Kythos AI vulnerability intelligence
Zero-Day Exploits / Vulnerabilities
A server-rendered, source-attributed view of confirmed CISA KEV entries and all NVD CVEs published in the rolling 48-hour UTC window.
Important distinction: CISA KEV means exploitation has been observed; it does not mean every entry was a zero-day. An NVD publication in the past 48 hours does not mean exploitation has occurred. Source records describe third-party products and do not identify Kythos AI customers, contracts, affiliations, or work history.
Confirmed exploitation intelligence
Zero-Day Exploits / Vulnerabilities
Complete CISA Known Exploited Vulnerabilities catalog, ordered by the date CISA added each entry. Every result is known to be exploited; entries are not necessarily zero-days.
Entries 1,729–1,752 of 1,769
CVE-2018-4878: Adobe Flash Player Use-After-Free Vulnerability
Adobe · Flash Player
Adobe Flash Player contains a use-after-free vulnerability that could allow for code execution.
Required action: The impacted product is end-of-life and should be disconnected if still in use.
CVE-2018-2380: SAP Customer Relationship Management (CRM) Path Traversal Vulnerability
SAP · Customer Relationship Management (CRM)
SAP Customer Relationship Management (CRM) contains a path traversal vulnerability that allows an attacker to exploit insufficient validation of path information provided by users.
Required action: Apply updates per vendor instructions.
CVE-2018-20062: ThinkPHP "noneCms" Remote Code Execution Vulnerability
ThinkPHP · noneCms
ThinkPHP "noneCms" contains an unspecified vulnerability that allows for remote code execution through crafted use of the filter parameter.
Required action: Apply updates per vendor instructions.
CVE-2018-18325: DotNetNuke (DNN) Inadequate Encryption Strength Vulnerability
DotNetNuke (DNN) · DotNetNuke (DNN)
DotNetNuke (DNN) contains an inadequate encryption strength vulnerability resulting from the use of a weak encryption algorithm to protect input parameters. This CVE ID resolves an incomplete patch for CVE-2018-15811.
Required action: Apply updates per vendor instructions.
CVE-2018-15961: Adobe ColdFusion Unrestricted File Upload Vulnerability
Adobe · ColdFusion
Adobe ColdFusion contains an unrestricted file upload vulnerability that could allow for code execution.
Required action: Apply updates per vendor instructions.
CVE-2018-15811: DotNetNuke (DNN) Inadequate Encryption Strength Vulnerability
DotNetNuke (DNN) · DotNetNuke (DNN)
DotNetNuke (DNN) contains an inadequate encryption strength vulnerability resulting from the use of a weak encryption algorithm to protect input parameters.
Required action: Apply updates per vendor instructions.
CVE-2018-14558: Tenda AC7, AC9, and AC10 Routers Command Injection Vulnerability
Tenda · AC7, AC9, and AC10 Routers
Tenda AC7, AC9, and AC10 devices contain a command injection vulnerability due to the "formsetUsbUnload" function executes a dosystemCmd function with untrusted input. Successful exploitation allows an attacker to execute OS commands via a crafted goform/setUsbUnload request.
Required action: Apply updates per vendor instructions.
CVE-2018-13379: Fortinet FortiOS SSL VPN Path Traversal Vulnerability
Fortinet · FortiOS
Fortinet FortiOS SSL VPN web portal contains a path traversal vulnerability that may allow an unauthenticated attacker to download FortiOS system files through specially crafted HTTP resource requests.
Required action: Apply updates per vendor instructions.
CVE-2018-11776: Apache Struts Remote Code Execution Vulnerability
Apache · Struts
Apache Struts contains a vulnerability that allows for remote code execution under two circumstances. One, where the alwaysSelectFullNamespace option is true and the value isn't set for a result defined in underlying configurations and in same time, its upper package configuration have…
Required action: Apply updates per vendor instructions.
CVE-2018-0802: Microsoft Office Memory Corruption Vulnerability
Microsoft · Office
Microsoft Office contains a memory corruption vulnerability due to the way objects are handled in memory. Successful exploitation allows for remote code execution in the context of the current user. This vulnerability is known to be chained with CVE-2018-0798.
Required action: Apply updates per vendor instructions.
CVE-2018-0798: Microsoft Office Memory Corruption Vulnerability
Microsoft · Office
Microsoft Office contains a memory corruption vulnerability due to the way objects are handled in memory. Successful exploitation allows for remote code execution in the context of the current user. This vulnerability is known to be chained with CVE-2018-0802.
Required action: Apply updates per vendor instructions.
CVE-2018-0296: Cisco Adaptive Security Appliance (ASA) Denial-of-Service Vulnerability
Cisco · Adaptive Security Appliance (ASA)
Cisco Adaptive Security Appliance (ASA) contains an improper input validation vulnerability with HTTP URLs. Exploitation could allow an attacker to cause a denial-of-service (DoS) condition or information disclosure.
Required action: Apply updates per vendor instructions.
CVE-2018-0171: Cisco IOS and IOS XE Software Smart Install Remote Code Execution Vulnerability
Cisco · IOS and IOS XE
Cisco IOS and IOS XE Software improperly validates packet data, allowing an unauthenticated, remote attacker to trigger a reload of an affected device, cause a denial-of-service (DoS) condition, or perform code execution on the affected device.
Required action: Apply updates per vendor instructions.
CVE-2017-9822: DotNetNuke (DNN) Remote Code Execution Vulnerability
DotNetNuke (DNN) · DotNetNuke (DNN)
DotNetNuke (DNN) contains a vulnerability that may allow for remote code execution via cookie deserialization.
Required action: Apply updates per vendor instructions.
CVE-2017-9805: Apache Struts Deserialization of Untrusted Data Vulnerability
Apache · Struts
Apache Struts REST Plugin uses an XStreamHandler with an instance of XStream for deserialization without any type filtering, which can lead to remote code execution when deserializing XML payloads.
Required action: Apply updates per vendor instructions.
CVE-2017-9248: Progress Telerik UI for ASP.NET AJAX and Sitefinity Cryptographic Weakness Vulnerability
Progress · ASP.NET AJAX and Sitefinity
Progress Telerik UI for ASP.NET AJAX and Sitefinity have a cryptographic weakness in Telerik.Web.UI.dll that can be exploited to disclose encryption keys (Telerik.Web.UI.DialogParametersEncryptionKey and/or the MachineKey), perform cross-site-scripting (XSS) attacks, compromise the ASP.NET ViewState, and/or upload and download files.
Required action: Apply updates per vendor instructions.
CVE-2017-8759: Microsoft .NET Framework Remote Code Execution Vulnerability
Microsoft · .NET Framework
Microsoft .NET Framework contains a remote code execution vulnerability when processing untrusted input that could allow an attacker to take control of an affected system.
Required action: Apply updates per vendor instructions.
CVE-2017-7269: Microsoft Windows Server Buffer Overflow Vulnerability
Microsoft · Internet Information Services (IIS)
Microsoft Windows Server 2003 R2 contains a buffer overflow vulnerability in Internet Information Services (IIS) 6.0 which allows remote attackers to execute code via a long header beginning with "If:
Required action: Apply updates per vendor instructions.
CVE-2017-6327: Symantec Messaging Gateway Remote Code Execution Vulnerability
Symantec · Symantec Messaging Gateway
Symantec Messaging Gateway contains an unspecified vulnerability which can allow for remote code execution. With the ability to perform remote code execution, an attacker may also desire to perform privilege escalating actions.
Required action: Apply updates per vendor instructions.
CVE-2017-5638: Apache Struts Remote Code Execution Vulnerability
Apache · Struts
Apache Struts Jakarta Multipart parser allows for malicious file upload using the Content-Type value, leading to remote code execution.
Required action: Apply updates per vendor instructions.
CVE-2017-16651: Roundcube Webmail File Disclosure Vulnerability
Roundcube · Roundcube Webmail
Roundcube Webmail contains a file disclosure vulnerability caused by insufficient input validation in conjunction with file-based attachment plugins, which are used by default.
Required action: Apply updates per vendor instructions.
CVE-2017-11882: Microsoft Office Memory Corruption Vulnerability
Microsoft · Office
Microsoft Office contains a memory corruption vulnerability that allows remote code execution in the context of the current user.
Required action: Apply updates per vendor instructions.
CVE-2017-11774: Microsoft Office Outlook Security Feature Bypass Vulnerability
Microsoft · Office
Microsoft Office Outlook contains a security feature bypass vulnerability due to improperly handling objects in memory. Successful exploitation allows an attacker to execute commands.
Required action: Apply updates per vendor instructions.
CVE-2017-0199: Microsoft Office and WordPad Remote Code Execution Vulnerability
Microsoft · Office and WordPad
Microsoft Office and WordPad contain an unspecified vulnerability due to the way the applications parse specially crafted files. Successful exploitation allows for remote code execution.
Required action: Apply updates per vendor instructions.
Complete fixed-window snapshot
CVEs — Past 48 Hours
All unique CVEs returned by NVD for the displayed UTC publication window. The snapshot is accepted only when its normalized unique-item count exactly equals the API totalResults value.
Entries 793–816 of 1,057
CVE-2026-66986
HCL AION is affected by a vulnerability where user sessions did not expire after a sufficient period of inactivity. An unattended authenticated session could be used by another person with access to the same system to view information or perform actions on behalf of the user,…
CVE-2026-66984
HCL AION is affected by a vulnerability where certain application responses revealed internal server file system paths. This information could help an attacker understand the application structure and plan further attacks, potentially resulting in unintended behavior or security impact under certain conditions.
CVE-2026-66982
HCL AION is affected by a vulnerability where browser autocomplete was enabled on sensitive login form fields, allowing the browser to store and suggest previously entered values. A malicious user with access to the same browser or system could retrieve saved credentials, potentially resulting in unintended…
CVE-2026-66981
HCL AION is affected by a vulnerability where the application trusted the value of the HTTP Host header supplied in requests without validation. An attacker could manipulate this header to influence links, redirects or responses generated by the application, potentially resulting in unintended behavior or security…
CVE-2026-58141
Dify before 1.15.0 contains a server-side request forgery vulnerability that allows any authenticated console user to bypass SSRF protections and issue arbitrary HTTP requests to internal services and cloud metadata endpoints due to the Squid proxy configuration only defining source ACLs without destination deny rules and…
CVE-2026-21834
HCL AION is affected by a vulnerability where the Content-Security-Policy (CSP) security response header was missing from application responses. Without this header, the browser does not restrict the sources of scripts and other content, increasing exposure to cross-site scripting and content-injection attacks, potentially resulting in unintended…
CVE-2026-123792
The Symfony Yaml components Inline and Parser, parse some YAML documents inefficiently, so that a small crafted document can take disproportionately long to process, keeping a PHP process busy for seconds or minutes, potentially causing a denial of service in Symfony versions prior to 5.4.56, 6.x…
CVE-2026-123677
A vulnerability was found in xxyopen/201206030 novel up to 3.5.0. Affected is the function getBookChapter of the file src/main/java/io/github/xxyopen/novel/service/impl/BookServiceImpl.java of the component Book Chapter Read Handler. Performing a manipulation of the argument chapterId results in authorization bypass. The attack may be initiated remotely. The exploit has…
CVE-2026-12067
Missing exception handlers in AvastSvc native message dispatcher (ashServ.dll) on Windows allow a local, unprivileged attacker to crash the service by sending specially crafted JSON messages. The vulnerability spans multiple handler pathways in the RPC-based native message protocol: * Log_NmSvc.message handler: converts JSON fields to strings…
CVE-2026-123676
A vulnerability has been found in xxyopen/201206030 novel up to 3.5.0. This impacts the function BookServiceImpl.getBookContentAbout of the file src/main/java/io/github/xxyopen/novel/service/impl/BookServiceImpl.java of the component Book Content Service. Such manipulation of the argument chapterId leads to improper authorization. The attack can be launched remotely. The exploit has been…
CVE-2026-123675
A flaw has been found in OpenBMB Internet of Agents up to 9d78e88e47160eb42ee1ee8538c05e1c2c47877a. This affects the function execute_code of the file im_client/agents/tools/code_executor.py of the component Code Executor Tool. This manipulation of the argument filename/lang causes code injection. The attack can be initiated remotely. The exploit has…
CVE-2026-123623
Grida through 0.0.24 contains a missing authorization vulnerability in the Forms file-preview API routes that allows unauthenticated attackers to read other organizations' form response files. Attackers can use form and field IDs exposed in public form payloads with a chosen path parameter to obtain service-role signed…
CVE-2026-121881
SQL injection vulnerability in the get_last_seen code-server session-state RPC in Posit Software, PBC Posit Workbench before 2026.08.0 allows authenticated users to read arbitrary data from the Workbench database via the sessionIds parameter. NOTE: exploitation requires a valid authenticated session; no administrative privileges are needed. The vulnerability…
CVE-2026-121880
Authorization bypass through user-controlled key in the localhost port-proxy (/p//) in Posit Software, PBC RStudio Server and Posit Workbench before 2026.08.0 allows remote authenticated users to reach web applications and other services bound to [network address omitted] under a different user's session, and to view their…
CVE-2026-121623
The Symfony Serializer component DataUriNormalizer[network address omitted]normalize() matches the data: scheme with a case-sensitive regular expression, allowing a value with an uppercase scheme, such as DATA:,/../../../etc/passwd, to bypass it, resulting in Arbitrary Local File Read through Path Traversal in Symfony versions prior to 5.4.56, 6.x prior…
CVE-2026-111573
Incorrect permissions on the Checkmk Windows agent's data directory, caused by a race condition that discards the permission changes during service start, in Checkmk
CVE-2026-87045
The HTTP/2 server in subsys/net/lib/http/http_server_http2.c clears the connection's stream binding at the start of every frame. handle_http_frame_header() executed client->current_stream = NULL unconditionally, but a CONTINUATION frame does not open a new stream and enter_http_frame_continuation_state() never re-bound one, so the rest of the header block was processed…
CVE-2026-64894
Inclusion of functionality from untrusted control sphere vulnerability in Johnson Controls EasyIO Neo IOManager and Tools Installer allows Malicious Software Update. This issue affects EasyIO Neo IOManager and Tools Installer: [network address omitted].
CVE-2026-59105
Jumis (formerly Tildes Jumis) creates and uses a Microsoft SQL Server login named ##Tilde_JumisAdmin## whose password is derived deterministically from a single non-secret input – the SQL Server name (@@servername). The derivation algorithm is hard-coded in the client application and is identical across every installation; it…
CVE-2026-53980
Charmbracelet wish before 2.0.5 contains a path traversal vulnerability in the git middleware (charm.land/wish/v2) that allows authenticated SSH users to escape the configured repository directory by supplying crafted repo paths that bypass a flawed forward-slash-count containment check in git.Middleware(). Attackers can use a single-depth path ../evil,…
CVE-2026-123786
Agenta before 0.122.5 contains a server-side request forgery vulnerability that allows workspace members with workflow edit rights to redirect workflow invocations by setting arbitrary revision URLs. Attackers can capture the attached secret-resolve Authorization token to read provider secrets from the vault API, or reach internal and…
CVE-2026-123785
Fluxbox through 1.3.7 contains an infinite loop vulnerability in Menu[network address omitted]updateMenu() in src/FbTk/Menu.cc that allows attackers to hang the window manager via crafted style geometry values. Attackers can supply a style with an oversized unbounded menu.titleHeight so the column loop never terminates, causing sustained CPU…
CVE-2026-123784
Fluxbox through 1.3.7 contains an OS command injection vulnerability in RootThem[network address omitted]reconfigTheme() that allows attackers to execute commands via crafted style background values. Attackers can embed shell metacharacters in background pixmap paths, random directories, or gradient texture text, which are concatenated unescaped into an fbsetbg…
CVE-2026-123783
Skyvern through 1.0.56 contains a sandbox bypass vulnerability that allows authenticated users to execute code by reconstructing functions from raw bytecode with types.CodeType. Attackers can deploy scripts that evade the is_safe_script_code AST denylist and import blocked modules such as subprocess or socket to run code in…