Kythos AI

CVE watch Past 48 hours+

Latest 48 of 1034 in cacheBrowse CVEs
NVD checked Nov 8, 04:27 UTCSource: NVD · Refreshed every 2 hours · Publication may lag

Kythos AI vulnerability intelligence

Zero-Day Exploits / Vulnerabilities

A server-rendered, source-attributed view of confirmed CISA KEV entries and all NVD CVEs published in the rolling 48-hour UTC window.

Important distinction: CISA KEV means exploitation has been observed; it does not mean every entry was a zero-day. An NVD publication in the past 48 hours does not mean exploitation has occurred. Source records describe third-party products and do not identify Kythos AI customers, contracts, affiliations, or work history.

CISA KEV catalogNVD 48-hour CVEsKythos AI RSS feed

Confirmed exploitation intelligence

Zero-Day Exploits / Vulnerabilities

Complete CISA Known Exploited Vulnerabilities catalog, ordered by the date CISA added each entry. Every result is known to be exploited; entries are not necessarily zero-days.

Current snapshot

Entries 1,513–1,536 of 1,769

CISA KEV

CVE-2021-30860: Apple Multiple Products Integer Overflow Vulnerability

Apple · Multiple Products

Apple iOS, iPadOS, macOS, and watchOS CoreGraphics contain an integer overflow vulnerability which may allow code execution when processing a maliciously crafted PDF. The vulnerability is also known under the moniker of FORCEDENTRY.

Federal remediation due Nov 17, 2021Ransomware use: Not confirmed by CISA

Required action: Apply updates per vendor instructions.

View in the CISA KEV catalog →

CISA KEV

CVE-2021-30858: Apple iOS, iPadOS, macOS Use-After-Free Vulnerability

Apple · iOS, iPadOS, and macOS

Apple iOS, iPadOS, and macOS WebKit contain a use-after-free vulnerability that leads to code execution when processing maliciously crafted web content. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely…

Federal remediation due Nov 17, 2021Ransomware use: Not confirmed by CISA

Required action: Apply updates per vendor instructions.

View in the CISA KEV catalog →

CISA KEV

CVE-2021-30762: Apple iOS WebKit Use-After-Free Vulnerability

Apple · iOS

Apple iOS WebKit contains a use-after-free vulnerability that leads to code execution when processing maliciously crafted web content. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for…

Federal remediation due Nov 17, 2021Ransomware use: Not confirmed by CISA

Required action: Apply updates per vendor instructions.

View in the CISA KEV catalog →

CISA KEV

CVE-2021-30761: Apple iOS WebKit Memory Corruption Vulnerability

Apple · iOS

Apple iOS WebKit contains a memory corruption vulnerability that leads to code execution when processing maliciously crafted web content. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit…

Federal remediation due Nov 17, 2021Ransomware use: Not confirmed by CISA

Required action: Apply updates per vendor instructions.

View in the CISA KEV catalog →

CISA KEV

CVE-2021-30666: Apple iOS WebKit Buffer Overflow Vulnerability

Apple · iOS

Apple iOS WebKit contains a buffer-overflow vulnerability that leads to code execution when processing maliciously crafted web content. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for…

Federal remediation due Nov 17, 2021Ransomware use: Not confirmed by CISA

Required action: Apply updates per vendor instructions.

View in the CISA KEV catalog →

CISA KEV

CVE-2021-30665: Apple Multiple Products WebKit Memory Corruption Vulnerability

Apple · Multiple Products

Apple iOS, iPadOS, macOS, watchOS, and tvOS WebKit contain a memory corruption vulnerability that leads to code execution when processing maliciously crafted web content. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple…

Federal remediation due Nov 17, 2021Ransomware use: Not confirmed by CISA

Required action: Apply updates per vendor instructions.

View in the CISA KEV catalog →

CISA KEV

CVE-2021-30663: Apple Multiple Products WebKit Integer Overflow Vulnerability

Apple · Multiple Products

Apple iOS, iPadOS, macOS, tvOS, and Safari WebKit contain an integer overflow vulnerability that leads to code execution when processing maliciously crafted web content. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple…

Federal remediation due Nov 17, 2021Ransomware use: Not confirmed by CISA

Required action: Apply updates per vendor instructions.

View in the CISA KEV catalog →

CISA KEV

CVE-2021-30661: Apple Multiple Products WebKit Storage Use-After-Free Vulnerability

Apple · Multiple Products

Apple iOS, iPadOS, macOS, tvOS, watchOS, and Safari WebKit Storage contain a use-after-free vulnerability that leads to code execution when processing maliciously crafted web content. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and…

Federal remediation due Nov 17, 2021Ransomware use: Not confirmed by CISA

Required action: Apply updates per vendor instructions.

View in the CISA KEV catalog →

CISA KEV

CVE-2021-30633: Google Chromium Indexed DB API Use-After-Free Vulnerability

Google · Chromium Indexed DB API

Google Chromium Indexed DB API contains a use-after-free vulnerability that allows a remote attacker, who has compromised the renderer process, to potentially perform a sandbox escape via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including,…

Federal remediation due Nov 17, 2021Ransomware use: Not confirmed by CISA

Required action: Apply updates per vendor instructions.

View in the CISA KEV catalog →

CISA KEV

CVE-2021-30632: Google Chromium V8 Out-of-Bounds Write Vulnerability

Google · Chromium V8

Google Chromium V8 Engine contains an out-of-bounds write vulnerability that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft…

Federal remediation due Nov 17, 2021Ransomware use: Not confirmed by CISA

Required action: Apply updates per vendor instructions.

View in the CISA KEV catalog →

CISA KEV

CVE-2021-30563: Google Chromium V8 Type Confusion Vulnerability

Google · Chromium V8

Google Chromium V8 Engine contains a type confusion vulnerability that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft…

Federal remediation due Nov 17, 2021Ransomware use: Not confirmed by CISA

Required action: Apply updates per vendor instructions.

View in the CISA KEV catalog →

CISA KEV

CVE-2021-30554: Google Chromium WebGL Use-After-Free Vulnerability

Google · Chromium WebGL

Google Chromium WebGL contains a use-after-free vulnerability that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and…

Federal remediation due Nov 17, 2021Ransomware use: Not confirmed by CISA

Required action: Apply updates per vendor instructions.

View in the CISA KEV catalog →

CISA KEV

CVE-2021-30551: Google Chromium V8 Type Confusion Vulnerability

Google · Chromium V8

Google Chromium V8 Engine contains a type confusion vulnerability that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft…

Federal remediation due Nov 17, 2021Ransomware use: Not confirmed by CISA

Required action: Apply updates per vendor instructions.

View in the CISA KEV catalog →

CISA KEV

CVE-2021-30116: Kaseya Virtual System/Server Administrator (VSA) Information Disclosure Vulnerability

Kaseya · Virtual System/Server Administrator (VSA)

Kaseya Virtual System/Server Administrator (VSA) contains an information disclosure vulnerability allowing an attacker to obtain the sessionId that can be used to execute further attacks against the system.

Federal remediation due Nov 17, 2021Ransomware use: Known

Required action: Apply updates per vendor instructions.

View in the CISA KEV catalog →

Source: Official CISA KEV JSONCatalog released Nov 6, 2026, 7:44 PM GMT+0000Site snapshot: Showing 24 of 1,769Source text normalized: network addresses and restricted context omittedRefresh interval: 30 minutes

Complete fixed-window snapshot

CVEs — Past 48 Hours

All unique CVEs returned by NVD for the displayed UTC publication window. The snapshot is accepted only when its normalized unique-item count exactly equals the API totalResults value.

Current snapshot

Entries 937–960 of 1,057

NVD CVE

CVE-2026-123301

In JetBrains IntelliJ IDEA before 2026.3 dOM-based XSS in the OpenAPI preview error view was possible

CVSS 8.2 HIGHStatus: Awaiting AnalysisCWE-79

Review the NVD record →

NVD CVE

CVE-2026-123300

In JetBrains Hub before 2026.2.52519 missing authorisation allowed users with read-only access to modify auth module group mappings

CVSS 2.7 LOWStatus: Awaiting AnalysisCWE-862

Review the NVD record →

NVD CVE

CVE-2026-123299

In JetBrains Hub before 2026.2.52519 information disclosure via user search queries was possible

CVSS 3.1 LOWStatus: Awaiting AnalysisCWE-863

Review the NVD record →

NVD CVE

CVE-2026-123298

In JetBrains Hub before 2026.2.52556 sMTP command injection via email verification was possible

CVSS 5.0 MEDIUMStatus: Awaiting AnalysisCWE-93

Review the NVD record →

NVD CVE

CVE-2026-123297

In JetBrains Hub before 2026.2.52519 two-factor authentication bypass was possible via the password reset flow

CVSS 6.8 MEDIUMStatus: Awaiting AnalysisCWE-304

Review the NVD record →

NVD CVE

CVE-2026-123296

In JetBrains Hub before 2026.2.52519 privilege escalation via forged email verification was possible

CVSS 7.5 HIGHStatus: Awaiting AnalysisCWE-863

Review the NVD record →

NVD CVE

CVE-2026-123295

In JetBrains Hub before 2026.2.52519 enforced two-factor authentication could be disabled via the profile update endpoint

CVSS 8.1 HIGHStatus: Awaiting AnalysisCWE-863

Review the NVD record →

NVD CVE

CVE-2026-123294

In JetBrains Hub before 2026.2.52556 privilege escalation was possible by changing email authentication details during the verification flow

CVSS 9.6 CRITICALStatus: Awaiting AnalysisCWE-915

Review the NVD record →

NVD CVE

CVE-2026-123293

In JetBrains IntelliJ IDEA before 2026.3, 2026.2.4 code execution was possible in untrusted projects via the Terraform tool path setting

CVSS 7.8 HIGHStatus: Awaiting AnalysisCWE-829

Review the NVD record →

NVD CVE

CVE-2026-123292

In JetBrains Datalore before 2026.4 aPI tokens and sessions of removed or banned users remained valid

CVSS 2.7 LOWStatus: Awaiting Analysis

Review the NVD record →

NVD CVE

CVE-2026-123291

In JetBrains Datalore before 2026.4 improper owner validation allowed reading another workspace's issues and runs notebook

CVSS 4.3 MEDIUMStatus: Awaiting AnalysisCWE-639

Review the NVD record →

NVD CVE

CVE-2026-123290

In JetBrains Datalore before 2026.4 hidden notebook code was exposed to unauthenticated users via the public interactive report content endpoint

CVSS 5.3 MEDIUMStatus: Awaiting AnalysisCWE-201

Review the NVD record →

NVD CVE

CVE-2026-123289

In JetBrains Datalore before 2026.4 improper authorisation allowed notebook viewers to modify files

CVSS 5.4 MEDIUMStatus: Awaiting AnalysisCWE-863

Review the NVD record →

NVD CVE

CVE-2026-123288

In JetBrains Datalore before 2026.4 stored XSS in notebook charts was possible via Vega editor link

CVSS 5.4 MEDIUMStatus: Awaiting AnalysisCWE-79

Review the NVD record →

NVD CVE

CVE-2026-123287

In JetBrains Datalore before 2026.4 private notebook files could be downloaded without authentication via published interactive reports

CVSS 5.9 MEDIUMStatus: Awaiting AnalysisCWE-863

Review the NVD record →

NVD CVE

CVE-2026-123286

In JetBrains Datalore before 2026.4 improper authorisation allowed read the notebook owner's file storage session token

CVSS 5.9 MEDIUMStatus: Awaiting AnalysisCWE-863

Review the NVD record →

NVD CVE

CVE-2026-123285

In JetBrains Datalore before 2026.3 command execution was possible in the database task container via JVM options injection

CVSS 6.3 MEDIUMStatus: Awaiting AnalysisCWE-88

Review the NVD record →

NVD CVE

CVE-2026-123284

In JetBrains Datalore before 2026.4 improper authorisation on workspace moves allowed view-only collaborators to modify shared content

CVSS 6.5 MEDIUMStatus: Awaiting AnalysisCWE-863

Review the NVD record →

NVD CVE

CVE-2026-123283

In JetBrains Datalore before 2026.4 account takeover was possible via SSO sign-in to a pre-registered account

CVSS 6.8 MEDIUMStatus: Awaiting Analysis

Review the NVD record →

NVD CVE

CVE-2026-123282

In JetBrains Datalore before 2026.4 missing expiration validation of account tokens allowed a new authenticated session

CVSS 7.4 HIGHStatus: Awaiting AnalysisCWE-672

Review the NVD record →

NVD CVE

CVE-2026-123281

In JetBrains Datalore before 2026.4 notebook code could execute commands in the sidecar container via the mount broker

CVSS 7.5 HIGHStatus: Awaiting AnalysisCWE-88

Review the NVD record →

NVD CVE

CVE-2026-123280

In JetBrains Datalore before 2026.2.4 unauthenticated users could execute code via published interactive reports

CVSS 8.1 HIGHStatus: Awaiting AnalysisCWE-863

Review the NVD record →

NVD CVE

CVE-2026-123279

In JetBrains Datalore before 2026.4 code execution was possible in a notebook's computation by view-only collaborators

CVSS 9.0 CRITICALStatus: Awaiting AnalysisCWE-863

Review the NVD record →

NVD CVE

CVE-2026-123278

In JetBrains IntelliJ IDEA before 2026.3 code execution was possible via the unauthenticated JDBC worker RMI endpoint

CVSS 6.7 MEDIUMStatus: Awaiting AnalysisCWE-306

Review the NVD record →

Source: Official NVD CVE API 2.0UTC window Nov 6, 2026 04:27–Nov 8, 2026 04:27API response: Site snapshot: Showing 24 of 1,057Source text normalized: network addresses and restricted context omittedRefresh interval: 2 hours