Kythos AI vulnerability intelligence
Zero-Day Exploits / Vulnerabilities
A server-rendered, source-attributed view of confirmed CISA KEV entries and all NVD CVEs published in the rolling 48-hour UTC window.
Important distinction: CISA KEV means exploitation has been observed; it does not mean every entry was a zero-day. An NVD publication in the past 48 hours does not mean exploitation has occurred. Source records describe third-party products and do not identify Kythos AI customers, contracts, affiliations, or work history.
Confirmed exploitation intelligence
Zero-Day Exploits / Vulnerabilities
Complete CISA Known Exploited Vulnerabilities catalog, ordered by the date CISA added each entry. Every result is known to be exploited; entries are not necessarily zero-days.
Entries 1,729–1,752 of 1,769
CVE-2018-4878: Adobe Flash Player Use-After-Free Vulnerability
Adobe · Flash Player
Adobe Flash Player contains a use-after-free vulnerability that could allow for code execution.
Required action: The impacted product is end-of-life and should be disconnected if still in use.
CVE-2018-2380: SAP Customer Relationship Management (CRM) Path Traversal Vulnerability
SAP · Customer Relationship Management (CRM)
SAP Customer Relationship Management (CRM) contains a path traversal vulnerability that allows an attacker to exploit insufficient validation of path information provided by users.
Required action: Apply updates per vendor instructions.
CVE-2018-20062: ThinkPHP "noneCms" Remote Code Execution Vulnerability
ThinkPHP · noneCms
ThinkPHP "noneCms" contains an unspecified vulnerability that allows for remote code execution through crafted use of the filter parameter.
Required action: Apply updates per vendor instructions.
CVE-2018-18325: DotNetNuke (DNN) Inadequate Encryption Strength Vulnerability
DotNetNuke (DNN) · DotNetNuke (DNN)
DotNetNuke (DNN) contains an inadequate encryption strength vulnerability resulting from the use of a weak encryption algorithm to protect input parameters. This CVE ID resolves an incomplete patch for CVE-2018-15811.
Required action: Apply updates per vendor instructions.
CVE-2018-15961: Adobe ColdFusion Unrestricted File Upload Vulnerability
Adobe · ColdFusion
Adobe ColdFusion contains an unrestricted file upload vulnerability that could allow for code execution.
Required action: Apply updates per vendor instructions.
CVE-2018-15811: DotNetNuke (DNN) Inadequate Encryption Strength Vulnerability
DotNetNuke (DNN) · DotNetNuke (DNN)
DotNetNuke (DNN) contains an inadequate encryption strength vulnerability resulting from the use of a weak encryption algorithm to protect input parameters.
Required action: Apply updates per vendor instructions.
CVE-2018-14558: Tenda AC7, AC9, and AC10 Routers Command Injection Vulnerability
Tenda · AC7, AC9, and AC10 Routers
Tenda AC7, AC9, and AC10 devices contain a command injection vulnerability due to the "formsetUsbUnload" function executes a dosystemCmd function with untrusted input. Successful exploitation allows an attacker to execute OS commands via a crafted goform/setUsbUnload request.
Required action: Apply updates per vendor instructions.
CVE-2018-13379: Fortinet FortiOS SSL VPN Path Traversal Vulnerability
Fortinet · FortiOS
Fortinet FortiOS SSL VPN web portal contains a path traversal vulnerability that may allow an unauthenticated attacker to download FortiOS system files through specially crafted HTTP resource requests.
Required action: Apply updates per vendor instructions.
CVE-2018-11776: Apache Struts Remote Code Execution Vulnerability
Apache · Struts
Apache Struts contains a vulnerability that allows for remote code execution under two circumstances. One, where the alwaysSelectFullNamespace option is true and the value isn't set for a result defined in underlying configurations and in same time, its upper package configuration have…
Required action: Apply updates per vendor instructions.
CVE-2018-0802: Microsoft Office Memory Corruption Vulnerability
Microsoft · Office
Microsoft Office contains a memory corruption vulnerability due to the way objects are handled in memory. Successful exploitation allows for remote code execution in the context of the current user. This vulnerability is known to be chained with CVE-2018-0798.
Required action: Apply updates per vendor instructions.
CVE-2018-0798: Microsoft Office Memory Corruption Vulnerability
Microsoft · Office
Microsoft Office contains a memory corruption vulnerability due to the way objects are handled in memory. Successful exploitation allows for remote code execution in the context of the current user. This vulnerability is known to be chained with CVE-2018-0802.
Required action: Apply updates per vendor instructions.
CVE-2018-0296: Cisco Adaptive Security Appliance (ASA) Denial-of-Service Vulnerability
Cisco · Adaptive Security Appliance (ASA)
Cisco Adaptive Security Appliance (ASA) contains an improper input validation vulnerability with HTTP URLs. Exploitation could allow an attacker to cause a denial-of-service (DoS) condition or information disclosure.
Required action: Apply updates per vendor instructions.
CVE-2018-0171: Cisco IOS and IOS XE Software Smart Install Remote Code Execution Vulnerability
Cisco · IOS and IOS XE
Cisco IOS and IOS XE Software improperly validates packet data, allowing an unauthenticated, remote attacker to trigger a reload of an affected device, cause a denial-of-service (DoS) condition, or perform code execution on the affected device.
Required action: Apply updates per vendor instructions.
CVE-2017-9822: DotNetNuke (DNN) Remote Code Execution Vulnerability
DotNetNuke (DNN) · DotNetNuke (DNN)
DotNetNuke (DNN) contains a vulnerability that may allow for remote code execution via cookie deserialization.
Required action: Apply updates per vendor instructions.
CVE-2017-9805: Apache Struts Deserialization of Untrusted Data Vulnerability
Apache · Struts
Apache Struts REST Plugin uses an XStreamHandler with an instance of XStream for deserialization without any type filtering, which can lead to remote code execution when deserializing XML payloads.
Required action: Apply updates per vendor instructions.
CVE-2017-9248: Progress Telerik UI for ASP.NET AJAX and Sitefinity Cryptographic Weakness Vulnerability
Progress · ASP.NET AJAX and Sitefinity
Progress Telerik UI for ASP.NET AJAX and Sitefinity have a cryptographic weakness in Telerik.Web.UI.dll that can be exploited to disclose encryption keys (Telerik.Web.UI.DialogParametersEncryptionKey and/or the MachineKey), perform cross-site-scripting (XSS) attacks, compromise the ASP.NET ViewState, and/or upload and download files.
Required action: Apply updates per vendor instructions.
CVE-2017-8759: Microsoft .NET Framework Remote Code Execution Vulnerability
Microsoft · .NET Framework
Microsoft .NET Framework contains a remote code execution vulnerability when processing untrusted input that could allow an attacker to take control of an affected system.
Required action: Apply updates per vendor instructions.
CVE-2017-7269: Microsoft Windows Server Buffer Overflow Vulnerability
Microsoft · Internet Information Services (IIS)
Microsoft Windows Server 2003 R2 contains a buffer overflow vulnerability in Internet Information Services (IIS) 6.0 which allows remote attackers to execute code via a long header beginning with "If:
Required action: Apply updates per vendor instructions.
CVE-2017-6327: Symantec Messaging Gateway Remote Code Execution Vulnerability
Symantec · Symantec Messaging Gateway
Symantec Messaging Gateway contains an unspecified vulnerability which can allow for remote code execution. With the ability to perform remote code execution, an attacker may also desire to perform privilege escalating actions.
Required action: Apply updates per vendor instructions.
CVE-2017-5638: Apache Struts Remote Code Execution Vulnerability
Apache · Struts
Apache Struts Jakarta Multipart parser allows for malicious file upload using the Content-Type value, leading to remote code execution.
Required action: Apply updates per vendor instructions.
CVE-2017-16651: Roundcube Webmail File Disclosure Vulnerability
Roundcube · Roundcube Webmail
Roundcube Webmail contains a file disclosure vulnerability caused by insufficient input validation in conjunction with file-based attachment plugins, which are used by default.
Required action: Apply updates per vendor instructions.
CVE-2017-11882: Microsoft Office Memory Corruption Vulnerability
Microsoft · Office
Microsoft Office contains a memory corruption vulnerability that allows remote code execution in the context of the current user.
Required action: Apply updates per vendor instructions.
CVE-2017-11774: Microsoft Office Outlook Security Feature Bypass Vulnerability
Microsoft · Office
Microsoft Office Outlook contains a security feature bypass vulnerability due to improperly handling objects in memory. Successful exploitation allows an attacker to execute commands.
Required action: Apply updates per vendor instructions.
CVE-2017-0199: Microsoft Office and WordPad Remote Code Execution Vulnerability
Microsoft · Office and WordPad
Microsoft Office and WordPad contain an unspecified vulnerability due to the way the applications parse specially crafted files. Successful exploitation allows for remote code execution.
Required action: Apply updates per vendor instructions.
Complete fixed-window snapshot
CVEs — Past 48 Hours
All unique CVEs returned by NVD for the displayed UTC publication window. The snapshot is accepted only when its normalized unique-item count exactly equals the API totalResults value.
Entries 361–384 of 1,057
CVE-2026-19122
IBM API Connect [network address omitted] through [network address omitted] could allow an authenticated privileged attacker to send unauthorized requests from the system due to server-side request forgery. This could be used to enumerate network resources or to support further attacks.
CVE-2026-19121
IBM API Connect [network address omitted] through [network address omitted] could allow an authenticated attacker to gain unauthorized access due to improper authorization. Tenant context is not sufficiently verified against the authenticated user, which could allow access to another tenant's resources.
CVE-2026-18838
IBM API Connect [network address omitted] through [network address omitted] could allow a remote attacker to obtain sensitive information and modify API configurations due to improper authentication. Identity information supplied in requests is not sufficiently verified, which could allow a caller to impersonate another user.
CVE-2026-18836
IBM API Connect [network address omitted] through [network address omitted] and [network address omitted] through [network address omitted] could allow a remote attacker to obtain sensitive information due to server-side request forgery. The affected component can be made to send requests to unintended destinations and return…
CVE-2026-18689
IBM API Connect [network address omitted] through [network address omitted] and [network address omitted] through [network address omitted] could allow an authenticated user to obtain limited information about other organizations due to incorrect authorization. A token issued for a limited purpose is accepted where it should…
CVE-2026-18535
IBM API Connect [network address omitted] through [network address omitted] and [network address omitted] through [network address omitted] are vulnerable to a Regular Expression Denial of Service (ReDoS) attack and to improper neutralisation of wildcard query operators.
CVE-2026-17428
IBM API Connect [network address omitted] through [network address omitted] and [network address omitted] through [network address omitted] could allow a remote authenticated attacker to obtain sensitive information due to improper authorization. Values supplied in the request URL are used in authorization decisions without sufficient verification,…
CVE-2026-17411
IBM API Connect [network address omitted] through [network address omitted] and [network address omitted] through [network address omitted] could allow an authenticated attacker to view, add, modify, or delete information in the back-end database due to SQL injection. Input is not properly neutralized before it is…
CVE-2026-17410
IBM API Connect [network address omitted] through [network address omitted] and [network address omitted] through [network address omitted] could allow a remote authenticated attacker to access and modify other tenants' portal data due to improper neutralization of argument delimiters.
CVE-2026-17409
IBM API Connect [network address omitted] through [network address omitted] and [network address omitted] through [network address omitted] could allow a remote attacker to execute unauthorized administrative operations and obtain sensitive information due to improper handling of case sensitivity. Access controls are not applied consistently to…
CVE-2026-17408
IBM API Connect [network address omitted] through [network address omitted] and [network address omitted] through [network address omitted] could allow a remote attacker to execute arbitrary code due to improper neutralization of special elements in an OS command.
CVE-2026-17407
IBM API Connect [network address omitted] through [network address omitted] and [network address omitted] through [network address omitted] could allow a remote authenticated attacker to execute arbitrary SQL commands due to SQL injection. Values received during sign-in are not properly neutralized before being used in a…
CVE-2026-17406
IBM API Connect [network address omitted] through [network address omitted] and [network address omitted] through [network address omitted] could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery. Address checks can be bypassed, which could allow the server to reach destinations…
CVE-2026-17405
IBM API Connect [network address omitted] through [network address omitted] and [network address omitted] through [network address omitted] could allow a remote authenticated attacker to obtain sensitive information due to broken object-level authorization. Access checks on keystore objects do not confirm that the requesting user is…
CVE-2026-17404
IBM API Connect [network address omitted] through [network address omitted] and [network address omitted] through [network address omitted] could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery.
CVE-2026-17403
IBM API Connect [network address omitted] through [network address omitted] and [network address omitted] through [network address omitted] could allow a remote attacker to gain full administrative control due to the use of hard-coded credentials.
CVE-2026-17402
IBM API Connect [network address omitted] through [network address omitted] and [network address omitted] through [network address omitted] could allow a remote authenticated attacker to execute arbitrary commands due to OS command injection. User-supplied input is not properly neutralized before it is passed to the operating…
CVE-2026-17401
IBM API Connect [network address omitted] through [network address omitted] and [network address omitted] through [network address omitted] could allow a remote authenticated attacker to execute arbitrary code due to a stack-based buffer overflow.
CVE-2026-17400
IBM API Connect [network address omitted] through [network address omitted] and [network address omitted] through [network address omitted] could allow a remote authenticated attacker to obtain sensitive information due to SQL injection.
CVE-2026-17399
IBM API Connect [network address omitted] through [network address omitted] and [network address omitted] through [network address omitted] could allow a remote authenticated attacker to execute arbitrary code due to insufficient validation of uploaded content. Content uploaded to the product is not sufficiently checked before it…
CVE-2026-17398
IBM API Connect [network address omitted] through [network address omitted] and [network address omitted] through [network address omitted] could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery.
CVE-2026-17397
IBM API Connect [network address omitted] through [network address omitted] and [network address omitted] through [network address omitted] could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery.
CVE-2026-17396
IBM API Connect [network address omitted] through [network address omitted] and [network address omitted] through [network address omitted] could allow a remote authenticated attacker to obtain sensitive information due to SQL injection.
CVE-2026-17395
IBM API Connect [network address omitted] through [network address omitted] and [network address omitted] through [network address omitted] could allow a remote authenticated attacker to access internal network resources due to improper validation of a user-supplied URL. Destinations are not sufficiently restricted, which could allow the…