution.
Required action: The impacted product is end-of-life and should be disconnected if still in use.
CVE-2015-2590: Oracle Java SE and Java SE Embedded Remote Code Execution Vulnerability
Oracle · Java SE
An unspecified vulnerability exists within Oracle Java Runtime Environment that allows an attacker to perform remote code execution.
Required action: Apply updates per vendor instructions.
CVE-2015-2545: Microsoft Office Malformed EPS File Vulnerability
Microsoft · Office
Microsoft Office allows remote attackers to execute arbitrary code via a crafted EPS image.
Required action: Apply updates per vendor instructions.
CVE-2015-2424: Microsoft PowerPoint Memory Corruption Vulnerability
Microsoft · PowerPoint
Microsoft PowerPoint allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted Office document.
Required action: Apply updates per vendor instructions.
CVE-2015-2387: Microsoft ATM Font Driver Privilege Escalation Vulnerability
Microsoft · ATM Font Driver
ATMFD.DLL in the Adobe Type Manager Font Driver in Microsoft Windows Server allows local users to gain privileges via a crafted application.
Required action: Apply updates per vendor instructions.
CVE-2015-1701: Microsoft Win32k Privilege Escalation Vulnerability
Microsoft · Win32k
An unspecified vulnerability exists in the Win32k.sys kernel-mode driver in Microsoft Windows Server that allows a local attacker to execute arbitrary code with elevated privileges.
Required action: Apply updates per vendor instructions.
CVE-2015-1642: Microsoft Office Memory Corruption Vulnerability
Microsoft · Office
Microsoft Office contains a memory corruption vulnerability that allows remote attackers to execute arbitrary code via a crafted document.
Required action: Apply updates per vendor instructions.
CVE-2014-4114: Microsoft Windows Object Linking & Embedding (OLE) Remote Code Execution Vulnerability
Microsoft · Windows
A vulnerability exists in Windows Object Linking & Embedding (OLE) that could allow remote code execution if a user opens a file that contains a specially crafted OLE object.
Required action: Apply updates per vendor instructions.
CVE-2014-0496: Adobe Reader and Acrobat Use-After-Free Vulnerability
Adobe · Reader and Acrobat
Adobe Reader and Acrobat contain a use-after-free vulnerability which can allow for code execution.
Required action: Apply updates per vendor instructions.
CVE-2013-5065: Microsoft Windows Kernel Privilege Escalation Vulnerability
Microsoft · Windows
Microsoft Windows NDProxy.sys in the kernel contains an improper input validation vulnerability which can allow a local attacker to escalate privileges.
Required action: Apply updates per vendor instructions.
CVE-2013-3897: Microsoft Internet Explorer Use-After-Free Vulnerability
Microsoft · Internet Explorer
A use-after-free vulnerability exists within CDisplayPointer in Microsoft Internet Explorer that allows an attacker to remotely execute arbitrary code.
Required action: Apply updates per vendor instructions.
CVE-2013-3346: Adobe Reader and Acrobat Memory Corruption Vulnerability
Adobe · Reader and Acrobat
Adobe Reader and Acrobat contain a memory corruption vulnerability which can allow attackers to execute arbitrary code or cause a denial of service.
Required action: Apply updates per vendor instructions.
CVE-2013-1675: Mozilla Firefox Information Disclosure Vulnerability
Mozilla · Firefox
Mozilla Firefox does not properly initialize data structures for the nsDOMSVGZoomEvent[network address omitted]mPreviousScale and nsDOMSVGZoomEvent[network address omitted]mNewScale functions, which allows remote attackers to obtain sensitive information from process memory via a crafted web site.
Required action: Apply updates per vendor instructions.
CVE-2013-1347: Microsoft Internet Explorer Remote Code Execution Vulnerability
Microsoft · Internet Explorer
This vulnerability may corrupt memory in a way that could allow an attacker to execute arbitrary code in the context of the current user within Internet Explorer.
Required action: Apply updates per vendor instructions.
CVE-2013-0641: Adobe Reader Buffer Overflow Vulnerability
Adobe · Reader
A buffer overflow vulnerability exists in Adobe Reader which allows an attacker to perform remote code execution.
Required action: Apply updates per vendor instructions.
CVE-2013-0640: Adobe Reader and Acrobat Memory Corruption Vulnerability
Adobe · Reader and Acrobat
An memory corruption vulnerability exists in the acroform.dll in Adobe Reader that allows an attacker to perform remote code execution.
Required action: Apply updates per vendor instructions.
CVE-2013-0632: Adobe ColdFusion Authentication Bypass Vulnerability
Adobe · ColdFusion
An authentication bypass vulnerability exists in Adobe ColdFusion which could result in an unauthorized user gaining administrative access.
Required action: Apply updates per vendor instructions.
Complete fixed-window snapshot
CVEs — Past 48 Hours
All unique CVEs returned by NVD for the displayed UTC publication window. The snapshot is accepted only when its normalized unique-item count exactly equals the API totalResults value.
Entries 385–408 of 1,091
CVE-2026-97371
ntopng is a web-based network traffic monitoring application. Prior to 6.7.260721, ndpi_get_custom_category_match writes a four-byte nDPI protocol-category value through a pointer to the two-byte id variable in IpAddress[network address omitted]reloadBlacklist in src/IpAddress.cpp during packet dissection and host initialization. A remote unauthenticated attacker on a monitored network…
CVE-2026-85287
HomeBox is a home inventory and organization system. Prior to 0.27.0, POST /api/v1/users/register and the users.email uniqueness constraint treat email addresses as case-sensitive while HomeBox uses a case-insensitive login lookup. An unauthenticated attacker who knows a victim's email can register a differently cased variant, creating duplicate…
CVE-2026-82965
A flaw was found in the SAML implementation of Keycloak, an open-source identity and access management solution. The SAML Artifact Resolution and ECP SOAP endpoints do not properly limit the size or complexity of incoming XML requests. An unauthenticated remote attacker can exploit this by sending…
CVE-2026-82413
ntopng is a web-based network traffic monitoring application. Prior to 6.7.260717, scripts/lua/rest/v2/add/host/to_scan.lua and scripts/lua/rest/v2/exec/host/schedule_vulnerability_scan.lua accept scan_ports from any authenticated session, including non-administrator users, while deployments with login disabled expose the same request without authentication. The endpoints validate scan_ports with validateSingleWord, which permits shell metacharacters, and persist…
CVE-2026-76077
ASN1SCC is an open source ASN.1 compiler for embedded systems. Prior to [network address omitted], the XER tokenizer NT() in asn1crt/asn1crt_encoding_xer.c, which is reached by all XER decode paths, copies tag characters into a fixed char Value[100] field without a length bound and reads input and…
CVE-2026-75615
ASN1SCC is an open source ASN.1 compiler for embedded systems. Prior to [network address omitted], the ACN runtime function Acn_Dec_String_CharIndex_private in asn1crt/asn1crt_encoding_acn.c and the generated uPER decoder InternalItem_string_with_alpha_decode in StgC/uper_c.stg do not validate a decoded character index before reading allowedCharSet. For string alphabets whose size is…
CVE-2026-75614
ASN1SCC is an open source ASN.1 compiler for embedded systems. Prior to [network address omitted], BitStream_DecodeConstraintWholeNumber in asn1crt/asn1crt_encoding.c reads enough bits for a constrained integer but does not reject values above the declared range when the encoded range is not a power of two. Generated uPER…
CVE-2026-75599
HomeBox is a home inventory and organization system. Prior to 0.27.0, the maybeUrl() utility accepts markdown-style links in entity custom-field values without restricting the URL scheme, so an authenticated user can store a javascript: URI that is rendered as a clickable anchor on an item page.…
CVE-2026-54146
OpenHuman is an open-source agent harness available as a desktop application and Rust library. From 0.53.15 before 0.57.5 on macOS, core_process.rs in the Tauri desktop process publishes the per-launch OPENHUMAN_CORE_TOKEN bearer credential in its process environment even though the core now runs as an in-process task.…
CVE-2026-54145
OpenHuman is an open-source agent harness available as a desktop application and Rust library. In affected versions before 0.57.5, the approval gate uses the JSON-RPC bearer token as an approval session identifier. This exposes the credential through persisted approval records, events, debug logs, and RPC responses,…
CVE-2026-54144
OpenHuman is an open-source agent harness available as a desktop application and Rust library. Before 0.56.0 on macOS, the runtime injected into a supported remote account webview such as Google Meet allows page JavaScript to call getDisplayMedia without a live user gesture. Instead of rejecting the…
CVE-2026-54143
OpenHuman is an open-source agent harness available as a desktop application and Rust library. Before version 0.57.13, an attacker who can send messages to a configured external channel can cause the agent to create persistent shell cron jobs without human approval. The scheduler later executes these…
CVE-2026-54142
OpenHuman is an open-source agent harness available as a desktop application and Rust library. Before 0.57.13, background synchronization for connected services such as email, Slack, and Notion stores raw external content and later places it in the model context of autonomous background agents without neutralizing embedded…
CVE-2026-54141
OpenHuman is an open-source agent harness available as a desktop application and Rust library. Before 0.57.13, a remote direct message received through a configured Yuanbao channel is converted into a generic channel AgentTurnRequest that uses the default tool policy without establishing an interactive approval context. Under…
CVE-2026-54140
OpenHuman is an open-source agent harness available as a desktop application and Rust library. Before 0.57.13, OpenHuman places names, descriptions, titles, and parameter definitions returned by configured external MCP servers into the agent model context without neutralizing instructions or bounding the descriptive fields. The McpRemoteTool records…
CVE-2026-49407
OpenHuman is an open-source agent harness available as a desktop application and Rust library. Before version 0.57.44, its local /ws/dictation WebSocket endpoint lacks client authentication and browser-origin validation. An unauthenticated client, including a malicious web page able to reach the endpoint, can submit audio and trigger…
CVE-2026-49405
OpenHuman is an open-source agent harness available as a desktop application and Rust library. Before 0.56.0, the local server exposes the server-sent events endpoint at /events without bearer authentication, permits cross-origin browser access, and uses only a caller-supplied client_id to select WebChannelEvent objects from the process-wide…
CVE-2026-49393
OpenHuman is an open-source agent harness available as a desktop application and Rust library. Before 0.56.0, the core server protects HTTP POST requests to /rpc with bearer middleware but exposes Socket.IO rpc:request and chat:start handlers without equivalent transport or handler-level authentication. A local unauthenticated client can…
CVE-2026-123151
A flaw was found in the GNU debugger (GDB). When GDB connects to a remote debug target, a malicious target can cause GDB to overflow a buffer on the stack while parsing the target's replies. This can crash GDB or potentially allow the target to execute…
CVE-2026-121997
A heap buffer overflow in gdbserver's QTDPsrc packet handler allows an unauthenticated remote attacker to achieve native code execution in the gdbserver process. The vulnerability results from a mismatch between a packet's declared source length and the actual data length, causing hex2bin to write beyond the…
CVE-2026-121996
A length validation flaw in gdbserver's agent-expression parser allows an unauthenticated remote attacker to read uninitialized heap memory from the gdbserver process and cause a denial of service. Disclosed heap content includes addresses suitable for defeating ASLR in further exploitation.
CVE-2026-121995
A stack buffer overflow in the GDB client's tracepoint upload handler allows an attacker-controlled debug stub to corrupt stack memory automatically during connection setup. The overflow results from GDB reading beyond the current reply boundary into a stale prior reply in the shared packet buffer.
CVE-2026-121994
A stack buffer overflow in the GDB client's remote protocol handler allows an attacker-controlled debug target to execute arbitrary code in the GDB process. The vulnerability exists in fetch_register_using_p, which decodes a stub's register reply into an alloca-sized buffer without bounding writes by the register width.
CVE-2026-120499
h5io before 0.2.6 contains a code injection vulnerability in read_hdf5() that allows attackers to execute arbitrary code by supplying a crafted HDF5 file. Attackers can store Python code in a node titled timezone, which _triage_read() passes to eval() with builtins reachable, name an arbitrary module in…