Kythos AI vulnerability intelligence
Zero-Day Exploits / Vulnerabilities
A server-rendered, source-attributed view of confirmed CISA KEV entries and all NVD CVEs published in the rolling 48-hour UTC window.
Important distinction: CISA KEV means exploitation has been observed; it does not mean every entry was a zero-day. An NVD publication in the past 48 hours does not mean exploitation has occurred. Source records describe third-party products and do not identify Kythos AI customers, contracts, affiliations, or work history.
Confirmed exploitation intelligence
Zero-Day Exploits / Vulnerabilities
Complete CISA Known Exploited Vulnerabilities catalog, ordered by the date CISA added each entry. Every result is known to be exploited; entries are not necessarily zero-days.
Entries 1,705–1,728 of 1,769
CVE-2019-15949: Nagios XI Remote Code Execution Vulnerability
Nagios · Nagios XI
Nagios XI contains a remote code execution vulnerability in which a user can modify the check_plugin executable and insert malicious commands to execute as root.
Required action: Apply updates per vendor instructions.
CVE-2019-15752: Docker Desktop Community Edition Privilege Escalation Vulnerability
Docker · Desktop Community Edition
Docker Desktop Community Edition contains a vulnerability that may allow local users to escalate privileges by placing a trojan horse docker-credential-wincred.exe file in %PROGRAMDATA%\DockerDesktop\version-bin\.
Required action: Apply updates per vendor instructions.
CVE-2019-1429: Microsoft Internet Explorer Scripting Engine Memory Corruption Vulnerability
Microsoft · Internet Explorer
Microsoft Internet Explorer contains a memory corruption vulnerability which can allow for remote code execution in the context of the current user.
Required action: Apply updates per vendor instructions.
CVE-2019-1367: Microsoft Internet Explorer Scripting Engine Memory Corruption Vulnerability
Microsoft · Internet Explorer
Microsoft Internet Explorer contains a memory corruption vulnerability in how the scripting engine handles objects in memory. Successful exploitation allows for remote code execution in the context of the current user.
Required action: Apply updates per vendor instructions.
CVE-2019-13608: Citrix StoreFront Server XML External Entity (XXE) Processing Vulnerability
Citrix · StoreFront Server
Citrix StoreFront Server contains an XML External Entity (XXE) processing vulnerability that may allow an unauthenticated attacker to retrieve potentially sensitive information.
Required action: Apply updates per vendor instructions.
CVE-2019-1215: Microsoft Windows Privilege Escalation Vulnerability
Microsoft · Windows
Microsoft Windows contains an unspecified vulnerability due to the way ws2ifsl.sys (Winsock) handles objects in memory, allowing for privilege escalation. Successful exploitation allows an attacker to execute code with elevated privileges.
Required action: Apply updates per vendor instructions.
CVE-2019-1214: Microsoft Windows Privilege Common Log File System (CLFS) Escalation Vulnerability
Microsoft · Windows
Microsoft Windows Common Log File System (CLFS) driver improperly handles objects in memory which can allow for privilege escalation.
Required action: Apply updates per vendor instructions.
CVE-2019-11634: Citrix Workspace Application and Receiver for Windows Remote Code Execution Vulnerability
Citrix · Workspace Application and Receiver for Windows
Citrix Workspace Application and Receiver for Windows contains remote code execution vulnerability resulting from local drive access preferences not being enforced into the clients' local drives.
Required action: Apply updates per vendor instructions.
CVE-2019-11580: Atlassian Crowd and Crowd Data Center Remote Code Execution Vulnerability
Atlassian · Crowd and Crowd Data Center
Atlassian Crowd and Crowd Data Center contain a remote code execution vulnerability resulting from a pdkinstall development plugin being incorrectly enabled in release builds.
Required action: Apply updates per vendor instructions.
CVE-2019-11539: Ivanti Pulse Connect Secure and Policy Secure Command Injection Vulnerability
Ivanti · Pulse Connect Secure and Pulse Policy Secure
Ivanti Pulse Connect Secure and Policy Secure allows an authenticated attacker from the admin web interface to inject and execute commands.
Required action: Apply updates per vendor instructions.
CVE-2019-11510: Ivanti Pulse Connect Secure Arbitrary File Read Vulnerability
Ivanti · Pulse Connect Secure
Ivanti Pulse Connect Secure contains an arbitrary file read vulnerability that allows an unauthenticated remote attacker with network access via HTTPS to send a specially crafted URI.
Required action: Apply updates per vendor instructions.
CVE-2019-0863: Microsoft Windows Error Reporting (WER) Privilege Escalation Vulnerability
Microsoft · Windows
Microsoft Windows Error Reporting (WER) contains a privilege escalation vulnerability due to the way it handles files, allowing for code execution in kernel mode.
Required action: Apply updates per vendor instructions.
CVE-2019-0859: Microsoft Win32k Privilege Escalation Vulnerability
Microsoft · Win32k
Microsoft Win32k fails to properly handle objects in memory causing privilege escalation. Successful exploitation allows an attacker to run code in kernel mode.
Required action: Apply updates per vendor instructions.
CVE-2019-0808: Microsoft Win32k Privilege Escalation Vulnerability
Microsoft · Win32k
Microsoft Win32k contains a privilege escalation vulnerability due to the component failing to properly handle objects in memory. Successful exploitation allows an attacker to run code in kernel mode.
Required action: Apply updates per vendor instructions.
CVE-2019-0803: Microsoft Win32k Privilege Escalation Vulnerability
Microsoft · Win32k
Microsoft Win32k contains an unspecified vulnerability due to it failing to properly handle objects in memory causing privilege escalation. Successful exploitation allows an attacker to run code in kernel mode.
Required action: Apply updates per vendor instructions.
CVE-2019-0797: Microsoft Win32k Privilege Escalation Vulnerability
Microsoft · Win32k
Microsoft Win32k contains a privilege escalation vulnerability when the Win32k component fails to properly handle objects in memory. Successful exploitation allows an attacker to execute code in kernel mode.
Required action: Apply updates per vendor instructions.
CVE-2019-0708: Microsoft Remote Desktop Services Remote Code Execution Vulnerability
Microsoft · Remote Desktop Services
Microsoft Remote Desktop Services, formerly known as Terminal Service, contains an unspecified vulnerability that allows an unauthenticated attacker to connect to the target system using RDP and send specially crafted requests. Successful exploitation allows for remote code execution. The vulnerability is also…
Required action: Apply updates per vendor instructions.
CVE-2019-0604: Microsoft SharePoint Remote Code Execution Vulnerability
Microsoft · SharePoint
Microsoft SharePoint fails to check the source markup of an application package. An attacker who successfully exploits the vulnerability could run remote code in the context of the SharePoint application pool and the SharePoint server farm account.
Required action: Apply updates per vendor instructions.
CVE-2019-0541: Microsoft MSHTML Remote Code Execution Vulnerability
Microsoft · MSHTML
Microsoft MSHTML engine contains an improper input validation vulnerability that allows for remote code execution vulnerability.
Required action: Apply updates per vendor instructions.
CVE-2019-0211: Apache HTTP Server Privilege Escalation Vulnerability
Apache · HTTP Server
Apache HTTP Server, with MPM event, worker or prefork, code executing in less-privileged child processes or threads (including scripts executed by an in-process scripting interpreter) could execute code with the privileges of the parent process (usually root) by manipulating the scoreboard.
Required action: Apply updates per vendor instructions.
CVE-2018-8653: Microsoft Internet Explorer Scripting Engine Memory Corruption Vulnerability
Microsoft · Internet Explorer
Microsoft Internet Explorer contains a memory corruption vulnerability due to how the Scripting Engine handles objects in memory, leading to remote code execution.
Required action: Apply updates per vendor instructions.
CVE-2018-7600: Drupal Core Remote Code Execution Vulnerability
Drupal · Drupal Core
Drupal Core contains a remote code execution vulnerability that could allow an attacker to exploit multiple attack vectors on a Drupal site, resulting in complete site compromise.
Required action: Apply updates per vendor instructions.
CVE-2018-6789: Exim Buffer Overflow Vulnerability
Exim · Exim
Exim contains a buffer overflow vulnerability in the base64d function part of the SMTP listener that may allow for remote code execution.
Required action: Apply updates per vendor instructions.
CVE-2018-4939: Adobe ColdFusion Deserialization of Untrusted Data Vulnerability
Adobe · ColdFusion
Adobe ColdFusion contains a deserialization of untrusted data vulnerability that could allow for code execution.
Required action: Apply updates per vendor instructions.
Complete fixed-window snapshot
CVEs — Past 48 Hours
All unique CVEs returned by NVD for the displayed UTC publication window. The snapshot is accepted only when its normalized unique-item count exactly equals the API totalResults value.
Entries 1,009–1,032 of 1,057
CVE-2026-119488
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Shamim Rajani Pie Register pie-register allows Stored XSS.This issue affects Pie Register: from n/a through [network address omitted].
CVE-2026-119472
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in David Anderson Redux Framework redux-framework allows Stored XSS.This issue affects Redux Framework: from n/a through 4.5.16.
CVE-2026-118423
The WP Libre Form WordPress plugin [network address omitted] does not validate the type of files uploaded through its form submissions, allowing unauthenticated attackers to upload PHP files to a web-accessible location and execute them, leading to remote code execution.
CVE-2026-118166
The MC4WP: Mailchimp for WordPress WordPress plugin before 4.15.0 does not prevent request-derived values in its dynamic content tags from being processed as shortcodes when a form is embedded with its block, allowing unauthenticated visitors to execute arbitrary registered shortcodes with attacker-chosen attributes. This requires the…
CVE-2026-9797
A flaw was found in Keycloak's administrative services (org.keycloak.services.resources.admin). A highly privileged attacker, authenticated with a 'manage-clients' role, could exploit this vulnerability through several methods, including manipulating client JSON Web Key Sets (JWKS), swapping client authenticator types and resetting secrets, or downloading legitimate signing keys. Successful…
CVE-2026-83494
A flaw was found in the training-operator. An incorrect object casting in the PyTorchJob ValidateUpdate webhook allows users to bypass an immutability check. This vulnerability could enable users to detach a queued job from its quota management system or hijack a running job's controller ownership. The…
CVE-2026-83493
A flaw was found in distributed-workloads. A remote attacker could exploit a vulnerability in the pull_request_target workflow by submitting a specially crafted pull request. This workflow processes untrusted code from the pull request author while operating with the base repository's sensitive secrets, such as the SNYK_TOKEN,…
CVE-2026-73473
A flaw was found in GStreamer gst-plugins-good (avidemux). In the subindex parser, missing validation of the entry count can cause excessive memory allocation and denial of service. Because avidemux is auto-plugged by playbin, decodebin, and gst-discoverer, opening or previewing a crafted AVI is sufficient to trigger…
CVE-2026-73472
A flaw was found in GStreamer gst-plugins-good (avidemux). In the superindex and subindex parsers, integer overflow can bypass bounds checks and cause out-of-bounds reads. Because avidemux is auto-plugged by playbin, decodebin, and gst-discoverer, opening or previewing a crafted AVI is sufficient to trigger the issue. Fixed…
CVE-2026-73471
A flaw was found in GStreamer gst-plugins-good (avidemux). In the Nikon metadata tag parser, a pointer can be dereferenced without verifying that data remains in the buffer, causing out-of-bounds reads. Because avidemux is auto-plugged by playbin, decodebin, and gst-discoverer, opening or previewing a crafted AVI is…
CVE-2026-120749
A flaw was found in D-Bus. With a privileged Monitoring client attached (for example dbus-monitor or busctl monitor), an unprivileged local user can cause dbus-daemon to abort if a driver-originated broadcast such as NameOwnerChanged or ActivatableServicesChanged cannot be delivered to a recipient (for example due to…
CVE-2026-97848
A flaw was found in the token sanitization logic of Keycloak, an open source identity and access management solution. The issue occurs when a protocol mapper is configured to emit structured claims using the JSON type. The security check designed to remove unauthorized role mappings only…
CVE-2026-97367
A flaw was found in the Keycloak Account REST API where it incorrectly handles session identification. A malicious client owner can manipulate their own security tokens to point to a different user's active session. This allows the attacker to access and modify the victim's account information,…
CVE-2026-96547
A flaw was found in the Dynamic Client Registration component of Keycloak, an open-source identity and access management solution. The issue occurs because the system does not properly restrict which claim names can be used when setting up new clients. An attacker with valid registration credentials…
CVE-2026-96460
A flaw was found in the token exchange mechanism of Keycloak. When using Standard Token Exchange V2, the system issues new tokens with a fresh lifetime based on the requester clients configuration instead of limiting it to the original tokens expiration. This issue allows an authenticated…
CVE-2026-96447
A flaw was found in the TokenManager component of Keycloak, an open-source identity and access management solution. The issue occurs during the validation of stateless access tokens when the original user ID no longer exists. Keycloak incorrectly falls back to using the username to identify the…
CVE-2026-92856
A flaw was found in the SAML brokering component of Keycloak, an identity and access management solution. The issue occurs when Keycloak acts as an intermediary between an upstream identity provider and downstream services. Keycloak fails to respect specific security instructions called ProxyRestrictions in the login…
CVE-2026-92396
The ShopEngine Gutenberg WooCommerce Builder Blocks Addon WordPress plugin before 2.4.4 does not validate the user's capabilities or the ownership of the targeted post in one of its AJAX actions, and does not escape the stored value before outputting it in a JavaScript context, allowing users…
CVE-2026-87784
The Cool Media Filter WordPress plugin through 1.0.1 does not perform any capability or nonce check when updating the capabilities of a role, allowing any authenticated user, such as a subscriber, to grant their own role administrator capabilities and take over the site.
CVE-2026-86606
The iubenda | All-in-one Compliance for GDPR / CCPA Cookie Consent + more WordPress plugin before 3.13.7 does not properly escape content it re-emits through its bundled HTML parser, allowing unauthenticated users to inject arbitrary web scripts in pages that will execute in the session of…
CVE-2026-19688
A flaw was found in the Admin REST API of Keycloak, an identity and access management solution. The Admin API fails to verify the intended audience of bearer tokens during authentication. This issue allows an attacker who operates a client within a realm to capture an…
CVE-2026-12967
The WCFM Membership WordPress plugin before 2.12.1 does not verify that payment was made before completing a paid membership, allowing any authenticated Subscriber/Customer to activate a paid vendor membership for free and gain the marketplace vendor role.
CVE-2026-123037
A flaw was found in the ansible-core user module. When generate_ssh_key is enabled, User.ssh_key_gen() guards the key files against symlinks but checks the ~/.ssh directory only with os.path.exists(). An unprivileged user on a managed node who replaces their ~/.ssh with a symlink to an existing root-writable…
CVE-2026-121837
A flaw was found in the REST Data Panache component of Quarkus. When a security constraint is applied to an entity property using the @SecureField annotation on its getter method rather than the field itself, the generated REST resource fails to enforce this constraint for filtering…