Kythos AI vulnerability intelligence
Zero-Day Exploits / Vulnerabilities
A server-rendered, source-attributed view of confirmed CISA KEV entries and all NVD CVEs published in the rolling 48-hour UTC window.
Important distinction: CISA KEV means exploitation has been observed; it does not mean every entry was a zero-day. An NVD publication in the past 48 hours does not mean exploitation has occurred. Source records describe third-party products and do not identify Kythos AI customers, contracts, affiliations, or work history.
Confirmed exploitation intelligence
Zero-Day Exploits / Vulnerabilities
Complete CISA Known Exploited Vulnerabilities catalog, ordered by the date CISA added each entry. Every result is known to be exploited; entries are not necessarily zero-days.
Entries 1,441–1,464 of 1,768
CVE-2020-13671: Drupal core Un-restricted Upload of File
Drupal · Drupal core
Improper sanitization in the extension file names is present in Drupal core.
Required action: Apply updates per vendor instructions.
CVE-2020-11978: Apache Airflow Command Injection
Apache · Airflow
A remote code/command injection vulnerability was discovered in one of the example DAGs shipped with Airflow.
Required action: Apply updates per vendor instructions.
CVE-2021-36260: Hikvision Improper Input Validation
Hikvision · Security cameras web server
A command injection vulnerability in the web server of some Hikvision product. Due to the insufficient input validation.
Required action: Apply updates per vendor instructions.
CVE-2021-27860: FatPipe WARP, IPVPN, and MPVPN Configuration Upload exploit
FatPipe · WARP, IPVPN, and MPVPN software
A vulnerability in the web management interface of FatPipe WARP, IPVPN, and MPVPN software allows a remote, unauthenticated attacker to upload a file to any location on the filesystem.
Required action: Apply updates per vendor instructions.
CVE-2021-22017: VMware vCenter Server Improper Access Control
VMware · vCenter Server
Rhttproxy as used in vCenter Server contains a vulnerability due to improper implementation of URI normalization.
Required action: Apply updates per vendor instructions.
CVE-2020-6572: Google Chrome Media Use-After-Free Vulnerability
Google · Chrome Media
Google Chrome Media contains a use-after-free vulnerability that allows a remote attacker to execute code via a crafted HTML page.
Required action: Apply updates per vendor instructions.
CVE-2019-9670: Synacor Zimbra Collaboration Suite (ZCS) Improper Restriction of XML External Entity Reference
Synacor · Zimbra Collaboration Suite (ZCS)
Synacor Zimbra Collaboration Suite (ZCS) contains an improper restriction of XML external entity (XXE) vulnerability in the mailboxd component.
Required action: Apply updates per vendor instructions.
CVE-2019-7609: Kibana Arbitrary Code Execution
Elastic · Kibana
Kibana contain an arbitrary code execution flaw in the Timelion visualizer.
Required action: Apply updates per vendor instructions.
CVE-2019-2725: Oracle WebLogic Server, Injection
Oracle · WebLogic Server
Injection vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: Web Services).
Required action: Apply updates per vendor instructions.
CVE-2019-1579: Palo Alto Networks PAN-OS Remote Code Execution Vulnerability
Palo Alto Networks · PAN-OS
Remote Code Execution in PAN-OS with GlobalProtect Portal or GlobalProtect Gateway Interface enabled.
Required action: Apply updates per vendor instructions.
CVE-2019-1458: Microsoft Win32k Privilege Escalation Vulnerability
Microsoft · Win32k
A privilege escalation vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory, aka 'Win32k EoP.
Required action: Apply updates per vendor instructions.
CVE-2019-10149: Exim Mail Transfer Agent (MTA) Improper Input Validation
Exim · Mail Transfer Agent (MTA)
Improper validation of recipient address in deliver_message() function in /src/deliver.c may lead to remote command execution.
Required action: Apply updates per vendor instructions.
CVE-2018-13383: Fortinet FortiOS and FortiProxy Out-of-bounds Write
Fortinet · FortiOS and FortiProxy
A heap buffer overflow in Fortinet FortiOS and FortiProxy may cause the SSL VPN web service termination for logged in users.
Required action: Apply updates per vendor instructions.
CVE-2018-13382: Fortinet FortiOS and FortiProxy Improper Authorization
Fortinet · FortiOS and FortiProxy
An Improper Authorization vulnerability in Fortinet FortiOS and FortiProxy under SSL VPN web portal allows an unauthenticated attacker to modify the password.
Required action: Apply updates per vendor instructions.
CVE-2017-1000486: Primetek Primefaces Remote Code Execution Vulnerability
Primetek · Primefaces Application
Primetek Primefaces is vulnerable to a weak encryption flaw resulting in remote code execution
Required action: Apply updates per vendor instructions.
CVE-2015-7450: IBM WebSphere Application Server and Server Hypervisor Edition Code Injection.
IBM · WebSphere Application Server and Server Hypervisor Edition
Serialized-object interfaces in certain IBM analytics, business solutions, cognitive, IT infrastructure, and mobile and social products allow remote attackers to execute arbitrary commands
Required action: Apply updates per vendor instructions.
CVE-2013-3900: Microsoft WinVerifyTrust function Remote Code Execution
Microsoft · WinVerifyTrust function
A remote code execution vulnerability exists in the way that the WinVerifyTrust function handles Windows Authenticode signature verification for PE files.
Required action: Apply updates per vendor instructions.
CVE-2021-43890: Microsoft Windows AppX Installer Spoofing Vulnerability
Microsoft · Windows
Microsoft Windows AppX Installer contains a spoofing vulnerability which has a high impacts to confidentiality, integrity, and availability.
Required action: Apply updates per vendor instructions.
CVE-2021-4102: Google Chromium V8 Use-After-Free Vulnerability
Google · Chromium V8
Google Chromium V8 Engine contains a use-after-free vulnerability that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge,…
Required action: Apply updates per vendor instructions.
CVE-2021-44515: Zoho Desktop Central Authentication Bypass Vulnerability
Zoho · Desktop Central
Zoho Desktop Central contains an authentication bypass vulnerability that could allow an attacker to execute arbitrary code in the Desktop Central MSP server.
Required action: Apply updates per vendor instructions.
CVE-2021-44228: Apache Log4j2 Remote Code Execution Vulnerability
Apache · Log4j2
Apache Log4j2 contains a vulnerability where JNDI features do not protect against attacker-controlled JNDI-related endpoints, allowing for remote code execution.
Required action: For all affected software assets for which updates exist, the only acceptable remediation actions are: 1) Apply updates; OR 2) remove affected assets from agency networks. Temporary mitigations using one of the measures provided at…
CVE-2021-44168: Fortinet FortiOS Arbitrary File Download
Fortinet · FortiOS
Fortinet FortiOS "execute restore src-vis" downloads code without integrity checking, allowing an attacker to arbitrarily download files.
Required action: Apply updates per vendor instructions.
CVE-2021-35394: Realtek Jungle SDK Remote Code Execution Vulnerability
Realtek · Jungle Software Development Kit (SDK)
RealTek Jungle SDK contains multiple memory corruption vulnerabilities which can allow an attacker to perform remote code execution.
Required action: Apply updates per vendor instructions.
CVE-2020-8816: Pi-Hole AdminLTE Remote Code Execution Vulnerability
Pi-hole · AdminLTE
Pi-hole Web v4.3.2 (aka AdminLTE) allows Remote Code Execution by privileged dashboard users via a crafted DHCP static lease.
Required action: Apply updates per vendor instructions.
Complete fixed-window snapshot
CVEs — Past 48 Hours
All unique CVEs returned by NVD for the displayed UTC publication window. The snapshot is accepted only when its normalized unique-item count exactly equals the API totalResults value.
Entries 1,129–1,152 of 1,338
CVE-2026-121240
Improper input validation in Variations in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass system access restrictions via crafted network traffic. (Chromium security severity: Low)
CVE-2026-121239
Information leak in Core in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-121238
Use after free in Source in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-121237
Improper state validation in FileSystem in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-121236
Improper input validation in Network in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: Low)
CVE-2026-121235
Information leak in Paint in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to obtain sensitive information via a crafted HTML page. (Chromium security severity: Low)
CVE-2026-121234
Privilege elevation in Contacts in Google Chrome on on Android prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-121233
Type confusion in CacheStorage in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
CVE-2026-121232
Incorrect authorization in Core in Google Chrome prior to 157.0.8103.38 allowed a local attacker leveraging social engineering to obtain sensitive information via a co-installed app. (Chromium security severity: Low)
CVE-2026-121231
Incorrect authorization in DevTools in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-121230
Race condition in ANGLE in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Low)
CVE-2026-121229
Memory corruption in ANGLE in Google Chrome on on Android prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)
CVE-2026-121228
Type confusion in V8 in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
CVE-2026-121227
Uninitialized resource in Skia in Google Chrome prior to 157.0.8103.38 allowed a remote attacker who had compromised the renderer process to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: High)
CVE-2026-121226
Type confusion in V8 in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
CVE-2026-121225
Incorrect authorization in Permissions in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Low)
CVE-2026-121224
Security issue in Desktop in Google Chrome on on Mac prior to 157.0.8103.38 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via crafted network traffic. (Chromium security severity: High)
CVE-2026-121223
Observable discrepancy in Media in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-121222
Incorrect authorization in Forms in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: Low)
CVE-2026-121221
Type confusion in V8 in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
CVE-2026-121220
Incorrect authorization in Core in Google Chrome prior to 157.0.8103.38 allowed a remote attacker who had compromised the renderer process to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-121219
Integer overflow in GPU in Google Chrome prior to 157.0.8103.38 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-121218
Type confusion in V8 in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-121217
Use after free in Streaming in Google Chrome prior to 157.0.8103.38 allowed an adjacent attacker to execute arbitrary code inside the sandbox via crafted network traffic. (Chromium security severity: Low)