Kythos AI vulnerability intelligence
Zero-Day Exploits / Vulnerabilities
A server-rendered, source-attributed view of confirmed CISA KEV entries and all NVD CVEs published in the rolling 48-hour UTC window.
Important distinction: CISA KEV means exploitation has been observed; it does not mean every entry was a zero-day. An NVD publication in the past 48 hours does not mean exploitation has occurred. Source records describe third-party products and do not identify Kythos AI customers, contracts, affiliations, or work history.
Confirmed exploitation intelligence
Zero-Day Exploits / Vulnerabilities
Complete CISA Known Exploited Vulnerabilities catalog, ordered by the date CISA added each entry. Every result is known to be exploited; entries are not necessarily zero-days.
Entries 1,633–1,656 of 1,768
CVE-2020-2555: Oracle Multiple Products Remote Code Execution Vulnerability
Oracle · Multiple Products
Multiple Oracle products contain a remote code execution vulnerability that allows an unauthenticated attacker with network access via T3 or HTTP to takeover the affected system. Impacted Oracle products: Oracle Coherence in Fusion Middleware, Oracle Utilities Framework, Oracle Retail Assortment Planning, Oracle…
Required action: Apply updates per vendor instructions.
CVE-2020-25506: D-Link DNS-320 Device Command Injection Vulnerability
D-Link · DNS-320 Device
D-Link DNS-320 device contains a command injection vulnerability in the sytem_mgr.cgi component that may allow for remote code execution.
Required action: Apply updates per vendor instructions.
CVE-2020-25213: WordPress File Manager Plugin Remote Code Execution Vulnerability
WordPress · File Manager Plugin
WordPress File Manager plugin contains a remote code execution vulnerability that allows unauthenticated users to execute PHP code and upload malicious files on a target site.
Required action: Apply updates per vendor instructions.
CVE-2020-24557: Trend Micro Multiple Products Improper Access Control Vulnerability
Trend Micro · Apex One, OfficeScan, and Worry-Free Business Security
Trend Micro Apex One, OfficeScan, and Worry-Free Business Security on Microsoft Windows contain an improper access control vulnerability that may allow an attacker to manipulate a particular product folder to disable the security temporarily, abuse a specific Windows function, and attain privilege…
Required action: Apply updates per vendor instructions.
CVE-2020-17530: Apache Struts Remote Code Execution Vulnerability
Apache · Struts
Forced Object-Graph Navigation Language (OGNL) evaluation in Apache Struts, when evaluated on raw user input in tag attributes, can lead to remote code execution.
Required action: Apply updates per vendor instructions.
CVE-2020-17496: vBulletin PHP Module Remote Code Execution Vulnerability
vBulletin · vBulletin
The PHP module within vBulletin contains an unspecified vulnerability that allows for remote code execution via crafted subWidgets data in an ajax/render/widget_tabbedcontainer_tab_panel request. This CVE ID resolves an incomplete patch for CVE-2019-16759.
Required action: Apply updates per vendor instructions.
CVE-2020-17144: Microsoft Exchange Server Remote Code Execution Vulnerability
Microsoft · Exchange Server
Microsoft Exchange Server improperly validates cmdlet arguments which allow an attacker to perform remote code execution.
Required action: Apply updates per vendor instructions.
CVE-2020-17087: Microsoft Windows Kernel Privilege Escalation Vulnerability
Microsoft · Windows
Microsoft Windows kernel contains an unspecified vulnerability that allows for privilege escalation.
Required action: Apply updates per vendor instructions.
CVE-2020-16846: SaltStack Salt Shell Injection Vulnerability
SaltStack · Salt
SaltStack Salt allows an unauthenticated user with network access to the Salt API to use shell injections to run code on the Salt API using the SSH client. This vulnerability affects any users running the Salt API.
Required action: Apply updates per vendor instructions.
CVE-2020-16017: Google Chrome Use-After-Free Vulnerability
Google · Chrome
Google Chrome contains a use-after-free vulnerability that allows a remote attacker, who has compromised the renderer process, to potentially perform a sandbox escape via a crafted HTML page.
Required action: Apply updates per vendor instructions.
CVE-2020-16013: Google Chromium V8 Incorrect Implementation Vulnerabililty
Google · Chromium V8
Google Chromium V8 Engine contains an inappropriate implementation vulnerability that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft…
Required action: Apply updates per vendor instructions.
CVE-2020-16010: Google Chrome for Android UI Heap Buffer Overflow Vulnerability
Google · Chrome for Android UI
Google Chrome for Android UI contains a heap buffer overflow vulnerability that allows a remote attacker, who has compromised the renderer process, to potentially perform a sandbox escape via a crafted HTML page.
Required action: Apply updates per vendor instructions.
CVE-2020-16009: Google Chromium V8 Type Confusion Vulnerability
Google · Chromium V8
Google Chromium V8 Engine contains a type confusion vulnerability that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft…
Required action: Apply updates per vendor instructions.
CVE-2020-15999: Google Chrome FreeType Heap Buffer Overflow Vulnerability
Google · Chrome FreeType
Google Chrome uses FreeType, an open-source software library to render fonts, which contains a heap buffer overflow vulnerability in the function Load_SBit_Png when processing PNG images embedded into fonts. This vulnerability is part of an exploit chain with CVE-2020-17087 on Windows and…
Required action: Apply updates per vendor instructions.
CVE-2020-15505: Ivanti MobileIron Multiple Products Remote Code Execution Vulnerability
Ivanti · MobileIron Multiple Products
Ivanti MobileIron's Core & Connector, Sentry, and Monitor and Reporting Database (RDB) products contain an unspecified vulnerability that allows for remote code execution.
Required action: Apply updates per vendor instructions.
CVE-2020-14883: Oracle WebLogic Server Unspecified Vulnerability
Oracle · WebLogic Server
Oracle WebLogic Server contains an unspecified vulnerability in the Console component with high impacts to confidentilaity, integrity, and availability.
Required action: Apply updates per vendor instructions.
CVE-2020-14882: Oracle WebLogic Server Remote Code Execution Vulnerability
Oracle · WebLogic Server
Oracle WebLogic Server contains an unspecified vulnerability, which is assessed to allow for remote code execution, based on this vulnerability being related to CVE-2020-14750.
Required action: Apply updates per vendor instructions.
CVE-2020-14871: Oracle Solaris and Zettabyte File System (ZFS) Unspecified Vulnerability
Oracle · Solaris and Zettabyte File System (ZFS)
Oracle Solaris and Oracle ZFS Storage Appliance Kit contain an unspecified vulnerability causing high impacts to confidentiality, integrity, and availability of affected systems.
Required action: Apply updates per vendor instructions.
CVE-2020-14750: Oracle WebLogic Server Remote Code Execution Vulnerability
Oracle · WebLogic Server
Oracle WebLogic Server contains an unspecified vulnerability allowing an unauthenticated attacker to perform remote code execution. This vulnerability is related to CVE-2020-14882.
Required action: Apply updates per vendor instructions.
CVE-2020-1472: Microsoft Netlogon Privilege Escalation Vulnerability
Microsoft · Netlogon
Microsoft's Netlogon Remote Protocol (MS-NRPC) contains a privilege escalation vulnerability when an attacker establishes a vulnerable Netlogon secure channel connection to a domain controller. An attacker who successfully exploits the vulnerability could run a specially crafted application on a device on the…
Required action: Apply updates per vendor instructions.
CVE-2020-1464: Microsoft Windows Spoofing Vulnerability
Microsoft · Windows
Microsoft Windows contains a spoofing vulnerability when Windows incorrectly validates file signatures, allowing an attacker to bypass security features and load improperly signed files.
Required action: Apply updates per vendor instructions.
CVE-2020-1380: Microsoft Internet Explorer Scripting Engine Memory Corruption Vulnerability
Microsoft · Internet Explorer
Microsoft Internet Explorer contains a memory corruption vulnerability which can allow for remote code execution in the context of the current user.
Required action: Apply updates per vendor instructions.
CVE-2020-1350: Microsoft Windows DNS Server Remote Code Execution Vulnerability
Microsoft · Windows
Microsoft Windows DNS Servers fail to properly handle requests, allowing an attacker to perform remote code execution in the context of the Local System Account. The vulnerability is also known under the moniker of SIGRed.
Required action: Apply updates per vendor instructions.
CVE-2020-12812: Fortinet FortiOS SSL VPN Improper Authentication Vulnerability
Fortinet · FortiOS
Fortinet FortiOS SSL VPN contains an improper authentication vulnerability that may allow a user to login successfully without being prompted for the second factor of authentication (FortiToken) if they change the case in their username.
Required action: Apply updates per vendor instructions.
Complete fixed-window snapshot
CVEs — Past 48 Hours
All unique CVEs returned by NVD for the displayed UTC publication window. The snapshot is accepted only when its normalized unique-item count exactly equals the API totalResults value.
Entries 937–960 of 1,347
CVE-2026-82161
Dell Wyse Management Suite, versions prior to 2609.0.0.155, contain an Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Script injection.
CVE-2026-82160
Dell Wyse Management Suite, versions prior to 2609.0.0.155, contain an Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Script injection.
CVE-2026-82159
Dell Wyse Management Suite, versions prior to 2609.0.0.155, contain an Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Script injection.
CVE-2026-82158
Dell Wyse Management Suite, versions prior to 2609.0.0.155, contain an Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Script injection.
CVE-2026-82155
Dell OS Recovery tool versions, prior to 2.4.4, contain a use of Untrusted Search Path vulnerability. An unauthenticated attacker with local access could potentially exploit this vulnerability, leading to Command execution.
CVE-2026-82154
Dell OS Recovery tool versions, prior to 2.4.4, contain a use of Hard-coded Cryptographic Key vulnerability. An unauthenticated attacker with physical access could potentially exploit this vulnerability, leading to Information Disclosure.
CVE-2026-76894
CKAN MCP Server is a tool for querying CKAN open data portals. Prior to 0.4.112, the DataStore table UI in src/resources/datastore-table-ui.ts accepts window message events without validating event.origin and sends JSON-RPC messages through postMessage with a wildcard target origin. A frame that can reach the embedded…
CVE-2026-64672
Terragrunt is a flexible orchestration tool that allows Infrastructure as Code written in OpenTofu or Terraform to scale. Prior to 1.1.1, the terragrunt catalog command derives a predictable per-repository catalog clone root under the shared system temporary directory and follows a symlink already placed at that…
CVE-2026-61497
TinyUSB before 0.20.1 contains an integer underflow vulnerability in the HID host report descriptor parser tuh_hid_parse_report_descriptor() in src/class/hid/hid_host.c that allows a malicious USB device to trigger an out-of-bounds read by subtracting an item size from the remaining descriptor length without validating the item fits within the…
CVE-2026-61496
Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
CVE-2026-61495
TinyUSB through 0.21.0, fixed in commit e85c2b8, contains an out-of-bounds write vulnerability in the MTP device class helper mtp_container_get_string() in src/class/mtp/mtp.h that allows a malicious USB host to corrupt adjacent memory by supplying a crafted MTP string with an unbounded character count. Attackers can exploit the…
CVE-2026-55186
Silverstripe MFA provides multi-factor authentication for Silverstripe CMS. Prior to 6.0.0, the CMS 5 password reset flow can issue a logged-in session after a user changes a password but before the user's configured multi-factor authentication challenge is completed. An attacker with access to the user's email…
CVE-2026-28531
Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
CVE-2026-121621
A command injection vulnerability was found in Argo CD Image Updater, where a proxy URL configured on an SSH Git repository is passed unsanitized into a shell-interpreted SSH command. An attacker able to set a malicious proxy value can inject shell metacharacters to execute arbitrary commands…
CVE-2026-121580
Server-side request forgery in the Jira ticketing filter lookup in Devolutions Server 2026.2.22.0 and earlier allows an authenticated low-privileged user to obtain the stored Jira service account credentials via an attacker-controlled server address in the request.
CVE-2026-121517
A vulnerability was detected in IrfanView [network address omitted] on Win64. Affected by this vulnerability is an unknown functionality of the component TIFF Wang Annotation Handler. Performing a manipulation results in heap-based buffer overflow. The attack is possible to be carried out remotely. The complexity of…
CVE-2026-121514
A weakness has been identified in EasySoft ZenTao PMS up to 22.6. This impacts the function userModel[network address omitted]heckGroupChange of the file module/user/model.php of the component User Module. This manipulation of the argument group causes improper privilege management. Remote exploitation of the attack is possible. The…
CVE-2026-121509
A security flaw has been discovered in Headless CMS Plugin up to 2.0.4 on WordPress. This affects the function get_required_post_data of the file /wp-json/rae/v1/post of the component REST API. The manipulation of the argument post_id/post_slug results in information disclosure. The attack may be launched remotely. The…
CVE-2026-121502
A vulnerability was identified in mathurvishal CloudClassroom-PHP-Project. The impacted element is an unknown function of the file facultydetails.php. The manipulation of the argument deleteid leads to sql injection. The attack may be initiated remotely. The exploit is publicly available and might be used. This product uses…
CVE-2026-121257
Use after free in TabStrip in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted Chrome extension. (Chromium security severity: Medium)
CVE-2026-121256
Use of released resource in GPU in Google Chrome prior to 157.0.8103.38 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-121255
Incorrect authorization in Autofill AI in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-121254
Information leak in Select in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to obtain sensitive information via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-121253
Missing authorization in DevTools in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to bypass site isolation via a crafted Chrome extension. (Chromium security severity: Low)