Kythos AI vulnerability intelligence
Zero-Day Exploits / Vulnerabilities
A server-rendered, source-attributed view of confirmed CISA KEV entries and all NVD CVEs published in the rolling 48-hour UTC window.
Important distinction: CISA KEV means exploitation has been observed; it does not mean every entry was a zero-day. An NVD publication in the past 48 hours does not mean exploitation has occurred. Source records describe third-party products and do not identify Kythos AI customers, contracts, affiliations, or work history.
Confirmed exploitation intelligence
Zero-Day Exploits / Vulnerabilities
Complete CISA Known Exploited Vulnerabilities catalog, ordered by the date CISA added each entry. Every result is known to be exploited; entries are not necessarily zero-days.
Entries 1,441–1,464 of 1,769
CVE-2020-13927: Apache Airflow's Experimental API Authentication Bypass
Apache · Airflow's Experimental API
The previous default setting for Airflow's Experimental API was to allow all API requests without authentication.
Required action: Apply updates per vendor instructions.
CVE-2020-13671: Drupal core Un-restricted Upload of File
Drupal · Drupal core
Improper sanitization in the extension file names is present in Drupal core.
Required action: Apply updates per vendor instructions.
CVE-2020-11978: Apache Airflow Command Injection
Apache · Airflow
A remote code/command injection vulnerability was discovered in one of the example DAGs shipped with Airflow.
Required action: Apply updates per vendor instructions.
CVE-2021-36260: Hikvision Improper Input Validation
Hikvision · Security cameras web server
A command injection vulnerability in the web server of some Hikvision product. Due to the insufficient input validation.
Required action: Apply updates per vendor instructions.
CVE-2021-27860: FatPipe WARP, IPVPN, and MPVPN Configuration Upload exploit
FatPipe · WARP, IPVPN, and MPVPN software
A vulnerability in the web management interface of FatPipe WARP, IPVPN, and MPVPN software allows a remote, unauthenticated attacker to upload a file to any location on the filesystem.
Required action: Apply updates per vendor instructions.
CVE-2021-22017: VMware vCenter Server Improper Access Control
VMware · vCenter Server
Rhttproxy as used in vCenter Server contains a vulnerability due to improper implementation of URI normalization.
Required action: Apply updates per vendor instructions.
CVE-2020-6572: Google Chrome Media Use-After-Free Vulnerability
Google · Chrome Media
Google Chrome Media contains a use-after-free vulnerability that allows a remote attacker to execute code via a crafted HTML page.
Required action: Apply updates per vendor instructions.
CVE-2019-9670: Synacor Zimbra Collaboration Suite (ZCS) Improper Restriction of XML External Entity Reference
Synacor · Zimbra Collaboration Suite (ZCS)
Synacor Zimbra Collaboration Suite (ZCS) contains an improper restriction of XML external entity (XXE) vulnerability in the mailboxd component.
Required action: Apply updates per vendor instructions.
CVE-2019-7609: Kibana Arbitrary Code Execution
Elastic · Kibana
Kibana contain an arbitrary code execution flaw in the Timelion visualizer.
Required action: Apply updates per vendor instructions.
CVE-2019-2725: Oracle WebLogic Server, Injection
Oracle · WebLogic Server
Injection vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: Web Services).
Required action: Apply updates per vendor instructions.
CVE-2019-1579: Palo Alto Networks PAN-OS Remote Code Execution Vulnerability
Palo Alto Networks · PAN-OS
Remote Code Execution in PAN-OS with GlobalProtect Portal or GlobalProtect Gateway Interface enabled.
Required action: Apply updates per vendor instructions.
CVE-2019-1458: Microsoft Win32k Privilege Escalation Vulnerability
Microsoft · Win32k
A privilege escalation vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory, aka 'Win32k EoP.
Required action: Apply updates per vendor instructions.
CVE-2019-10149: Exim Mail Transfer Agent (MTA) Improper Input Validation
Exim · Mail Transfer Agent (MTA)
Improper validation of recipient address in deliver_message() function in /src/deliver.c may lead to remote command execution.
Required action: Apply updates per vendor instructions.
CVE-2018-13383: Fortinet FortiOS and FortiProxy Out-of-bounds Write
Fortinet · FortiOS and FortiProxy
A heap buffer overflow in Fortinet FortiOS and FortiProxy may cause the SSL VPN web service termination for logged in users.
Required action: Apply updates per vendor instructions.
CVE-2018-13382: Fortinet FortiOS and FortiProxy Improper Authorization
Fortinet · FortiOS and FortiProxy
An Improper Authorization vulnerability in Fortinet FortiOS and FortiProxy under SSL VPN web portal allows an unauthenticated attacker to modify the password.
Required action: Apply updates per vendor instructions.
CVE-2017-1000486: Primetek Primefaces Remote Code Execution Vulnerability
Primetek · Primefaces Application
Primetek Primefaces is vulnerable to a weak encryption flaw resulting in remote code execution
Required action: Apply updates per vendor instructions.
CVE-2015-7450: IBM WebSphere Application Server and Server Hypervisor Edition Code Injection.
IBM · WebSphere Application Server and Server Hypervisor Edition
Serialized-object interfaces in certain IBM analytics, business solutions, cognitive, IT infrastructure, and mobile and social products allow remote attackers to execute arbitrary commands
Required action: Apply updates per vendor instructions.
CVE-2013-3900: Microsoft WinVerifyTrust function Remote Code Execution
Microsoft · WinVerifyTrust function
A remote code execution vulnerability exists in the way that the WinVerifyTrust function handles Windows Authenticode signature verification for PE files.
Required action: Apply updates per vendor instructions.
CVE-2021-43890: Microsoft Windows AppX Installer Spoofing Vulnerability
Microsoft · Windows
Microsoft Windows AppX Installer contains a spoofing vulnerability which has a high impacts to confidentiality, integrity, and availability.
Required action: Apply updates per vendor instructions.
CVE-2021-4102: Google Chromium V8 Use-After-Free Vulnerability
Google · Chromium V8
Google Chromium V8 Engine contains a use-after-free vulnerability that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge,…
Required action: Apply updates per vendor instructions.
CVE-2021-44515: Zoho Desktop Central Authentication Bypass Vulnerability
Zoho · Desktop Central
Zoho Desktop Central contains an authentication bypass vulnerability that could allow an attacker to execute arbitrary code in the Desktop Central MSP server.
Required action: Apply updates per vendor instructions.
CVE-2021-44228: Apache Log4j2 Remote Code Execution Vulnerability
Apache · Log4j2
Apache Log4j2 contains a vulnerability where JNDI features do not protect against attacker-controlled JNDI-related endpoints, allowing for remote code execution.
Required action: For all affected software assets for which updates exist, the only acceptable remediation actions are: 1) Apply updates; OR 2) remove affected assets from agency networks. Temporary mitigations using one of the measures provided at…
CVE-2021-44168: Fortinet FortiOS Arbitrary File Download
Fortinet · FortiOS
Fortinet FortiOS "execute restore src-vis" downloads code without integrity checking, allowing an attacker to arbitrarily download files.
Required action: Apply updates per vendor instructions.
CVE-2021-35394: Realtek Jungle SDK Remote Code Execution Vulnerability
Realtek · Jungle Software Development Kit (SDK)
RealTek Jungle SDK contains multiple memory corruption vulnerabilities which can allow an attacker to perform remote code execution.
Required action: Apply updates per vendor instructions.
Complete fixed-window snapshot
CVEs — Past 48 Hours
All unique CVEs returned by NVD for the displayed UTC publication window. The snapshot is accepted only when its normalized unique-item count exactly equals the API totalResults value.
Entries 1,009–1,032 of 1,057
CVE-2026-119488
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Shamim Rajani Pie Register pie-register allows Stored XSS.This issue affects Pie Register: from n/a through [network address omitted].
CVE-2026-119472
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in David Anderson Redux Framework redux-framework allows Stored XSS.This issue affects Redux Framework: from n/a through 4.5.16.
CVE-2026-118423
The WP Libre Form WordPress plugin [network address omitted] does not validate the type of files uploaded through its form submissions, allowing unauthenticated attackers to upload PHP files to a web-accessible location and execute them, leading to remote code execution.
CVE-2026-118166
The MC4WP: Mailchimp for WordPress WordPress plugin before 4.15.0 does not prevent request-derived values in its dynamic content tags from being processed as shortcodes when a form is embedded with its block, allowing unauthenticated visitors to execute arbitrary registered shortcodes with attacker-chosen attributes. This requires the…
CVE-2026-9797
A flaw was found in Keycloak's administrative services (org.keycloak.services.resources.admin). A highly privileged attacker, authenticated with a 'manage-clients' role, could exploit this vulnerability through several methods, including manipulating client JSON Web Key Sets (JWKS), swapping client authenticator types and resetting secrets, or downloading legitimate signing keys. Successful…
CVE-2026-83494
A flaw was found in the training-operator. An incorrect object casting in the PyTorchJob ValidateUpdate webhook allows users to bypass an immutability check. This vulnerability could enable users to detach a queued job from its quota management system or hijack a running job's controller ownership. The…
CVE-2026-83493
A flaw was found in distributed-workloads. A remote attacker could exploit a vulnerability in the pull_request_target workflow by submitting a specially crafted pull request. This workflow processes untrusted code from the pull request author while operating with the base repository's sensitive secrets, such as the SNYK_TOKEN,…
CVE-2026-73473
A flaw was found in GStreamer gst-plugins-good (avidemux). In the subindex parser, missing validation of the entry count can cause excessive memory allocation and denial of service. Because avidemux is auto-plugged by playbin, decodebin, and gst-discoverer, opening or previewing a crafted AVI is sufficient to trigger…
CVE-2026-73472
A flaw was found in GStreamer gst-plugins-good (avidemux). In the superindex and subindex parsers, integer overflow can bypass bounds checks and cause out-of-bounds reads. Because avidemux is auto-plugged by playbin, decodebin, and gst-discoverer, opening or previewing a crafted AVI is sufficient to trigger the issue. Fixed…
CVE-2026-73471
A flaw was found in GStreamer gst-plugins-good (avidemux). In the Nikon metadata tag parser, a pointer can be dereferenced without verifying that data remains in the buffer, causing out-of-bounds reads. Because avidemux is auto-plugged by playbin, decodebin, and gst-discoverer, opening or previewing a crafted AVI is…
CVE-2026-120749
A flaw was found in D-Bus. With a privileged Monitoring client attached (for example dbus-monitor or busctl monitor), an unprivileged local user can cause dbus-daemon to abort if a driver-originated broadcast such as NameOwnerChanged or ActivatableServicesChanged cannot be delivered to a recipient (for example due to…
CVE-2026-97848
A flaw was found in the token sanitization logic of Keycloak, an open source identity and access management solution. The issue occurs when a protocol mapper is configured to emit structured claims using the JSON type. The security check designed to remove unauthorized role mappings only…
CVE-2026-97367
A flaw was found in the Keycloak Account REST API where it incorrectly handles session identification. A malicious client owner can manipulate their own security tokens to point to a different user's active session. This allows the attacker to access and modify the victim's account information,…
CVE-2026-96547
A flaw was found in the Dynamic Client Registration component of Keycloak, an open-source identity and access management solution. The issue occurs because the system does not properly restrict which claim names can be used when setting up new clients. An attacker with valid registration credentials…
CVE-2026-96460
A flaw was found in the token exchange mechanism of Keycloak. When using Standard Token Exchange V2, the system issues new tokens with a fresh lifetime based on the requester clients configuration instead of limiting it to the original tokens expiration. This issue allows an authenticated…
CVE-2026-96447
A flaw was found in the TokenManager component of Keycloak, an open-source identity and access management solution. The issue occurs during the validation of stateless access tokens when the original user ID no longer exists. Keycloak incorrectly falls back to using the username to identify the…
CVE-2026-92856
A flaw was found in the SAML brokering component of Keycloak, an identity and access management solution. The issue occurs when Keycloak acts as an intermediary between an upstream identity provider and downstream services. Keycloak fails to respect specific security instructions called ProxyRestrictions in the login…
CVE-2026-92396
The ShopEngine Gutenberg WooCommerce Builder Blocks Addon WordPress plugin before 2.4.4 does not validate the user's capabilities or the ownership of the targeted post in one of its AJAX actions, and does not escape the stored value before outputting it in a JavaScript context, allowing users…
CVE-2026-87784
The Cool Media Filter WordPress plugin through 1.0.1 does not perform any capability or nonce check when updating the capabilities of a role, allowing any authenticated user, such as a subscriber, to grant their own role administrator capabilities and take over the site.
CVE-2026-86606
The iubenda | All-in-one Compliance for GDPR / CCPA Cookie Consent + more WordPress plugin before 3.13.7 does not properly escape content it re-emits through its bundled HTML parser, allowing unauthenticated users to inject arbitrary web scripts in pages that will execute in the session of…
CVE-2026-19688
A flaw was found in the Admin REST API of Keycloak, an identity and access management solution. The Admin API fails to verify the intended audience of bearer tokens during authentication. This issue allows an attacker who operates a client within a realm to capture an…
CVE-2026-12967
The WCFM Membership WordPress plugin before 2.12.1 does not verify that payment was made before completing a paid membership, allowing any authenticated Subscriber/Customer to activate a paid vendor membership for free and gain the marketplace vendor role.
CVE-2026-123037
A flaw was found in the ansible-core user module. When generate_ssh_key is enabled, User.ssh_key_gen() guards the key files against symlinks but checks the ~/.ssh directory only with os.path.exists(). An unprivileged user on a managed node who replaces their ~/.ssh with a symlink to an existing root-writable…
CVE-2026-121837
A flaw was found in the REST Data Panache component of Quarkus. When a security constraint is applied to an entity property using the @SecureField annotation on its getter method rather than the field itself, the generated REST resource fails to enforce this constraint for filtering…