Kythos AI

CVE watch Past 48 hours+

Latest 48 of 1022 in cacheBrowse CVEs
NVD checked Nov 8, 06:27 UTCSource: NVD · Refreshed every 2 hours · Publication may lag

Kythos AI vulnerability intelligence

Zero-Day Exploits / Vulnerabilities

A server-rendered, source-attributed view of confirmed CISA KEV entries and all NVD CVEs published in the rolling 48-hour UTC window.

Important distinction: CISA KEV means exploitation has been observed; it does not mean every entry was a zero-day. An NVD publication in the past 48 hours does not mean exploitation has occurred. Source records describe third-party products and do not identify Kythos AI customers, contracts, affiliations, or work history.

CISA KEV catalogNVD 48-hour CVEsKythos AI RSS feed

Confirmed exploitation intelligence

Zero-Day Exploits / Vulnerabilities

Complete CISA Known Exploited Vulnerabilities catalog, ordered by the date CISA added each entry. Every result is known to be exploited; entries are not necessarily zero-days.

Current snapshot

Entries 1,585–1,608 of 1,769

CISA KEV

CVE-2020-8468: Trend Micro Multiple Products Content Validation Escape Vulnerability

Trend Micro · Apex One, OfficeScan and Worry-Free Business Security Agents

Trend Micro Apex One, OfficeScan, and Worry-Free Business Security agents contain a content validation escape vulnerability that could allow an attacker to manipulate certain agent client components.

Federal remediation due May 3, 2022Ransomware use: Not confirmed by CISA

Required action: Apply updates per vendor instructions.

View in the CISA KEV catalog →

CISA KEV

CVE-2020-8193: Citrix ADC, Gateway, and SD-WAN WANOP Appliance Authorization Bypass Vulnerability

Citrix · Application Delivery Controller (ADC), Gateway, and SD-WAN WANOP Appliance

Citrix ADC, Citrix Gateway, and multiple Citrix SD-WAN WANOP appliance models contain an authorization bypass vulnerability that may allow unauthenticated access to certain URL endpoints. The attacker must have access to the NetScaler IP (NSIP) in order to perform exploitation.

Federal remediation due May 3, 2022Ransomware use: Not confirmed by CISA

Required action: Apply updates per vendor instructions.

View in the CISA KEV catalog →

CISA KEV

CVE-2020-6820: Mozilla Firefox And Thunderbird Use-After-Free Vulnerability

Mozilla · Firefox and Thunderbird

Mozilla Firefox and Thunderbird contain a race condition vulnerability when handling a ReadableStream under certain conditions. The race condition creates a use-after-free vulnerability, causing unspecified impacts.

Federal remediation due May 3, 2022Ransomware use: Not confirmed by CISA

Required action: Apply updates per vendor instructions.

View in the CISA KEV catalog →

CISA KEV

CVE-2020-6819: Mozilla Firefox And Thunderbird Use-After-Free Vulnerability

Mozilla · Firefox and Thunderbird

Mozilla Firefox and Thunderbird contain a race condition vulnerability when running the nsDocShell destructor under certain conditions. The race condition creates a use-after-free vulnerability, causing unspecified impacts.

Federal remediation due May 3, 2022Ransomware use: Not confirmed by CISA

Required action: Apply updates per vendor instructions.

View in the CISA KEV catalog →

CISA KEV

CVE-2020-6418: Google Chromium V8 Type Confusion Vulnerability

Google · Chromium V8

Google Chromium V8 Engine contains a type confusion vulnerability allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge,…

Federal remediation due May 3, 2022Ransomware use: Not confirmed by CISA

Required action: Apply updates per vendor instructions.

View in the CISA KEV catalog →

Source: Official CISA KEV JSONCatalog released Nov 6, 2026, 7:44 PM GMT+0000Site snapshot: Showing 24 of 1,769Source text normalized: network addresses and restricted context omittedRefresh interval: 30 minutes

Complete fixed-window snapshot

CVEs — Past 48 Hours

All unique CVEs returned by NVD for the displayed UTC publication window. The snapshot is accepted only when its normalized unique-item count exactly equals the API totalResults value.

Current snapshot

Entries 289–312 of 1,041

NVD CVE

CVE-2026-120840

Missing Authorization vulnerability in ThemeGrill User Registration user-registration allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects User Registration: from n/a through 5.3.0.

CVSS 4.3 MEDIUMStatus: DeferredCWE-862

Review the NVD record →

NVD CVE

CVE-2026-120548

The YML for Yandex Market plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 5.10.0 via the 'y4ym_check_action' parameter. This makes it possible for unauthenticated attackers to extract the merchant's plaintext Yandex Market API key written to the publicly…

CVSS 5.3 MEDIUMStatus: DeferredCWE-532

Review the NVD record →

NVD CVE

CVE-2026-120532

The wpForo Forum plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'post[body]' parameter in all versions up to, and including, 3.2.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject…

CVSS 6.4 MEDIUMStatus: DeferredCWE-79

Review the NVD record →

NVD CVE

CVE-2026-120514

The Zephyr Project Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'zpm_profile_picture' parameter in all versions up to, and including, 3.3.209 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to…

CVSS 5.4 MEDIUMStatus: DeferredCWE-79

Review the NVD record →

NVD CVE

CVE-2026-119520

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brainstorm Force Spectra ultimate-addons-for-gutenberg allows Stored XSS.This issue affects Spectra: from n/a through 2.20.4.

CVSS 6.5 MEDIUMStatus: DeferredCWE-79

Review the NVD record →

NVD CVE

CVE-2026-119511

Missing Authorization vulnerability in Saeed MC Woocommerce Wishlist smart-wishlist-for-more-convert allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects MC Woocommerce Wishlist: from n/a through 2.0.3.

CVSS 5.3 MEDIUMStatus: DeferredCWE-862

Review the NVD record →

NVD CVE

CVE-2026-119507

Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in WPDeveloper NotificationX notificationx allows Code Injection.This issue affects NotificationX: from n/a through 3.3.6.

CVSS 5.3 MEDIUMStatus: DeferredCWE-80

Review the NVD record →

NVD CVE

CVE-2026-119502

Missing Authorization vulnerability in BdThemes Ultimate Store Kit Elementor Addons ultimate-store-kit allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Ultimate Store Kit Elementor Addons: from n/a through 4.0.1.

CVSS 5.3 MEDIUMStatus: DeferredCWE-862

Review the NVD record →

NVD CVE

CVE-2026-119500

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins Flash & HTML5 Video html5-video-player allows Stored XSS.This issue affects Flash & HTML5 Video: from n/a through 2.14.1.

CVSS 6.5 MEDIUMStatus: DeferredCWE-79

Review the NVD record →

NVD CVE

CVE-2026-119494

Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Gemini Labs Site Reviews site-reviews allows Code Injection.This issue affects Site Reviews: from n/a through 8.3.6.

CVSS 5.3 MEDIUMStatus: DeferredCWE-80

Review the NVD record →

NVD CVE

CVE-2026-119493

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Metaphor Creations, LLC Ditty ditty-news-ticker allows Stored XSS.This issue affects Ditty: from n/a through 3.1.71.

CVSS 6.5 MEDIUMStatus: DeferredCWE-79

Review the NVD record →

NVD CVE

CVE-2026-119491

Missing Authorization vulnerability in David Lingren Media LIbrary Assistant media-library-assistant allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Media LIbrary Assistant: from n/a through 3.43.

CVSS 4.3 MEDIUMStatus: DeferredCWE-862

Review the NVD record →

NVD CVE

CVE-2026-119486

Missing Authorization vulnerability in WP ManageNinja LLC FluentBoards fluent-boards allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects FluentBoards: from n/a through 2.2.2.

CVSS 4.3 MEDIUMStatus: DeferredCWE-862

Review the NVD record →

NVD CVE

CVE-2026-119484

Cross-Site Request Forgery (CSRF) vulnerability in Supsystic Photo Gallery by Supsystic gallery-by-supsystic allows Cross Site Request Forgery.This issue affects Photo Gallery by Supsystic: from n/a through 1.21.6.

CVSS 6.3 MEDIUMStatus: DeferredCWE-352

Review the NVD record →

NVD CVE

CVE-2026-119473

Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in properfraction ProfilePress wp-user-avatar allows Code Injection.This issue affects ProfilePress: from n/a through 4.17.7.

CVSS 4.3 MEDIUMStatus: DeferredCWE-80

Review the NVD record →

NVD CVE

CVE-2026-119465

Insertion of Sensitive Information Into Sent Data vulnerability in WPVibes Elementor Addon Elements addon-elements-for-elementor-page-builder allows Retrieve Embedded Sensitive Data.This issue affects Elementor Addon Elements: from n/a through 1.15.

CVSS 5.3 MEDIUMStatus: DeferredCWE-201

Review the NVD record →

NVD CVE

CVE-2026-119164

The wpForo Forum plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.2.2 via the `data[secondary_groupids]` parameter of the `wpforo_action_profile_update` POST handler. This is due to a type-confusion flaw in the secondary_groupids authorization guard within the `Members[network address omitted]update()` function…

CVSS 7.5 HIGHStatus: DeferredCWE-269

Review the NVD record →

NVD CVE

CVE-2026-119155

The wpForo Forum plugin for WordPress is vulnerable to time-based SQL Injection via the 'href[locale]' parameter in all versions up to, and including, 3.2.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it…

CVSS 7.5 HIGHStatus: DeferredCWE-89

Review the NVD record →

NVD CVE

CVE-2026-118784

The WPSpeed plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2.6.10 This is due to a combination of two issues in the LightImages HTML optimizer: (1) Dispatcher[network address omitted]runOptimize() decides whether the current request is the site's home page…

CVSS 6.4 MEDIUMStatus: DeferredCWE-79

Review the NVD record →

NVD CVE

CVE-2026-110004

The wpForo Forum plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the theme_delete function in all versions up to, and including, 3.2.2 This makes it possible for authenticated attackers, with subscriber-level access and above, to delete arbitrary files…

CVSS 6.5 MEDIUMStatus: DeferredCWE-22

Review the NVD record →

NVD CVE

CVE-2026-107616

The Amelia plugin for WordPress is vulnerable to unauthorized access of attendee data due to a missing authorization check on the GetEventAttendeesCommandHandler[network address omitted]handle() function in versions up to, and including, 9.9.1. The handler only enforces the broad `amelia_read_events` capability — which the plugin's own `wpamelia-customer`…

CVSS 7.5 HIGHStatus: DeferredCWE-862

Review the NVD record →

NVD CVE

CVE-2026-104992

The Booking for Appointments and Events Calendar – Amelia plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 9.9.1. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it…

CVSS 6.5 MEDIUMStatus: DeferredCWE-862

Review the NVD record →

NVD CVE

CVE-2026-103900

The WPJAM Basic plugin for WordPress is vulnerable to Privilege Escalation in versions up to, and including, 7.1 This is due to the WPJAM_User_Signup[network address omitted]signup() function unpacking attacker-supplied `data[args]` from the AJAX POST body and merging it via PHP array union into the payload passed…

CVSS 8.1 HIGHStatus: DeferredCWE-269

Review the NVD record →

NVD CVE

CVE-2026-66669

Cross-Site Request Forgery (CSRF) vulnerability in Suplugins Superb Addons: Blocks, Patterns & Theme Designer superb-blocks allows Cross Site Request Forgery.This issue affects Superb Addons: Blocks, Patterns & Theme Designer: from n/a through 4.2.4.

CVSS 8.8 HIGHStatus: DeferredCWE-352

Review the NVD record →

Source: Official NVD CVE API 2.0UTC window Nov 6, 2026 06:27–Nov 8, 2026 06:27API response: Site snapshot: Showing 24 of 1,041Source text normalized: network addresses and restricted context omittedRefresh interval: 2 hours