Kythos AI vulnerability intelligence

Zero-Day Exploits / Vulnerabilities

A server-rendered, source-attributed view of confirmed CISA KEV entries and all NVD CVEs published in the rolling 48-hour UTC window.

Important distinction: CISA KEV means exploitation has been observed; it does not mean every entry was a zero-day. An NVD publication in the past 48 hours does not mean exploitation has occurred. Source records describe third-party products and do not identify Kythos AI customers, contracts, affiliations, or work history.

CISA KEV catalog NVD 48-hour CVEs Kythos AI RSS feed

Confirmed exploitation intelligence

Zero-Day Exploits / Vulnerabilities

Complete CISA Known Exploited Vulnerabilities catalog, ordered by the date CISA added each entry. Every result is known to be exploited; entries are not necessarily zero-days.

Current snapshot

Entries 1,393–1,416 of 1,769

CISA KEVAdded Feb 15, 2022

CVE-2022-24086: Adobe Commerce and Magento Open Source Improper Input Validation Vulnerability

Adobe · Commerce and Magento Open Source

Adobe Commerce and Magento Open Source contain an improper input validation vulnerability which can allow for arbitrary code execution.

Federal remediation due Mar 1, 2022Ransomware use: Not confirmed by CISA

Required action: Apply updates per vendor instructions.

View in the CISA KEV catalog →

CISA KEVAdded Feb 15, 2022

CVE-2022-0609: Google Chromium Animation Use-After-Free Vulnerability

Google · Chromium Animation

Google Chromium Animation contains a use-after-free vulnerability that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and…

Federal remediation due Mar 1, 2022Ransomware use: Not confirmed by CISA

Required action: Apply updates per vendor instructions.

View in the CISA KEV catalog →

CISA KEVAdded Feb 15, 2022

CVE-2019-0752: Microsoft Internet Explorer Type Confusion Vulnerability

Microsoft · Internet Explorer

A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer

Federal remediation due Aug 15, 2022Ransomware use: Known

Required action: Apply updates per vendor instructions.

View in the CISA KEV catalog →

CISA KEVAdded Feb 15, 2022

CVE-2018-8174: Microsoft Windows VBScript Engine Out-of-Bounds Write Vulnerability

Microsoft · Windows

A remote code execution vulnerability exists in the way that the VBScript engine handles objects in memory, aka "Windows VBScript Engine Remote Code Execution"

Federal remediation due Aug 15, 2022Ransomware use: Known

Required action: Apply updates per vendor instructions.

View in the CISA KEV catalog →

CISA KEVAdded Feb 15, 2022

CVE-2018-20250: WinRAR Absolute Path Traversal Vulnerability

RARLAB · WinRAR

WinRAR Absolute Path Traversal vulnerability leads to Remote Code Execution

Federal remediation due Aug 15, 2022Ransomware use: Known

Required action: Apply updates per vendor instructions.

View in the CISA KEV catalog →

CISA KEVAdded Feb 15, 2022

CVE-2018-15982: Adobe Flash Player Use-After-Free Vulnerability

Adobe · Flash Player

Adobe Flash Player com.adobe.tvsdk.mediacore.metadata Use After Free Vulnerability

Federal remediation due Aug 15, 2022Ransomware use: Known

Required action: The impacted product is end-of-life and should be disconnected if still in use.

View in the CISA KEV catalog →

CISA KEVAdded Feb 15, 2022

CVE-2017-9841: PHPUnit Command Injection Vulnerability

PHPUnit · PHPUnit

PHPUnit allows remote attackers to execute arbitrary PHP code via HTTP POST data beginning with a "

Federal remediation due Aug 15, 2022Ransomware use: Not confirmed by CISA

Required action: Apply updates per vendor instructions.

View in the CISA KEV catalog →

CISA KEVAdded Feb 15, 2022

CVE-2014-1761: Microsoft Word Memory Corruption Vulnerability

Microsoft · Word

Microsoft Word contains a memory corruption vulnerability which when exploited could allow for remote code execution.

Federal remediation due Aug 15, 2022Ransomware use: Not confirmed by CISA

Required action: Apply updates per vendor instructions.

View in the CISA KEV catalog →

CISA KEVAdded Feb 15, 2022

CVE-2013-3906: Microsoft Graphics Component Memory Corruption Vulnerability

Microsoft · Graphics Component

Microsoft Graphics Component contains a memory corruption vulnerability which can allow for remote code execution.

Federal remediation due Aug 15, 2022Ransomware use: Not confirmed by CISA

Required action: Apply updates per vendor instructions.

View in the CISA KEV catalog →

CISA KEVAdded Feb 11, 2022

CVE-2022-22620: Apple iOS, iPadOS, and macOS Webkit Use-After-Free Vulnerability

Apple · iOS, iPadOS, and macOS

Apple iOS, iPadOS, and macOS WebKit contain a use-after-free vulnerability that leads to code execution when processing maliciously crafted web content. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely…

Federal remediation due Feb 25, 2022Ransomware use: Not confirmed by CISA

Required action: Apply updates per vendor instructions.

View in the CISA KEV catalog →

CISA KEVAdded Feb 10, 2022

CVE-2021-36934: Microsoft Windows SAM Local Privilege Escalation Vulnerability

Microsoft · Windows

If a Volume Shadow Copy (VSS) shadow copy of the system drive is available, users can read the SAM file which would allow any user to escalate privileges to SYSTEM level.

Federal remediation due Feb 24, 2022Ransomware use: Not confirmed by CISA

Required action: Apply updates per vendor instructions.

View in the CISA KEV catalog →

CISA KEVAdded Feb 10, 2022

CVE-2020-0796: Microsoft SMBv3 Remote Code Execution Vulnerability

Microsoft · SMBv3

A remote code execution vulnerability exists in the way that the Microsoft Server Message Block 3.1.1 (SMBv3) protocol handles certain requests. An attacker who successfully exploited the vulnerability could gain the ability to execute code on the target server or client.

Federal remediation due Aug 10, 2022Ransomware use: Known

Required action: Apply updates per vendor instructions.

View in the CISA KEV catalog →

CISA KEVAdded Feb 10, 2022

CVE-2018-1000861: Jenkins Stapler Web Framework Deserialization of Untrusted Data Vulnerability

Jenkins · Jenkins Stapler Web Framework

A code execution vulnerability exists in the Stapler web framework used by Jenkins

Federal remediation due Aug 10, 2022Ransomware use: Not confirmed by CISA

Required action: Apply updates per vendor instructions.

View in the CISA KEV catalog →

CISA KEVAdded Feb 10, 2022

CVE-2017-9791: Apache Struts 1 Improper Input Validation Vulnerability

Apache · Struts 1

The Struts 1 plugin in Apache Struts might allow remote code execution via a malicious field value passed in a raw message to the ActionMessage.

Federal remediation due Aug 10, 2022Ransomware use: Not confirmed by CISA

Required action: Apply updates per vendor instructions.

View in the CISA KEV catalog →

CISA KEVAdded Feb 10, 2022

CVE-2017-8464: Microsoft Windows Shell (.lnk) Remote Code Execution Vulnerability

Microsoft · Windows

Windows Shell in multiple versions of Microsoft Windows allows local users or remote attackers to execute arbitrary code via a crafted .LNK file

Federal remediation due Aug 10, 2022Ransomware use: Not confirmed by CISA

Required action: Apply updates per vendor instructions.

View in the CISA KEV catalog →

CISA KEVAdded Feb 10, 2022

CVE-2017-10271: Oracle Corporation WebLogic Server Remote Code Execution Vulnerability

Oracle · WebLogic Server

Oracle Corporation WebLogic Server contains a vulnerability that allows for remote code execution.

Federal remediation due Aug 10, 2022Ransomware use: Known

Required action: Apply updates per vendor instructions.

View in the CISA KEV catalog →

CISA KEVAdded Feb 10, 2022

CVE-2017-0263: Microsoft Win32k Privilege Escalation Vulnerability

Microsoft · Win32k

Microsoft Win32k contains a privilege escalation vulnerability due to the Windows kernel-mode driver failing to properly handle objects in memory.

Federal remediation due Aug 10, 2022Ransomware use: Not confirmed by CISA

Required action: Apply updates per vendor instructions.

View in the CISA KEV catalog →

CISA KEVAdded Feb 10, 2022

CVE-2017-0262: Microsoft Office Remote Code Execution Vulnerability

Microsoft · Office

A remote code execution vulnerability exists in Microsoft Office.

Federal remediation due Aug 10, 2022Ransomware use: Not confirmed by CISA

Required action: Apply updates per vendor instructions.

View in the CISA KEV catalog →

CISA KEVAdded Feb 10, 2022

CVE-2017-0145: Microsoft SMBv1 Remote Code Execution Vulnerability

Microsoft · SMBv1

The SMBv1 server in multiple Microsoft Windows versions allows remote attackers to execute arbitrary code via crafted packets.

Federal remediation due Aug 10, 2022Ransomware use: Known

Required action: Apply updates per vendor instructions.

View in the CISA KEV catalog →

CISA KEVAdded Feb 10, 2022

CVE-2017-0144: Microsoft SMBv1 Remote Code Execution Vulnerability

Microsoft · SMBv1

The SMBv1 server in multiple Microsoft Windows versions allows remote attackers to execute arbitrary code via crafted packets.

Federal remediation due Aug 10, 2022Ransomware use: Known

Required action: Apply updates per vendor instructions.

View in the CISA KEV catalog →

CISA KEVAdded Feb 10, 2022

CVE-2016-3088: Apache ActiveMQ Improper Input Validation Vulnerability

Apache · ActiveMQ

The Fileserver web application in Apache ActiveMQ allows remote attackers to upload and execute arbitrary files via an HTTP PUT followed by an HTTP MOVE request

Federal remediation due Aug 10, 2022Ransomware use: Not confirmed by CISA

Required action: Apply updates per vendor instructions.

View in the CISA KEV catalog →

CISA KEVAdded Feb 10, 2022

CVE-2015-2051: D-Link DIR-645 Router Remote Code Execution Vulnerability

D-Link · DIR-645 Router

D-Link DIR-645 Wired/Wireless Router allows remote attackers to execute arbitrary commands via a GetDeviceSettings action to the HNAP interface.

Federal remediation due Aug 10, 2022Ransomware use: Not confirmed by CISA

Required action: The impacted product is end-of-life and should be disconnected if still in use.

View in the CISA KEV catalog →

CISA KEVAdded Feb 10, 2022

CVE-2015-1635: Microsoft HTTP.sys Remote Code Execution Vulnerability

Microsoft · HTTP.sys

Microsoft HTTP protocol stack (HTTP.sys) contains a vulnerability that allows for remote code execution.

Federal remediation due Aug 10, 2022Ransomware use: Not confirmed by CISA

Required action: Apply updates per vendor instructions.

View in the CISA KEV catalog →

CISA KEVAdded Feb 10, 2022

CVE-2015-1130: Apple OS X Authentication Bypass Vulnerability

Apple · OS X

The XPC implementation in Admin Framework in Apple OS X before 10.10.3 allows local users to bypass authentication and obtain admin privileges.

Federal remediation due Aug 10, 2022Ransomware use: Not confirmed by CISA

Required action: Apply updates per vendor instructions.

View in the CISA KEV catalog →

Source: Official CISA KEV JSONCatalog released Nov 6, 2026, 7:44 PM GMT+0000Site snapshot: Nov 7, 2026, 8:27 AM GMT+0000Showing 24 of 1,769Source text normalized: network addresses and restricted context omittedRefresh interval: 30 minutes

Complete fixed-window snapshot

CVEs — Past 48 Hours

All unique CVEs returned by NVD for the displayed UTC publication window. The snapshot is accepted only when its normalized unique-item count exactly equals the API totalResults value.

Current snapshot

Entries 1,153–1,176 of 1,317

NVD CVEPublished Nov 5, 2026, 4:17 PM GMT+0000