Kythos AI vulnerability intelligence

Zero-Day Exploits / Vulnerabilities

A server-rendered, source-attributed view of confirmed CISA KEV entries and all NVD CVEs published in the rolling 48-hour UTC window.

Important distinction: CISA KEV means exploitation has been observed; it does not mean every entry was a zero-day. An NVD publication in the past 48 hours does not mean exploitation has occurred. Source records describe third-party products and do not identify Kythos AI customers, contracts, affiliations, or work history.

CISA KEV catalog NVD 48-hour CVEs Kythos AI RSS feed

Confirmed exploitation intelligence

Zero-Day Exploits / Vulnerabilities

Complete CISA Known Exploited Vulnerabilities catalog, ordered by the date CISA added each entry. Every result is known to be exploited; entries are not necessarily zero-days.

Current snapshot

Entries 145–168 of 1,769

CISA KEVAdded Jun 23, 2026

CVE-2026-34908: Ubiquiti UniFi OS Improper Access Control Vulnerability

Ubiquiti · UniFi OS

Ubiquiti UniFi OS contains an improper access control vulnerability which could allow a malicious actor with access to the network to make unauthorized changes to the system.

Federal remediation due Jun 26, 2026Ransomware use: Not confirmed by CISA

Required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable…

View in the CISA KEV catalog →

CISA KEVAdded Jun 23, 2026

CVE-2025-67038: Lantronix EDS5000 Code Injection Vulnerability

Lantronix · EDS5000

Lantronix EDS5000 contains a code injection vulnerability that could allow attackers to inject arbitrary OS commands into the username parameter. Injected commands are executed with root privileges.

Federal remediation due Jun 26, 2026Ransomware use: Not confirmed by CISA

View in the CISA KEV catalog →

CISA KEVAdded Jun 18, 2026

CVE-2026-20253: Splunk Enterprise Missing Authentication for Critical Function Vulnerability

Splunk · Enterprise

Splunk Enterprise contains a missing authentication for critical function vulnerability which could allow an unauthenticated user to create or truncate arbitrary files through a PostgreSQL sidecar service endpoint.

Federal remediation due Jun 21, 2026Ransomware use: Not confirmed by CISA

View in the CISA KEV catalog →

CISA KEVAdded Jun 16, 2026

CVE-2026-48907: Widget Factory Joomla Content Editor Improper Access Control Vulnerability

Widget Factory · Joomla Content Editor

Widget Factory Joomla Content Editor contains an improper access control vulnerability which could allow for upload and execution of PHP code via the creation of new editor profiles for unauthenticated users.

Federal remediation due Jun 19, 2026Ransomware use: Not confirmed by CISA

View in the CISA KEV catalog →

CISA KEVAdded Jun 15, 2026

CVE-2026-54420: LiteSpeed cPanel Plugin UNIX Symbolic Link (Symlink) Following Vulnerability

LiteSpeed · cPanel Plugin

LiteSpeed cPanel plugin contains a UNIX symbolic link (Symlink) following vulnerability that could allow a user with FTP or web shell access on a shared hosting server running CloudLinux/CageFS.

Federal remediation due Jun 18, 2026Ransomware use: Not confirmed by CISA

View in the CISA KEV catalog →

CISA KEVAdded Jun 15, 2026

CVE-2026-20262: Cisco Catalyst SD-WAN Manager Directory or Path Traversal Vulnerability

Cisco · Catalyst SD-WAN Manager

Cisco Catalyst SD-WAN Manager contains a directory or path traversal vulnerability that could allow an authenticated, remote attacker to create a file or overwrite any file on the filesystem of an affected system.

Federal remediation due Jun 29, 2026Ransomware use: Not confirmed by CISA

View in the CISA KEV catalog →

CISA KEVAdded Jun 12, 2026

CVE-2026-35273: Oracle PeopleSoft Enterprise PeopleTools Missing Authentication for Critical Function Vulnerability

Oracle · PeopleSoft Enterprise PeopleTools

Oracle PeopleSoft Enterprise PeopleTools contains a missing authentication for critical function vulnerability which could allow an unauthenticated attacker to obtain takeover of PeopleSoft Enterprise PeopleTools.

Federal remediation due Jun 15, 2026Ransomware use: Known

View in the CISA KEV catalog →

CISA KEVAdded Jun 11, 2026

CVE-2026-10520: Ivanti Sentry OS Command Injection Vulnerability

Ivanti · Sentry

Ivanti Sentry (formerly known as MobileIron Sentry) contains an OS command injection vulnerability which could allow a remote unauthenticated user to achieve root-level remote code execution. This vulnerability can be successfully exploited in cases where the Sentry appliance is in an unmanaged…

Federal remediation due Jun 14, 2026Ransomware use: Not confirmed by CISA

View in the CISA KEV catalog →

CISA KEVAdded Jun 9, 2026

CVE-2026-7473: Arista Extensible Operating System Incomplete Comparison with Missing Factors Vulnerability

Arista · Extensible Operating System

Arista Extensible Operating System (EOS) contains an incomplete comparison with missing factors vulnerability when the switch incorrectly decapsulate and forwards other unexpected tunneled packet with a destination IP matching its configured decapsulation IP.

Federal remediation due Jun 23, 2026Ransomware use: Not confirmed by CISA

Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

View in the CISA KEV catalog →

CISA KEVAdded Jun 9, 2026

CVE-2026-20245: Cisco Catalyst SD-WAN Manager Improper Encoding or Escaping of Output Vulnerability

Cisco · Catalyst SD-WAN Manager

Cisco Catalyst SD-WAN Manager formerly SD-WAN vManage contains an improper encoding or escaping of output vulnerability. This vulnerability could allow an authenticated, local attacker to execute arbitrary commands as root by supplying a crafted file to the affected system.

Federal remediation due Jun 23, 2026Ransomware use: Not confirmed by CISA

Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

View in the CISA KEV catalog →

CISA KEVAdded Jun 9, 2026

CVE-2026-11645: Google Chromium V8 Out-of-Bounds Read and Write Vulnerability

Google · Chromium V8

Google Chromium V8 out-of-bounds read and write vulnerability that could allow a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google…

Federal remediation due Jun 23, 2026Ransomware use: Not confirmed by CISA

Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

View in the CISA KEV catalog →

CISA KEVAdded Jun 8, 2026

CVE-2026-50751: Check Point Security Gateway Improper Authentication Vulnerability

Check Point · Security Gateway

Check Point Security Gateway contains an improper authentication vulnerability in IKEv1 key exchange that could allow an unauthenticated remote attacker to bypass user authentication and establish a remote access VPN connection without a valid user password.

Federal remediation due Jun 11, 2026Ransomware use: Known

Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

View in the CISA KEV catalog →

CISA KEVAdded Jun 8, 2026

CVE-2026-42271: BerriAI LiteLLM Command Injection Vulnerability

BerriAI · LiteLLM

BerriAI LiteLLM contains a command injection vulnerability that could allow any authenticated user, including holders of low-privilege internal-user keys, to run arbitrary commands on the host.

Federal remediation due Jun 22, 2026Ransomware use: Not confirmed by CISA

Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

View in the CISA KEV catalog →

CISA KEVAdded Jun 5, 2026

CVE-2026-28318: SolarWinds Serv-U Uncontrolled Resource Consumption Vulnerability

SolarWinds · Serv-U

SolarWinds Serv-U contains an uncontrolled resource consumption vulnerability that allows specially crafted POST requests using the Content-Encoding: deflate header to crash the Serv-U service without authentication.

Federal remediation due Jun 19, 2026Ransomware use: Not confirmed by CISA

Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

View in the CISA KEV catalog →

CISA KEVAdded Jun 3, 2026

CVE-2026-45247: Mirasvit Full Page Cache Warmer Deserialization of Untrusted Data Vulnerability

Mirasvit · Mirasvit Full Page Cache Warmer

Mirasvit Full Page Cache Warmer contains a deserialization of untrusted data vulnerability that could allow unauthenticated attackers to achieve remote code execution by supplying a crafted serialized PHP object in the CacheWarmer cookie.

Federal remediation due Jun 6, 2026Ransomware use: Not confirmed by CISA

Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

View in the CISA KEV catalog →

CISA KEVAdded Jun 2, 2026

CVE-2025-48595: Android Framework Integer Overflow Vulnerability

Android · Framework

Android Framework contains an integer overflow vulnerability that allows for code execution that could allow for local privilege escalation.

Federal remediation due Jun 5, 2026Ransomware use: Not confirmed by CISA

Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

View in the CISA KEV catalog →

CISA KEVAdded Jun 2, 2026

CVE-2022-0492: Linux Kernel Improper Authentication Vulnerability

Linux · Kernel

Linux Kernel contains an improper authentication vulnerability which could allow for privilege escalation via the cgroups v1 release_agent feature.

Federal remediation due Jun 5, 2026Ransomware use: Not confirmed by CISA

Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

View in the CISA KEV catalog →

CISA KEVAdded Jun 1, 2026

CVE-2024-21182: Oracle WebLogic Server Unspecified Vulnerability

Oracle · WebLogic Server

Oracle WebLogic contains an unspecified vulnerability that could allow an unauthenticated attacker with network access via T3, IIOP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle…

Federal remediation due Jun 4, 2026Ransomware use: Not confirmed by CISA

Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

View in the CISA KEV catalog →

CISA KEVAdded May 29, 2026

CVE-2026-0257: Palo Alto Networks PAN-OS Authentication Bypass Vulnerability

Palo Alto Networks · PAN-OS

Palo Alto Networks PAN-OS contains an authentication bypass vulnerability that allows attackers to bypass security restrictions and establish an unauthorized VPN connection.

Federal remediation due Jun 1, 2026Ransomware use: Known

Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

View in the CISA KEV catalog →

CISA KEVAdded May 27, 2026

CVE-2026-8398: Daemon Tools Lite Embedded Malicious Code Vulnerability

Daemon · Daemon Tools Lite

Daemon Tools contains an unspecified vulnerability that has a high impact on confidentiality, integrity, and availability.

Federal remediation due May 30, 2026Ransomware use: Not confirmed by CISA

Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

View in the CISA KEV catalog →

CISA KEVAdded May 27, 2026

CVE-2026-48027: Nx Console Embedded Malicious Code Vulnerability

Nx · Nx Console

Nx Console contains an embedded malicious code vulnerability that allowed a malicious version of Nx Console to be published. The compromised extension fetched an obfuscated payload that could harvested credentials from multiple sources on disk and in memory.

Federal remediation due Jun 10, 2026Ransomware use: Known

Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

View in the CISA KEV catalog →

CISA KEVAdded May 27, 2026

CVE-2026-45321: TanStack Unspecified Vulnerability

TanStack · TanStack

TanStack contains an unspecified vulnerability that allowed malicious versions of the product to be published to the npm registry to publish credential-stealing malware under a trusted identity.

Federal remediation due Jun 10, 2026Ransomware use: Known

Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

View in the CISA KEV catalog →

CISA KEVAdded May 26, 2026

CVE-2026-48172: LiteSpeed cPanel Plugin Privilege Escalation Vulnerability

LiteSpeed · cPanel Plugin

LiteSpeed cPanel Plugin contains privilege escalation vulnerability that is exposed via the user-end cPanel plugin, which can be abused by any cPanel user account to execute arbitrary scripts with root privileges.

Federal remediation due May 29, 2026Ransomware use: Not confirmed by CISA

Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

View in the CISA KEV catalog →

CISA KEVAdded May 22, 2026

CVE-2026-9082: Drupal Core SQL Injection Vulnerability

Drupal · Core

Drupal Core contains a SQL injection vulnerability that could allow for privilege escalation and remote code execution via specially crafted requests sent with the database abstraction API.

Federal remediation due May 27, 2026Ransomware use: Not confirmed by CISA

Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

View in the CISA KEV catalog →

Source: Official CISA KEV JSONCatalog released Nov 6, 2026, 7:44 PM GMT+0000Site snapshot: Nov 8, 2026, 6:21 AM GMT+0000Showing 24 of 1,769Source text normalized: network addresses and restricted context omittedRefresh interval: 30 minutes

Complete fixed-window snapshot

CVEs — Past 48 Hours

All unique CVEs returned by NVD for the displayed UTC publication window. The snapshot is accepted only when its normalized unique-item count exactly equals the API totalResults value.

Current snapshot

Entries 361–384 of 1,057

NVD CVEPublished Nov 7, 2026, 5:19 AM GMT+0000

CVE-2026-19122

IBM API Connect [network address omitted] through [network address omitted] could allow an authenticated privileged attacker to send unauthorized requests from the system due to server-side request forgery. This could be used to enumerate network resources or to support further attacks.

CVSS 3.8 LOWStatus: Awaiting AnalysisCWE-918

Review the NVD record →