Kythos AI vulnerability intelligence
Zero-Day Exploits / Vulnerabilities
A server-rendered, source-attributed view of confirmed CISA KEV entries and all NVD CVEs published in the rolling 48-hour UTC window.
Important distinction: CISA KEV means exploitation has been observed; it does not mean every entry was a zero-day. An NVD publication in the past 48 hours does not mean exploitation has occurred. Source records describe third-party products and do not identify Kythos AI customers, contracts, affiliations, or work history.
Confirmed exploitation intelligence
Zero-Day Exploits / Vulnerabilities
Complete CISA Known Exploited Vulnerabilities catalog, ordered by the date CISA added each entry. Every result is known to be exploited; entries are not necessarily zero-days.
Entries 1,537–1,560 of 1,769
CVE-2021-28664: Arm Mali Graphics Processing Unit (GPU) Unspecified Vulnerability
Arm · Mali Graphics Processing Unit (GPU)
Arm Mali Graphics Processing Unit (GPU) kernel driver contains an unspecified vulnerability that may allow a non-privileged user to gain write access to read-only memory, gain root privilege, corrupt memory, and modify the memory of other processes.
Required action: Apply updates per vendor instructions.
CVE-2021-28663: Arm Mali Graphics Processing Unit (GPU) Use-After-Free Vulnerability
Arm · Mali Graphics Processing Unit (GPU)
Arm Mali Graphics Processing Unit (GPU) kernel driver contains a use-after-free vulnerability that may allow a non-privileged user to make improper operations on GPU memory to gain root privilege, and/or disclose information.
Required action: Apply updates per vendor instructions.
CVE-2021-28550: Adobe Acrobat and Reader Use-After-Free Vulnerability
Adobe · Acrobat and Reader
Adobe Acrobat and Reader contains a use-after-free vulnerability that could allow an unauthenticated attacker to achieve code execution in the context of the current user.
Required action: Apply updates per vendor instructions.
CVE-2021-28310: Microsoft Win32k Privilege Escalation Vulnerability
Microsoft · Win32k
Microsoft Windows Win32k contains an unspecified vulnerability that allows for privilege escalation.
Required action: Apply updates per vendor instructions.
CVE-2021-27562: Arm Trusted Firmware Out-of-Bounds Write Vulnerability
Arm · Trusted Firmware
Arm Trusted Firmware contains an out-of-bounds write vulnerability allowing the non-secure (NS) world to trigger a system halt, overwrite secure data, or print out secure data when calling secure functions under the non-secure processing environment (NSPE) handler mode. This vulnerability affects Yealink…
Required action: Apply updates per vendor instructions.
CVE-2021-27561: Yealink Device Management Server-Side Request Forgery (SSRF) Vulnerability
Yealink · Device Management
Yealink Device Management contains a server-side request forgery (SSRF) vulnerability that allows for unauthenticated remote code execution.
Required action: Apply updates per vendor instructions.
CVE-2021-27104: Accellion FTA OS Command Injection Vulnerability
Accellion · FTA
Accellion FTA contains an OS command injection vulnerability exploited via a crafted POST request to various admin endpoints.
Required action: Apply updates per vendor instructions.
CVE-2021-27103: Accellion FTA Server-Side Request Forgery (SSRF) Vulnerability
Accellion · FTA
Accellion FTA contains a server-side request forgery (SSRF) vulnerability exploited via a crafted POST request to wmProgressstat.html.
Required action: Apply updates per vendor instructions.
CVE-2021-27102: Accellion FTA OS Command Injection Vulnerability
Accellion · FTA
Accellion FTA contains an OS command injection vulnerability exploited via a local web service call.
Required action: Apply updates per vendor instructions.
CVE-2021-27101: Accellion FTA SQL Injection Vulnerability
Accellion · FTA
Accellion FTA contains a SQL injection vulnerability exploited via a crafted host header in a request to document_root.html.
Required action: Apply updates per vendor instructions.
CVE-2021-27085: Microsoft Internet Explorer Remote Code Execution Vulnerability
Microsoft · Internet Explorer
Microsoft Internet Explorer contains an unspecified vulnerability that allows for remote code execution.
Required action: Apply updates per vendor instructions.
CVE-2021-27065: Microsoft Exchange Server Remote Code Execution Vulnerability
Microsoft · Exchange Server
Microsoft Exchange Server contains an unspecified vulnerability that allows for remote code execution. This vulnerability is part of the ProxyLogon exploit chain.
Required action: Apply updates per vendor instructions.
CVE-2021-27059: Microsoft Office Remote Code Execution Vulnerability
Microsoft · Office
Microsoft Office contains an unspecified vulnerability that allows for remote code execution.
Required action: Apply updates per vendor instructions.
CVE-2021-26858: Microsoft Exchange Server Remote Code Execution Vulnerability
Microsoft · Exchange Server
Microsoft Exchange Server contains an unspecified vulnerability that allows for remote code execution. This vulnerability is part of the ProxyLogon exploit chain.
Required action: Apply updates per vendor instructions.
CVE-2021-26857: Microsoft Exchange Server Remote Code Execution Vulnerability
Microsoft · Exchange Server
Microsoft Exchange Server contains an unspecified vulnerability that allows for remote code execution. This vulnerability is part of the ProxyLogon exploit chain.
Required action: Apply updates per vendor instructions.
CVE-2021-26855: Microsoft Exchange Server Remote Code Execution Vulnerability
Microsoft · Exchange Server
Microsoft Exchange Server contains an unspecified vulnerability that allows for remote code execution. This vulnerability is part of the ProxyLogon exploit chain.
Required action: Apply updates per vendor instructions.
CVE-2021-26411: Microsoft Internet Explorer Memory Corruption Vulnerability
Microsoft · Internet Explorer
Microsoft Internet Explorer contains an unspecified vulnerability that allows for memory corruption.
Required action: Apply updates per vendor instructions.
CVE-2021-26084: Atlassian Confluence Server and Data Center Object-Graph Navigation Language (OGNL) Injection Vulnerability
Atlassian · Confluence Server and Data Center
Atlassian Confluence Server and Data Server contain an Object-Graph Navigation Language (OGNL) injection vulnerability that may allow an unauthenticated attacker to execute code.
Required action: Apply updates per vendor instructions.
CVE-2021-23874: McAfee Total Protection (MTP) Improper Privilege Management Vulnerability
McAfee · McAfee Total Protection (MTP)
McAfee Total Protection (MTP) contains an improper privilege management vulnerability that allows a local user to gain elevated privileges and execute code, bypassing MTP self-defense.
Required action: Apply updates per vendor instructions.
CVE-2021-22986: F5 BIG-IP and BIG-IQ Centralized Management iControl REST Remote Code Execution Vulnerability
F5 · BIG-IP and BIG-IQ Centralized Management
F5 BIG-IP and BIG-IQ Centralized Management contain a remote code execution vulnerability in the iControl REST interface that allows unauthenticated attackers with network access to execute system commands, create or delete files, and disable services.
Required action: Apply updates per vendor instructions.
CVE-2021-22900: Ivanti Pulse Connect Secure Unrestricted File Upload Vulnerability
Ivanti · Pulse Connect Secure
Ivanti Pulse Connect Secure contains an unrestricted file upload vulnerability that allows an authenticated administrator to perform a file write via a maliciously crafted archive upload in the administrator web interface.
Required action: Apply updates per vendor instructions.
CVE-2021-22899: Ivanti Pulse Connect Secure Command Injection Vulnerability
Ivanti · Pulse Connect Secure
Ivanti Pulse Connect Secure contains a command injection vulnerability that allows remote authenticated users to perform remote code execution via Windows File Resource Profiles.
Required action: Apply updates per vendor instructions.
CVE-2021-22894: Ivanti Pulse Connect Secure Collaboration Suite Buffer Overflow Vulnerability
Ivanti · Pulse Connect Secure
Ivanti Pulse Connect Secure Collaboration Suite contains a buffer overflow vulnerabilities that allows a remote authenticated users to execute code as the root user via maliciously crafted meeting room.
Required action: Apply updates per vendor instructions.
CVE-2021-22893: Ivanti Pulse Connect Secure Use-After-Free Vulnerability
Ivanti · Pulse Connect Secure
Ivanti Pulse Connect Secure contains a use-after-free vulnerability that allow a remote, unauthenticated attacker to execute code via license services.
Required action: Apply updates per vendor instructions.
Complete fixed-window snapshot
CVEs — Past 48 Hours
All unique CVEs returned by NVD for the displayed UTC publication window. The snapshot is accepted only when its normalized unique-item count exactly equals the API totalResults value.
Entries 601–624 of 1,203
CVE-2026-112208
A flaw was found in the Organization identity-first login flow of the Keycloak authentication server. Keycloak is an open-source identity and access management solution used to secure modern applications and services. The issue occurs when an attacker who belongs to multiple organizations initiates a login and…
CVE-2026-111253
A flaw was found in dnf5daemon-server. Session methods on dynamically exported D-Bus session objects do not verify that the caller is the unique sender that created the session. A local attacker can modify another user's live package-management session and replace its resolved transaction plan. If the…
CVE-2026-110932
A flaw was found in the theme resource endpoint of Keycloak, an open-source identity and access management solution. The issue occurs because the server fails to validate theme names before using them as keys for an on-disk gzip cache. An unauthenticated attacker can exploit this by…
CVE-2026-110931
A flaw was found in the SAML 1.1 assertion parser of Keycloak, a tool used for identity and access management. The issue occurs when the parser handles a specific element called AuthorityBinding within an authentication statement. Due to an incomplete fix for a previous vulnerability, the…
CVE-2026-107602
A flaw was found in the SAML 1.1 XML parsing logic of Keycloak, an open-source identity and access management solution. The issue occurs when the parser encounters unexpected elements within a security token's key information section, causing the processing thread to enter an infinite loop. An…
CVE-2026-107123
A flaw was found in the SAML XML processing component of Keycloak, an open-source identity and access management solution. The issue occurs when the server parses XML documents containing excessively long dateTime or duration values. Because these strings are not properly validated before processing, the XML…
CVE-2026-104867
Immich is a high-performance self-hosted photo and video management solution. From 3.0.0 until 3.2.0, the GET /api/admin/users/{id}/calendar-heatmap route in server/src/controllers/user-admin.controller.ts uses the ordinary Permission.UserRead permission without an admin-route requirement, and UserAdminService.getCalendarHeatmap in server/src/services/user-admin.service.ts does not compare the authenticated user with the requested user identifier or perform…
CVE-2026-103112
A flaw was found in the authentication session handling of the keycloak-services component in Keycloak. The issue occurs because the system fails to verify if an authenticator is valid for the current authentication flow when switching between the standard authentication path and the reset credentials path.…
CVE-2026-102739
ESPectre is a Wi-Fi motion sensing platform for ESP32. Prior to 3.0.0-rc1, Micro-ESPectre analysis tools, including tools/6_optimize_filter_params.py, tools/1_analyze_raw_data.py, and tools/10_train_ml_model.py, load NPZ datasets with NumPy pickle support enabled through micro-espectre/tools/csi_utils.py and a direct loader. A malicious dataset contributor or pull-request author can place an object-typed array…
CVE-2026-85286
HomeBox is a home inventory and organization system. Prior to 0.27.0, the POST /api/v1/users/login endpoint performs password-hash verification only when the submitted username matches an existing account, while unknown usernames return immediately. Although both paths return the same 401 unauthorized response, the processing-time discrepancy allows an…
CVE-2026-73856
ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. From 3.0.0 until 3.0.17, src/transaction.cc compares a response Content-Type value against SecResponseBodyMimeType entries case-sensitively. A mixed-case response media type that is semantically equivalent to a configured lowercase type can…
CVE-2026-70660
stable-diffusion.cpp is a pure C/C++ library for running diffusion model (Stable Diffusion, Flux, Wan, Qwen Image, Z-Image, and more) inference. Prior to master-764-e22272e, the safetensors loader in src/model_io/safetensors_io.cpp trusts each tensor's data_offsets after checking only that nbytes equals end – begin. A crafted .safetensors file can…
CVE-2026-70659
stable-diffusion.cpp is a pure C/C++ library for running diffusion model (Stable Diffusion, Flux, Wan, Qwen Image, Z-Image, and more) inference. From master-742-1a13107 until master-763-4fcc6fe, IMatrixCollector[network address omitted]load_imatrix in src/runtime/imatrix.cpp reuses the values and counts vectors for entries with the same tensor name but resizes them only…
CVE-2026-61813
ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. Prior to 2.9.15 and 3.0.17, the HttpsClient[network address omitted]ownload function in src/utils/https_client.cc sets libcurl CURLOPT_SSL_VERIFYHOST to 1 instead of the strict value 2L. Under adversary-in-the-middle and TLS interception conditions,…
CVE-2026-123158
sshd in OpenSSH before 10.6p2 on Linux, when musl libc is used without PAM, lacks a workaround for a password authentication bypass (related to misinterpretation of whether a string is intended to be a password hash). For some configurations of accounts, any password between 256 and…
CVE-2026-123125
The Symfony Validator component IpValidator incompletely classifies internal addresses in the filtered modes of the Ip constraint, so some internal addresses are accepted as public, which can lead to Server-Side Request Forgery (SSRF) in Symfony versions prior to 5.4.56, 6.x prior to 6.4.50, 7.x prior to…
CVE-2026-123096
anacrolix/torrent through 1.61.0 contains a memory exhaustion vulnerability in the tracker/http package that allows malicious trackers to crash clients by returning unbounded responses. Attackers controlling an HTTP tracker in a torrent file or magnet link can return huge or gzip-compressed announce or scrape responses that Client.Announce…
CVE-2026-123095
mpv 0.29.0 before 0.42.0 contains a playlist injection vulnerability in the bundled ytdl_hook script that allows remote attackers to add unchecked entries by embedding newlines in playlist URLs. Attackers controlling a feed or page can bypass url_is_safe() to open file:// or av:// inputs, reading local files…
CVE-2026-123094
Huginn before 2026.11.05 contains a stored cross-site scripting vulnerability in the service_label helper that marks unescaped OAuth service display names as html_safe. Authenticated attackers can connect an OAuth account with a crafted nickname, name or email and share it globally, executing JavaScript when victims attach it…
CVE-2026-122330
Blosc c-blosc2 before 3.5.0 contains a divide-by-zero vulnerability in blosc2_schunk_get_slice_buffer() in blosc/schunk.c that allows attackers to crash applications by supplying crafted frames with unchecked zero chunksize or blocksize values. Attackers can provide a malicious Blosc2 frame opened via blosc2_schunk_open() or blosc2_schunk_from_buffer() and read as a slice,…
CVE-2026-122329
SDL_mixer 3.1.2 through 3.2.4 contains a stack-based buffer overflow in FetchXLaw() in src/decoder_aiff.c due to miscalculated output offsets when expanding A-law or mu-law samples. Attackers can supply a crafted AIFF-C file that overwrites roughly 1 KB of adjacent stack memory when decoded, causing crashes or potential…
CVE-2026-122328
SDL_mixer 3.1.2 through 3.2.4 contains a stack-based buffer overflow vulnerability in FetchXLaw() of src/decoder_wav.c when decoding A-law or mu-law WAV files. Attackers can supply a crafted WAV file whose doubly-offset float expansion overwrites about 1 KB of adjacent stack memory, causing crashes or potentially code execution.
CVE-2026-122327
Meelo through 3.13.1 contains a missing authorization vulnerability that allows authenticated non-admin users to modify shared catalog data because RolesGuard does not require Admin on song, track and video write routes. Attackers can send PUT requests to /songs/:idOrSlug, /tracks/:idOrSlug or /videos/:idOrSlug, or POST to /songs/:idOrSlug/merge, to…
CVE-2026-122326
Chevereto before 4.5.8 contains an authorization bypass vulnerability in the get-album-contents action of the /json route that allows unauthenticated attackers to list private albums by supplying another user's album id. Attackers with a session token from any public page and an album's encoded id can obtain…