Kythos AI vulnerability intelligence
Zero-Day Exploits / Vulnerabilities
A server-rendered, source-attributed view of confirmed CISA KEV entries and all NVD CVEs published in the rolling 48-hour UTC window.
Important distinction: CISA KEV means exploitation has been observed; it does not mean every entry was a zero-day. An NVD publication in the past 48 hours does not mean exploitation has occurred. Source records describe third-party products and do not identify Kythos AI customers, contracts, affiliations, or work history.
Confirmed exploitation intelligence
Zero-Day Exploits / Vulnerabilities
Complete CISA Known Exploited Vulnerabilities catalog, ordered by the date CISA added each entry. Every result is known to be exploited; entries are not necessarily zero-days.
Entries 1,393–1,416 of 1,769
CVE-2022-24086: Adobe Commerce and Magento Open Source Improper Input Validation Vulnerability
Adobe · Commerce and Magento Open Source
Adobe Commerce and Magento Open Source contain an improper input validation vulnerability which can allow for arbitrary code execution.
Required action: Apply updates per vendor instructions.
CVE-2022-0609: Google Chromium Animation Use-After-Free Vulnerability
Google · Chromium Animation
Google Chromium Animation contains a use-after-free vulnerability that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and…
Required action: Apply updates per vendor instructions.
CVE-2019-0752: Microsoft Internet Explorer Type Confusion Vulnerability
Microsoft · Internet Explorer
A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer
Required action: Apply updates per vendor instructions.
CVE-2018-8174: Microsoft Windows VBScript Engine Out-of-Bounds Write Vulnerability
Microsoft · Windows
A remote code execution vulnerability exists in the way that the VBScript engine handles objects in memory, aka "Windows VBScript Engine Remote Code Execution"
Required action: Apply updates per vendor instructions.
CVE-2018-20250: WinRAR Absolute Path Traversal Vulnerability
RARLAB · WinRAR
WinRAR Absolute Path Traversal vulnerability leads to Remote Code Execution
Required action: Apply updates per vendor instructions.
CVE-2018-15982: Adobe Flash Player Use-After-Free Vulnerability
Adobe · Flash Player
Adobe Flash Player com.adobe.tvsdk.mediacore.metadata Use After Free Vulnerability
Required action: The impacted product is end-of-life and should be disconnected if still in use.
CVE-2017-9841: PHPUnit Command Injection Vulnerability
PHPUnit · PHPUnit
PHPUnit allows remote attackers to execute arbitrary PHP code via HTTP POST data beginning with a "
Required action: Apply updates per vendor instructions.
CVE-2014-1761: Microsoft Word Memory Corruption Vulnerability
Microsoft · Word
Microsoft Word contains a memory corruption vulnerability which when exploited could allow for remote code execution.
Required action: Apply updates per vendor instructions.
CVE-2013-3906: Microsoft Graphics Component Memory Corruption Vulnerability
Microsoft · Graphics Component
Microsoft Graphics Component contains a memory corruption vulnerability which can allow for remote code execution.
Required action: Apply updates per vendor instructions.
CVE-2022-22620: Apple iOS, iPadOS, and macOS Webkit Use-After-Free Vulnerability
Apple · iOS, iPadOS, and macOS
Apple iOS, iPadOS, and macOS WebKit contain a use-after-free vulnerability that leads to code execution when processing maliciously crafted web content. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely…
Required action: Apply updates per vendor instructions.
CVE-2021-36934: Microsoft Windows SAM Local Privilege Escalation Vulnerability
Microsoft · Windows
If a Volume Shadow Copy (VSS) shadow copy of the system drive is available, users can read the SAM file which would allow any user to escalate privileges to SYSTEM level.
Required action: Apply updates per vendor instructions.
CVE-2020-0796: Microsoft SMBv3 Remote Code Execution Vulnerability
Microsoft · SMBv3
A remote code execution vulnerability exists in the way that the Microsoft Server Message Block 3.1.1 (SMBv3) protocol handles certain requests. An attacker who successfully exploited the vulnerability could gain the ability to execute code on the target server or client.
Required action: Apply updates per vendor instructions.
CVE-2018-1000861: Jenkins Stapler Web Framework Deserialization of Untrusted Data Vulnerability
Jenkins · Jenkins Stapler Web Framework
A code execution vulnerability exists in the Stapler web framework used by Jenkins
Required action: Apply updates per vendor instructions.
CVE-2017-9791: Apache Struts 1 Improper Input Validation Vulnerability
Apache · Struts 1
The Struts 1 plugin in Apache Struts might allow remote code execution via a malicious field value passed in a raw message to the ActionMessage.
Required action: Apply updates per vendor instructions.
CVE-2017-8464: Microsoft Windows Shell (.lnk) Remote Code Execution Vulnerability
Microsoft · Windows
Windows Shell in multiple versions of Microsoft Windows allows local users or remote attackers to execute arbitrary code via a crafted .LNK file
Required action: Apply updates per vendor instructions.
CVE-2017-10271: Oracle Corporation WebLogic Server Remote Code Execution Vulnerability
Oracle · WebLogic Server
Oracle Corporation WebLogic Server contains a vulnerability that allows for remote code execution.
Required action: Apply updates per vendor instructions.
CVE-2017-0263: Microsoft Win32k Privilege Escalation Vulnerability
Microsoft · Win32k
Microsoft Win32k contains a privilege escalation vulnerability due to the Windows kernel-mode driver failing to properly handle objects in memory.
Required action: Apply updates per vendor instructions.
CVE-2017-0262: Microsoft Office Remote Code Execution Vulnerability
Microsoft · Office
A remote code execution vulnerability exists in Microsoft Office.
Required action: Apply updates per vendor instructions.
CVE-2017-0145: Microsoft SMBv1 Remote Code Execution Vulnerability
Microsoft · SMBv1
The SMBv1 server in multiple Microsoft Windows versions allows remote attackers to execute arbitrary code via crafted packets.
Required action: Apply updates per vendor instructions.
CVE-2017-0144: Microsoft SMBv1 Remote Code Execution Vulnerability
Microsoft · SMBv1
The SMBv1 server in multiple Microsoft Windows versions allows remote attackers to execute arbitrary code via crafted packets.
Required action: Apply updates per vendor instructions.
CVE-2016-3088: Apache ActiveMQ Improper Input Validation Vulnerability
Apache · ActiveMQ
The Fileserver web application in Apache ActiveMQ allows remote attackers to upload and execute arbitrary files via an HTTP PUT followed by an HTTP MOVE request
Required action: Apply updates per vendor instructions.
CVE-2015-2051: D-Link DIR-645 Router Remote Code Execution Vulnerability
D-Link · DIR-645 Router
D-Link DIR-645 Wired/Wireless Router allows remote attackers to execute arbitrary commands via a GetDeviceSettings action to the HNAP interface.
Required action: The impacted product is end-of-life and should be disconnected if still in use.
CVE-2015-1635: Microsoft HTTP.sys Remote Code Execution Vulnerability
Microsoft · HTTP.sys
Microsoft HTTP protocol stack (HTTP.sys) contains a vulnerability that allows for remote code execution.
Required action: Apply updates per vendor instructions.
CVE-2015-1130: Apple OS X Authentication Bypass Vulnerability
Apple · OS X
The XPC implementation in Admin Framework in Apple OS X before 10.10.3 allows local users to bypass authentication and obtain admin privileges.
Required action: Apply updates per vendor instructions.
Complete fixed-window snapshot
CVEs — Past 48 Hours
All unique CVEs returned by NVD for the displayed UTC publication window. The snapshot is accepted only when its normalized unique-item count exactly equals the API totalResults value.
Entries 1–24 of 1,057
CVE-2026-114713
The labeled-response module in UnrealIRCd 6.0.0 before [network address omitted] does not escape the IRCv3 "label" message tag when echoing it into replies, which allows any user on a network with two or more linked servers to inject server-to-server commands that are executed with server authority.
CVE-2026-124422
SunEditor from 3.0.0 before 3.4.0 contains a stored cross-site scripting vulnerability in html.clean() that rebuilds iframes from data-se-iframe-holder-attrs JSON without filtering srcdoc or uppercase SRC keys. Attackers can inject crafted HTML through paste, html.set, or html.insert to execute script in the host page origin when victims…
CVE-2026-123616
imgproxy from 3.3.0 before 4.0.16 contains an unbounded memory allocation vulnerability in the ICO loader that fails to validate the data_size field. Attackers can supply a crafted 23-byte ICO file declaring a ~4GB data_size to trigger memory exhaustion and worker crashes without authentication.
CVE-2026-123615
imgproxy 3.3.0 before 4.0.17 contains an out-of-bounds heap read and write in the ICO loader's BMP header reconstruction (vips_foreign_load_ico_header in vips/icoload.c) when an ICO entry declares a tiny data size, causing unvalidated header fields to be read and written past the allocated buffer. Unauthenticated remote attackers…
CVE-2026-123614
imgproxy from 4.0.0 before 4.0.16 contains an integer overflow in the ICO loader that allows remote attackers to trigger a heap buffer overflow via a crafted data_size value. Attackers can submit a crafted ICO image whose data_size wraps the allocation in vips/icoload.c, corrupting heap memory to…
CVE-2026-123613
Rustls from 0.23.13 before 0.23.45 accepts TLS 1.3 handshake messages at the wrong encryption level when they follow a key-changing message in the same record, because Deframer[network address omitted]ligned does not enforce RFC 8446 record-boundary alignment. A peer or on-path attacker can pack a plaintext EncryptedExtensions…
CVE-2026-123612
rustls 0.23.44 and 0.23.45 contain an information disclosure vulnerability that sends application data buffered before the handshake completes to the client-facing server when Encrypted Client Hello is rejected. Because start_traffic() queues plaintext from ClientConnection[network address omitted]writer() before sending the ech_required alert, the authenticated public_name server receives…
CVE-2026-123611
rustls before 0.23.46 contains a key exchange downgrade vulnerability that allows network attackers to poison the per-server-name key-exchange group record via an unauthenticated ServerHello. Attackers can answer one connection with a ServerHello selecting X25519, causing later ClientHellos to send only classical shares and lose post-quantum confidentiality.
CVE-2026-123610
rustls before 0.23.46 contains an uncontrolled memory allocation flaw in its optional Brotli certificate decompression, which limits decompressed output size but accepts an input-selected large history window. Malicious peers can send a certificate with a five-byte Brotli header requesting up to 1 GiB before authentication, aborting…
CVE-2026-123609
Rustls before 0.23.46 and 0.24.0-dev.1 before 0.24.0-dev.2 contains an information disclosure vulnerability where derived Debug formatting of client session values exposes secret key material. Custom ClientSessionStore implementations that log Tls12ClientSessionValue or Tls13ClientSessionValue can leak TLS 1.2 master secrets or TLS 1.3 resumption PSKs to log readers.
CVE-2026-123608
Hickory DNS hickory-proto from 0.3.1 before 0.26.1 contains a denial of service vulnerability in BinEncoder that allows remote attackers to exhaust CPU through quadratic-time name compression. Attackers can send malicious DNS messages with many records that add many candidate labels and trigger repeated linear scans during…
CVE-2026-123607
Hickory DNS hickory-proto 0.25.0-alpha.3 through 0.25.2 and hickory-net before 0.26.1 contain an unbounded loop vulnerability in DnssecDnsHandle NSEC3 closest-encloser proof validation when the SOA owner is not an ancestor of the QNAME. Upstream attackers can return NoData or NXDomain responses with a cross-zone SOA record to…
CVE-2026-123606
The hickory-dns recursor in hickory-recursor 0.25.0-alpha.3 through 0.25.2 and hickory-resolver 0.26.0-alpha.1 before 0.26.2 iterates every out-of-bailiwick NS target lacking glue in a referral without any per-query work budget. Remote attackers can serve such referrals to force A and AAAA lookups per target, amplifying traffic against remote…
CVE-2026-123605
Hickory DNS hickory-proto 0.1 through 0.25.0-alpha.3 and hickory-net before 0.26.2 contain a DNSSEC validation bypass because the validator verifies an RRSIG against the DNSKEY of whatever name appears in its Signer's Name field without checking that this name is the zone containing the RRset. Attackers controlling…
CVE-2026-123604
Hickory DNS hickory-resolver 0.26.0-beta.1 before 0.26.2 contains an unbounded retry loop in NameServerPool[network address omitted]try_send, which re-queues truncated (TC) responses without checking the answering transport or counting iterations. A malicious authoritative server returning TC=1 on every transport keeps the resolver spinning on a persistent TCP connection…
CVE-2026-123603
hickory-proto and hickory-resolver 0.26.0 before 0.26.2, hickory-server 0.25.0-alpha.1 before 0.26.2, and hickory-recursor 0.25.0-alpha.3 through 0.26.0-alpha.1 fail to canonicalize IPv4-mapped IPv6 addresses when checking deny_answers, deny_server, or AccessControlSet rules. Attackers can use IPv4-mapped addresses to evade answer filtering, trigger queries to denied nameservers, or reach hickory-server library…
CVE-2026-123602
The Hickory DNS recursor in all versions of hickory-recursor and in hickory-resolver 0.26.0-beta.1 before 0.26.2 (recursor feature) is vulnerable to ghost domain names attacks because it reuses child-side apex NS RRsets cached from zone NS queries for iterative resolution. By repeatedly querying a zone's NS records,…
CVE-2026-123601
Hickory DNS hickory-proto 0.25.0 through 0.26.0-alpha.1 and hickory-net 0.26.0-beta.1 before 0.26.2 invert the relational operators in the wrap-around branch of find_covering_record() in nsec3.rs, so the last NSEC3 record in a zone's hash ring covers every hash except its owner. Attackers able to inject DNS responses can…
CVE-2026-123600
Hickory DNS hickory-proto 0.25.0-alpha.3 through 0.25.2 and hickory-net 0.26.0-alpha.1 before 0.26.2 contain a DNSSEC validation flaw in DnssecDnsHandle that accepts NSEC3-signed NODATA responses for zone-apex queries as secure without an NSEC3 record matching the hashed QNAME. On-path attackers or malicious authoritative servers can replay a validly…
CVE-2026-123599
Hickory DNS hickory-proto before 0.26.0-beta.1 and hickory-net before 0.26.2 contain a DNSSEC validation bypass because verify_rrsets() ignores DNS class when partitioning RRsets, so non-IN records skip signature verification yet are marked secure when the IN records verify. Attackers able to supply DNS responses can include forged…
CVE-2026-123598
The validating recursor in Hickory DNS hickory-recursor 0.25.0 through 0.26.0-alpha.1, hickory-resolver 0.26.0-alpha.1 before 0.26.2, and hickory-net 0.26.0-beta.1 before 0.26.2 caches DNSSEC-bogus answers using the untrusted, attacker-supplied record TTL (capped at 24 hours) instead of a short validation-failure TTL. A remote attacker who spoofs a single authoritative…
CVE-2026-123597
Hickory DNS hickory-proto 0.25.0-alpha.1 through 0.26.0-alpha.1 and hickory-net before 0.26.2 contain a logic bug in DnssecDnsHandle's DS-fetch path that caches transient DS lookup errors as Bogus DNSSEC validation verdicts. An attacker who induces a SERVFAIL, REFUSED, or timeout response to a child-zone DS sub-query causes the…
CVE-2026-123596
Hickory DNS hickory-proto through 0.26.0-alpha.1 and hickory-net 0.26.0-beta.1 before 0.26.2 contain a DNSSEC validation flaw in the validating recursor's NSEC handler that accepts parent-side ancestor-delegation NSEC records as proof of nonexistence for names below the zone cut. An on-path attacker, rogue parent nameserver, or attacker winning…
CVE-2026-123595
Hickory DNS hickory-proto 0.25 through 0.26.0-alpha.1 and hickory-net 0.26.0-beta.1 before 0.26.2 contain a DNSSEC validation flaw in the validating recursor's NSEC3 handler, which matches the closest encloser by hash alone without checking the type bitmap and so accepts parent-side ancestor-delegation NSEC3 records as proof of nonexistence.…