Kythos AI vulnerability intelligence
Zero-Day Exploits / Vulnerabilities
A server-rendered, source-attributed view of confirmed CISA KEV entries and all NVD CVEs published in the rolling 48-hour UTC window.
Important distinction: CISA KEV means exploitation has been observed; it does not mean every entry was a zero-day. An NVD publication in the past 48 hours does not mean exploitation has occurred. Source records describe third-party products and do not identify Kythos AI customers, contracts, affiliations, or work history.
Confirmed exploitation intelligence
Zero-Day Exploits / Vulnerabilities
Complete CISA Known Exploited Vulnerabilities catalog, ordered by the date CISA added each entry. Every result is known to be exploited; entries are not necessarily zero-days.
Entries 1,489–1,512 of 1,769
CVE-2021-38648: Microsoft Open Management Infrastructure (OMI) Privilege Escalation Vulnerability
Microsoft · Open Management Infrastructure (OMI)
Microsoft Open Management Infrastructure (OMI) within Azure VM Management Extensions contains an unspecified vulnerability allowing privilege escalation.
Required action: Apply updates per vendor instructions.
CVE-2021-38647: Microsoft Open Management Infrastructure (OMI) Remote Code Execution Vulnerability
Microsoft · Open Management Infrastructure (OMI)
Microsoft Open Management Infrastructure (OMI) within Azure VM Management Extensions contains an unspecified vulnerability allowing remote code execution.
Required action: Apply updates per vendor instructions.
CVE-2021-38645: Microsoft Open Management Infrastructure (OMI) Privilege Escalation Vulnerability
Microsoft · Open Management Infrastructure (OMI)
Microsoft Open Management Infrastructure (OMI) within Azure VM Management Extensions contains an unspecified vulnerability that allows for privilege escalation.
Required action: Apply updates per vendor instructions.
CVE-2021-38003: Google Chromium V8 Memory Corruption Vulnerability
Google · Chromium V8
Google Chromium V8 Engine has a bug in JSON.stringify, where the internal TheHole value can leak to script code, causing memory corruption. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and…
Required action: Apply updates per vendor instructions.
CVE-2021-38000: Google Chromium Intents Improper Input Validation Vulnerability
Google · Chromium Intents
Google Chromium Intents contains an improper input validation vulnerability that allows a remote attacker to arbitrarily browser to a malicious URL via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google…
Required action: Apply updates per vendor instructions.
CVE-2021-37976: Google Chromium Information Disclosure Vulnerability
Google · Chromium
Google Chromium contains an information disclosure vulnerability within the core memory component that allows a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but…
Required action: Apply updates per vendor instructions.
CVE-2021-37975: Google Chromium V8 Use-After-Free Vulnerability
Google · Chromium V8
Google Chromium V8 Engine contains a use-after-free vulnerability that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge,…
Required action: Apply updates per vendor instructions.
CVE-2021-37973: Google Chromium Portals Use-After-Free Vulnerability
Google · Chromium Portals
Google Chromium Portals contains a use-after-free vulnerability that allows a remote attacker, who has compromised the renderer process, to potentially perform a sandbox escape via a crafted HTML page. This vulnerability affects web browsers that utilize Chromium, including Google Chrome and Microsoft…
Required action: Apply updates per vendor instructions.
CVE-2021-36955: Microsoft Windows Common Log File System (CLFS) Driver Privilege Escalation Vulnerability
Microsoft · Windows
Microsoft Windows Common Log File System (CLFS) driver contains an unspecified vulnerability that allows for privilege escalation.
Required action: Apply updates per vendor instructions.
CVE-2021-36948: Microsoft Windows Update Medic Service Privilege Escalation Vulnerability
Microsoft · Windows
Microsoft Windows Update Medic Service contains an unspecified vulnerability that allows for privilege escalation.
Required action: Apply updates per vendor instructions.
CVE-2021-36942: Microsoft Windows Local Security Authority (LSA) Spoofing Vulnerability
Microsoft · Windows
Microsoft Windows Local Security Authority (LSA) contains a spoofing vulnerability allowing an unauthenticated attacker to call a method on the LSARPC interface and coerce the domain controller to authenticate against another server using NTLM.
Required action: Apply updates per vendor instructions.
CVE-2021-36742: Trend Micro Multiple Products Improper Input Validation Vulnerability
Trend Micro · Apex One, Apex One as a Service, and Worry-Free Business Security
Trend Micro Apex One, Apex One as a Service, and Worry-Free Business Security contain an improper input validation vulnerability that allows for privilege escalation.
Required action: Apply updates per vendor instructions.
CVE-2021-36741: Trend Micro Multiple Products Improper Input Validation Vulnerability
Trend Micro · Apex One, Apex One as a Service, and Worry-Free Business Security
Trend Micro Apex One, Apex One as a Service, and Worry-Free Business Security contain an improper input validation vulnerability that allows a remote attacker to upload files.
Required action: Apply updates per vendor instructions.
CVE-2021-35464: ForgeRock Access Management (AM) Core Server Remote Code Execution Vulnerability
ForgeRock · Access Management (AM)
ForgeRock Access Management (AM) Core Server allows an attacker who sends a specially crafted HTTP request to one of three endpoints (/ccversion/Version, /ccversion/Masthead, or /ccversion/ButtonFrame) to execute code in the context of the current user (unless ForgeRock AM is running as root…
Required action: Apply updates per vendor instructions.
CVE-2021-35395: Realtek AP-Router SDK Buffer Overflow Vulnerability
Realtek · AP-Router SDK
Realtek AP-Router SDK HTTP web server boa contains a buffer overflow vulnerability due to unsafe copies of some overly long parameters submitted in the form that lead to denial-of-service (DoS).
Required action: Apply updates per vendor instructions.
CVE-2021-35211: SolarWinds Serv-U Remote Code Execution Vulnerability
SolarWinds · Serv-U
SolarWinds Serv-U contains an unspecified memory escape vulnerability which can allow for remote code execution.
Required action: Apply updates per vendor instructions.
CVE-2021-34527: Microsoft Windows Print Spooler Remote Code Execution Vulnerability
Microsoft · Windows
Microsoft Windows Print Spooler contains an unspecified vulnerability due to the Windows Print Spooler service improperly performing privileged file operations. Successful exploitation allows an attacker to perform remote code execution with SYSTEM privileges. The vulnerability is also known under the moniker of…
Required action: Apply updates per vendor instructions.
CVE-2021-34523: Microsoft Exchange Server Privilege Escalation Vulnerability
Microsoft · Exchange Server
Microsoft Exchange Server contains an unspecified vulnerability that allows for privilege escalation.
Required action: Apply updates per vendor instructions.
CVE-2021-34473: Microsoft Exchange Server Remote Code Execution Vulnerability
Microsoft · Exchange Server
Microsoft Exchange Server contains an unspecified vulnerability that allows for remote code execution.
Required action: Apply updates per vendor instructions.
CVE-2021-34448: Microsoft Windows Scripting Engine Memory Corruption Vulnerability
Microsoft · Windows
Microsoft Windows Scripting Engine contains an unspecified vulnerability that allows for memory corruption.
Required action: Apply updates per vendor instructions.
CVE-2021-33771: Microsoft Windows Kernel Privilege Escalation Vulnerability
Microsoft · Windows
Microsoft Windows kernel contains an unspecified vulnerability that allows for privilege escalation.
Required action: Apply updates per vendor instructions.
CVE-2021-33742: Microsoft Windows MSHTML Platform Remote Code Execution Vulnerability
Microsoft · Windows
Microsoft Windows MSHTML Platform contains an unspecified vulnerability that allows for remote code execution.
Required action: Apply updates per vendor instructions.
CVE-2021-33739: Microsoft Desktop Window Manager (DWM) Core Library Privilege Escalation Vulnerability
Microsoft · Windows
Microsoft Desktop Window Manager (DWM) Core Library contains an unspecified vulnerability that allows for privilege escalation.
Required action: Apply updates per vendor instructions.
CVE-2021-31979: Microsoft Windows Kernel Privilege Escalation Vulnerability
Microsoft · Windows
Microsoft Windows kernel contains an unspecified vulnerability that allows for privilege escalation.
Required action: Apply updates per vendor instructions.
Complete fixed-window snapshot
CVEs — Past 48 Hours
All unique CVEs returned by NVD for the displayed UTC publication window. The snapshot is accepted only when its normalized unique-item count exactly equals the API totalResults value.
Entries 409–432 of 1,041
CVE-2026-17392
IBM API Connect [network address omitted] through [network address omitted] and [network address omitted] through [network address omitted] could allow a remote authenticated attacker to gain unauthorized administrative access to other tenants due to LDAP injection. User-supplied input is not properly neutralized in directory queries, which…
CVE-2026-17391
IBM API Connect [network address omitted] through [network address omitted] and [network address omitted] through [network address omitted] could allow a remote authenticated attacker to obtain sensitive information due to broken object-level authorization.
CVE-2026-17390
IBM API Connect [network address omitted] through [network address omitted] and [network address omitted] through [network address omitted] could allow an authenticated user to execute arbitrary JavaScript in the web UI due to cross-site scripting. This could alter the intended functionality of the page and potentially…
CVE-2026-17389
IBM API Connect [network address omitted] through [network address omitted] and [network address omitted] through [network address omitted] could allow a remote attacker to obtain sensitive information from the connected LDAP directory due to LDAP injection. Input is not properly neutralized in directory lookups, which could…
CVE-2026-17388
IBM API Connect [network address omitted] through [network address omitted] and [network address omitted] through [network address omitted] could allow a remote authenticated attacker to obtain sensitive information due to broken object-level authorization.
CVE-2026-17387
IBM API Connect [network address omitted] through [network address omitted] and [network address omitted] through [network address omitted] could allow a remote authenticated attacker to obtain sensitive information due to broken object-level authorization.
CVE-2026-17386
IBM API Connect [network address omitted] through [network address omitted] could allow a remote attacker to gain full administrative control due to the use of a cryptographically weak pseudo-random number generator.
CVE-2026-17385
IBM API Connect [network address omitted] through [network address omitted] and [network address omitted] through [network address omitted] could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery.
CVE-2026-17384
IBM API Connect [network address omitted] through [network address omitted] could allow a remote authenticated attacker to obtain sensitive information due to a server-side request forgery vulnerability.
CVE-2026-17383
IBM API Connect [network address omitted] through [network address omitted] and [network address omitted] through [network address omitted] could allow a remote authenticated attacker to obtain sensitive information from other tenants due to broken object-level authorization.
CVE-2026-17382
IBM API Connect [network address omitted] through [network address omitted] and [network address omitted] through [network address omitted] could allow a remote authenticated attacker to obtain sensitive information due to a path traversal vulnerability.
CVE-2026-17381
IBM API Connect [network address omitted] through [network address omitted] and [network address omitted] through [network address omitted] could allow a remote authenticated attacker to obtain sensitive information due to improper authorization validation using user-controlled keys.
CVE-2026-17380
IBM API Connect [network address omitted] through [network address omitted] and [network address omitted] through [network address omitted] could allow a remote authenticated attacker to access sensitive information belonging to other tenants due to improper validation of a path parameter. A path value in a request…
CVE-2026-17379
IBM API Connect [network address omitted] through [network address omitted] and [network address omitted] through [network address omitted] could allow a remote attacker to bypass authentication and assign arbitrary roles due to improper verification of cryptographic signatures.
CVE-2026-17378
IBM API Connect [network address omitted] through [network address omitted] and [network address omitted] through [network address omitted] could allow a remote authenticated attacker to obtain sensitive information due to broken object-level authorization.
CVE-2026-17377
IBM API Connect [network address omitted] through [network address omitted] and [network address omitted] through [network address omitted] could allow a remote authenticated attacker to forge audit records due to improper output neutralization for logs.
CVE-2026-17376
IBM API Connect [network address omitted] through [network address omitted] and [network address omitted] through [network address omitted] could allow a remote authenticated attacker to obtain sensitive information due to broken object-level authorization.
CVE-2026-17375
IBM API Connect [network address omitted] through [network address omitted] and [network address omitted] through [network address omitted] could allow a remote authenticated attacker to obtain sensitive information due to improper authorization. Authorization decisions rely on information supplied by the client, which could allow access to…
CVE-2026-17374
IBM API Connect [network address omitted] through [network address omitted] and [network address omitted] through [network address omitted] could allow a remote authenticated attacker to obtain sensitive information due to broken object-level authorization.
CVE-2026-17373
IBM API Connect [network address omitted] through [network address omitted] and [network address omitted] through [network address omitted] could allow a remote authenticated attacker to obtain sensitive information due to improper authorization.
CVE-2026-17372
IBM API Connect [network address omitted] through [network address omitted] and [network address omitted] through [network address omitted] could allow a remote authenticated attacker to probe internal network resources due to insufficient validation of webhook destination URLs. User-configured webhook addresses are not sufficiently restricted, so the…
CVE-2026-17371
IBM API Connect [network address omitted] through [network address omitted] and [network address omitted] through [network address omitted] could allow a remote authenticated attacker to obtain sensitive information due to broken object-level authorization.
CVE-2026-17370
IBM API Connect [network address omitted] through [network address omitted] and [network address omitted] through [network address omitted] could allow a remote authenticated attacker to obtain an access token for another user due to improper authentication. The sign-in flow does not sufficiently verify the identity of…
CVE-2026-17369
IBM API Connect [network address omitted] through [network address omitted] and [network address omitted] through [network address omitted] could allow a remote attacker to force a user to authenticate into an attacker-controlled account due to cross-site request forgery. The sign-in flow does not sufficiently verify that…