Kythos AI vulnerability intelligence
Zero-Day Exploits / Vulnerabilities
A server-rendered, source-attributed view of confirmed CISA KEV entries and all NVD CVEs published in the rolling 48-hour UTC window.
Important distinction: CISA KEV means exploitation has been observed; it does not mean every entry was a zero-day. An NVD publication in the past 48 hours does not mean exploitation has occurred. Source records describe third-party products and do not identify Kythos AI customers, contracts, affiliations, or work history.
Confirmed exploitation intelligence
Zero-Day Exploits / Vulnerabilities
Complete CISA Known Exploited Vulnerabilities catalog, ordered by the date CISA added each entry. Every result is known to be exploited; entries are not necessarily zero-days.
Entries 1,729–1,752 of 1,769
CVE-2018-4878: Adobe Flash Player Use-After-Free Vulnerability
Adobe · Flash Player
Adobe Flash Player contains a use-after-free vulnerability that could allow for code execution.
Required action: The impacted product is end-of-life and should be disconnected if still in use.
CVE-2018-2380: SAP Customer Relationship Management (CRM) Path Traversal Vulnerability
SAP · Customer Relationship Management (CRM)
SAP Customer Relationship Management (CRM) contains a path traversal vulnerability that allows an attacker to exploit insufficient validation of path information provided by users.
Required action: Apply updates per vendor instructions.
CVE-2018-20062: ThinkPHP "noneCms" Remote Code Execution Vulnerability
ThinkPHP · noneCms
ThinkPHP "noneCms" contains an unspecified vulnerability that allows for remote code execution through crafted use of the filter parameter.
Required action: Apply updates per vendor instructions.
CVE-2018-18325: DotNetNuke (DNN) Inadequate Encryption Strength Vulnerability
DotNetNuke (DNN) · DotNetNuke (DNN)
DotNetNuke (DNN) contains an inadequate encryption strength vulnerability resulting from the use of a weak encryption algorithm to protect input parameters. This CVE ID resolves an incomplete patch for CVE-2018-15811.
Required action: Apply updates per vendor instructions.
CVE-2018-15961: Adobe ColdFusion Unrestricted File Upload Vulnerability
Adobe · ColdFusion
Adobe ColdFusion contains an unrestricted file upload vulnerability that could allow for code execution.
Required action: Apply updates per vendor instructions.
CVE-2018-15811: DotNetNuke (DNN) Inadequate Encryption Strength Vulnerability
DotNetNuke (DNN) · DotNetNuke (DNN)
DotNetNuke (DNN) contains an inadequate encryption strength vulnerability resulting from the use of a weak encryption algorithm to protect input parameters.
Required action: Apply updates per vendor instructions.
CVE-2018-14558: Tenda AC7, AC9, and AC10 Routers Command Injection Vulnerability
Tenda · AC7, AC9, and AC10 Routers
Tenda AC7, AC9, and AC10 devices contain a command injection vulnerability due to the "formsetUsbUnload" function executes a dosystemCmd function with untrusted input. Successful exploitation allows an attacker to execute OS commands via a crafted goform/setUsbUnload request.
Required action: Apply updates per vendor instructions.
CVE-2018-13379: Fortinet FortiOS SSL VPN Path Traversal Vulnerability
Fortinet · FortiOS
Fortinet FortiOS SSL VPN web portal contains a path traversal vulnerability that may allow an unauthenticated attacker to download FortiOS system files through specially crafted HTTP resource requests.
Required action: Apply updates per vendor instructions.
CVE-2018-11776: Apache Struts Remote Code Execution Vulnerability
Apache · Struts
Apache Struts contains a vulnerability that allows for remote code execution under two circumstances. One, where the alwaysSelectFullNamespace option is true and the value isn't set for a result defined in underlying configurations and in same time, its upper package configuration have…
Required action: Apply updates per vendor instructions.
CVE-2018-0802: Microsoft Office Memory Corruption Vulnerability
Microsoft · Office
Microsoft Office contains a memory corruption vulnerability due to the way objects are handled in memory. Successful exploitation allows for remote code execution in the context of the current user. This vulnerability is known to be chained with CVE-2018-0798.
Required action: Apply updates per vendor instructions.
CVE-2018-0798: Microsoft Office Memory Corruption Vulnerability
Microsoft · Office
Microsoft Office contains a memory corruption vulnerability due to the way objects are handled in memory. Successful exploitation allows for remote code execution in the context of the current user. This vulnerability is known to be chained with CVE-2018-0802.
Required action: Apply updates per vendor instructions.
CVE-2018-0296: Cisco Adaptive Security Appliance (ASA) Denial-of-Service Vulnerability
Cisco · Adaptive Security Appliance (ASA)
Cisco Adaptive Security Appliance (ASA) contains an improper input validation vulnerability with HTTP URLs. Exploitation could allow an attacker to cause a denial-of-service (DoS) condition or information disclosure.
Required action: Apply updates per vendor instructions.
CVE-2018-0171: Cisco IOS and IOS XE Software Smart Install Remote Code Execution Vulnerability
Cisco · IOS and IOS XE
Cisco IOS and IOS XE Software improperly validates packet data, allowing an unauthenticated, remote attacker to trigger a reload of an affected device, cause a denial-of-service (DoS) condition, or perform code execution on the affected device.
Required action: Apply updates per vendor instructions.
CVE-2017-9822: DotNetNuke (DNN) Remote Code Execution Vulnerability
DotNetNuke (DNN) · DotNetNuke (DNN)
DotNetNuke (DNN) contains a vulnerability that may allow for remote code execution via cookie deserialization.
Required action: Apply updates per vendor instructions.
CVE-2017-9805: Apache Struts Deserialization of Untrusted Data Vulnerability
Apache · Struts
Apache Struts REST Plugin uses an XStreamHandler with an instance of XStream for deserialization without any type filtering, which can lead to remote code execution when deserializing XML payloads.
Required action: Apply updates per vendor instructions.
CVE-2017-9248: Progress Telerik UI for ASP.NET AJAX and Sitefinity Cryptographic Weakness Vulnerability
Progress · ASP.NET AJAX and Sitefinity
Progress Telerik UI for ASP.NET AJAX and Sitefinity have a cryptographic weakness in Telerik.Web.UI.dll that can be exploited to disclose encryption keys (Telerik.Web.UI.DialogParametersEncryptionKey and/or the MachineKey), perform cross-site-scripting (XSS) attacks, compromise the ASP.NET ViewState, and/or upload and download files.
Required action: Apply updates per vendor instructions.
CVE-2017-8759: Microsoft .NET Framework Remote Code Execution Vulnerability
Microsoft · .NET Framework
Microsoft .NET Framework contains a remote code execution vulnerability when processing untrusted input that could allow an attacker to take control of an affected system.
Required action: Apply updates per vendor instructions.
CVE-2017-7269: Microsoft Windows Server Buffer Overflow Vulnerability
Microsoft · Internet Information Services (IIS)
Microsoft Windows Server 2003 R2 contains a buffer overflow vulnerability in Internet Information Services (IIS) 6.0 which allows remote attackers to execute code via a long header beginning with "If:
Required action: Apply updates per vendor instructions.
CVE-2017-6327: Symantec Messaging Gateway Remote Code Execution Vulnerability
Symantec · Symantec Messaging Gateway
Symantec Messaging Gateway contains an unspecified vulnerability which can allow for remote code execution. With the ability to perform remote code execution, an attacker may also desire to perform privilege escalating actions.
Required action: Apply updates per vendor instructions.
CVE-2017-5638: Apache Struts Remote Code Execution Vulnerability
Apache · Struts
Apache Struts Jakarta Multipart parser allows for malicious file upload using the Content-Type value, leading to remote code execution.
Required action: Apply updates per vendor instructions.
CVE-2017-16651: Roundcube Webmail File Disclosure Vulnerability
Roundcube · Roundcube Webmail
Roundcube Webmail contains a file disclosure vulnerability caused by insufficient input validation in conjunction with file-based attachment plugins, which are used by default.
Required action: Apply updates per vendor instructions.
CVE-2017-11882: Microsoft Office Memory Corruption Vulnerability
Microsoft · Office
Microsoft Office contains a memory corruption vulnerability that allows remote code execution in the context of the current user.
Required action: Apply updates per vendor instructions.
CVE-2017-11774: Microsoft Office Outlook Security Feature Bypass Vulnerability
Microsoft · Office
Microsoft Office Outlook contains a security feature bypass vulnerability due to improperly handling objects in memory. Successful exploitation allows an attacker to execute commands.
Required action: Apply updates per vendor instructions.
CVE-2017-0199: Microsoft Office and WordPad Remote Code Execution Vulnerability
Microsoft · Office and WordPad
Microsoft Office and WordPad contain an unspecified vulnerability due to the way the applications parse specially crafted files. Successful exploitation allows for remote code execution.
Required action: Apply updates per vendor instructions.
Complete fixed-window snapshot
CVEs — Past 48 Hours
All unique CVEs returned by NVD for the displayed UTC publication window. The snapshot is accepted only when its normalized unique-item count exactly equals the API totalResults value.
Entries 889–912 of 1,057
CVE-2026-114630
The ELEX WordPress HelpDesk & Customer Ticketing System plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the factory_reset function in all versions up to, and including, 3.3.8 This makes it possible for unauthenticated attackers to delete arbitrary files…
CVE-2026-107658
The BuddyForms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'bf_post_type (and buddyforms_form_content)' parameter in all versions up to, and including, 2.10.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in…
CVE-2026-107622
The BuddyForms plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 2.10.5 via a form-type confusion attack through the `bf_post_type` parameter. This is due to the public frontend submission handler `buddyforms_form_response_no_ajax()` authorizing logged-out submissions based solely on the target form's…
CVE-2026-104010
The WPSyncSheets For Contact Form 7 – CF7 Google Sheets Connector & Save to Database plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1.8.0 via the 'any non-system CF7 field (e.g., your-message)' parameter parameter. This is due to…
CVE-2026-103908
The The AMP for WP – Accelerated Mobile Pages plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 1.1.18. This is due to the software allowing users to execute an action that does not properly validate a value before…
CVE-2026-103479
The Pubjet | پابجت plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 5.4.8. This is due to the `checkToken()` AJAX handler — registered under `wp_ajax_pubjet-check-token` — performing no capability check and no nonce verification before unconditionally writing the attacker-supplied…
CVE-2025-66621
Apache James SASL OAuthBearer/XOAUTH2 prior versions 3.9.1 fails to validate correctly AUD claim of JWT payloads when introspection is not configured. This allows an attacker with valid credentials to access the mail server even if they are not authorized to do so. We recommend users to…
CVE-2026-84164
The HTML report that plist-to-html, CodeChecker parse –export html and CodeChecker cmd diff –output html generate puts the report message, the checker name and the source file path into a script block through json.dumps. json.dumps does not escape the less-than character, so a closing script tag…
CVE-2026-84161
When an operator enables store.analysis_statistics_dir, a network client with PRODUCT_STORE permission for a product can call that product's storeAnalysisStatistics Thrift-over-HTTP method. CodeChecker 6.29.0 decodes the attacker-controlled Base64 string and passes the complete compressed input to one-shot zlib.decompress(). No maximum decompressed size is enforced. This gives a…
CVE-2026-84155
CodeChecker's web server fails to fully invalidate a session token on logout when the server runs with more than one API worker process (the default). Each worker process maintains its own in-memory session cache; logout only clears the cache of the single worker that handles the…
CVE-2026-66295
Saxy's XML encoder writes the target and the content of a processing instruction into the output document verbatim, without validation or escaping. The encoder builds the construct by concatenating both fields between , so neither field is checked against the constraints the XML specification places on…
CVE-2026-66294
XML injection in the Saxy XML encoder. Saxy.Encoder.cdata/1 serializes a {:cdata, characters} node by wrapping the supplied characters between and passing the payload through byte for byte. The encoder's character-data and attribute-value paths escape the XML metacharacters , &, ", and ', but the CDATA path…
CVE-2026-66293
XML injection in the encoder of Saxy. Saxy.Encoder does not neutralize the — sequence in XML comment content: escape_comment/2 returns the comment binary unchanged in every clause and only appends a space when the comment ends in a single -, so neither an interior — nor…
CVE-2026-123337
In JetBrains YouTrack before 2026.2.19656 users without update permission could change issue visibility
CVE-2026-123336
In JetBrains YouTrack before 2026.2.19728 the attachment size limit could be bypassed via AI assistant thread conversion
CVE-2026-123335
In JetBrains YouTrack before 2026.2.19562, 2026.1.14137, 2025.3.169041 missing authorization allowed attaching tags to any issue via the tag issues collection
CVE-2026-123334
In JetBrains YouTrack before 2026.2.19562 project admins of a related project could delete VCS integrations owned by another project
CVE-2026-123333
In JetBrains YouTrack before 2026.2.19562 sprint creation allowed moving issues from inaccessible projects between sprints
CVE-2026-123332
In JetBrains YouTrack before 2026.2.19562 missing authorization allowed Project Admin to manage VCS hosting server configurations
CVE-2026-123331
In JetBrains YouTrack before 2026.2.19197 article editors could change visibility of restricted child articles
CVE-2026-123330
In JetBrains YouTrack before 2026.2.19562 missing authorization allowed users with read-only access to change issue visibility settings
CVE-2026-123329
In JetBrains YouTrack before 2026.2.19562 missing authorization in TeamCity integration allowed disclosure of other projects' actions
CVE-2026-123328
In JetBrains YouTrack before 2026.2.19656 app permission bypass allowed privilege escalation via project tab
CVE-2026-123327
In JetBrains YouTrack before 2026.2.19562 missing authorization in the saved query endpoint allowed disclosure of issue descriptions