Kythos AI vulnerability intelligence

Zero-Day Exploits / Vulnerabilities

A server-rendered, source-attributed view of confirmed CISA KEV entries and all NVD CVEs published in the rolling 48-hour UTC window.

Important distinction: CISA KEV means exploitation has been observed; it does not mean every entry was a zero-day. An NVD publication in the past 48 hours does not mean exploitation has occurred. Source records describe third-party products and do not identify Kythos AI customers, contracts, affiliations, or work history.

CISA KEV catalog NVD 48-hour CVEs Kythos AI RSS feed

Confirmed exploitation intelligence

Zero-Day Exploits / Vulnerabilities

Complete CISA Known Exploited Vulnerabilities catalog, ordered by the date CISA added each entry. Every result is known to be exploited; entries are not necessarily zero-days.

Current snapshot

Entries 169–192 of 1,769

CISA KEVAdded May 21, 2026

CVE-2026-34926: Trend Micro Apex One (On-Premise) Directory Traversal Vulnerability

Trend Micro · Apex One

Trend Micro Apex One (on-premise) contains a directory traversal vulnerability that could allow a pre-authenticated local attacker to modify a key table on the server to inject malicious code to deploy to agents on affected installations.

Federal remediation due Jun 4, 2026Ransomware use: Not confirmed by CISA

Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

View in the CISA KEV catalog →

CISA KEVAdded May 21, 2026

CVE-2025-34291: Langflow Origin Validation Error Vulnerability

Langflow · Langflow

Langflow contains an origin validation error vulnerability in which an overly permissive CORS configuration combined with a refresh token cookie configured as SameSite=None allows a malicious webpage to perform cross-origin requests that include credentials and successfully call the refresh endpoint. This could…

Federal remediation due Jun 4, 2026Ransomware use: Not confirmed by CISA

Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

View in the CISA KEV catalog →

CISA KEVAdded May 20, 2026

CVE-2026-45498: Microsoft Defender Denial of Service Vulnerability

Microsoft · Defender

Microsoft Defender contains an unspecified vulnerability that allows for denial of service.

Federal remediation due Jun 3, 2026Ransomware use: Not confirmed by CISA

Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

View in the CISA KEV catalog →

CISA KEVAdded May 20, 2026

CVE-2026-41091: Microsoft Defender Link Following Vulnerability

Microsoft · Defender

Microsoft Defender contains a link following vulnerability that allows an authorized attacker to elevate privileges locally.

Federal remediation due Jun 3, 2026Ransomware use: Not confirmed by CISA

Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

View in the CISA KEV catalog →

CISA KEVAdded May 20, 2026

CVE-2010-0806: Microsoft Internet Explorer Use-After-Free Vulnerability

Microsoft · Internet Explorer

Microsoft Internet Explorer contains an use-after-free vulnerability that could allow remote attackers to execute arbitrary code via vectors involving access to an invalid pointer after the deletion of an object. The impacted product could be end-of-life (EoL) and/or end-of-service (EoS). Users should…

Federal remediation due Jun 3, 2026Ransomware use: Not confirmed by CISA

Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

View in the CISA KEV catalog →

CISA KEVAdded May 20, 2026

CVE-2010-0249: Microsoft Internet Explorer Use-After-Free Vulnerability

Microsoft · Internet Explorer

Microsoft Internet Explorer contains an use-after-free vulnerability that could allow remote attackers to execute arbitrary code by accessing a pointer associated with a deleted object. The impacted product could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization.

Federal remediation due Jun 3, 2026Ransomware use: Not confirmed by CISA

Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

View in the CISA KEV catalog →

CISA KEVAdded May 20, 2026

CVE-2009-3459: Adobe Acrobat and Reader Heap-Based Buffer Overflow Vulnerability

Adobe · Acrobat and Reader

Adobe Acrobat and Reader contain a heap-based buffer overflow vulnerability which could allow remote attackers to execute arbitrary code via a crafted PDF file that triggers memory corruption.

Federal remediation due Jun 3, 2026Ransomware use: Not confirmed by CISA

Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

View in the CISA KEV catalog →

CISA KEVAdded May 20, 2026

CVE-2009-1537: Microsoft DirectX NULL Byte Overwrite Vulnerability

Microsoft · DirectX

Microsoft DirectX contains a NULL byte overwrite vulnerability in the QuickTime Movie Parser Filter in quartz.dll in DirectShow which could allow remote attackers to execute arbitrary code via a crafted QuickTime media file.

Federal remediation due Jun 3, 2026Ransomware use: Not confirmed by CISA

Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

View in the CISA KEV catalog →

CISA KEVAdded May 20, 2026

CVE-2008-4250: Microsoft Windows Buffer Overflow Vulnerability

Microsoft · Windows

Microsoft Windows contains a buffer overflow vulnerability in the Windows Server Service that allows remote attackers to execute arbitrary code via a crafted RPC request that triggers an overflow during path canonicalization.

Federal remediation due Jun 3, 2026Ransomware use: Not confirmed by CISA

Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

View in the CISA KEV catalog →

CISA KEVAdded May 15, 2026

CVE-2026-42897: Microsoft Exchange Server Cross-Site Scripting Vulnerability

Microsoft · Microsoft

Microsoft Exchange Server contains a cross-site scripting vulnerability during web page generation in Outlook Web Access and when certain interaction conditions are met, arbitrary JavaScript can be executed in the browser context.

Federal remediation due May 29, 2026Ransomware use: Not confirmed by CISA

Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

View in the CISA KEV catalog →

CISA KEVAdded May 14, 2026

CVE-2026-20182: Cisco Catalyst SD-WAN Controller Authentication Bypass Vulnerability

Cisco · Catalyst SD-WAN

Cisco Catalyst SD-WAN Controller & Manager contain an authentication bypass vulnerability that allows an unauthenticated, remote attacker to bypass authentication and obtain administrative privileges on an affected system.

Federal remediation due May 17, 2026Ransomware use: Not confirmed by CISA

Required action: Please adhere to CISA’s guidelines to assess exposure and mitigate risks associated with Cisco SD-WAN devices as outlined in CISA’s Emergency Directive 26-03 (URL listed below in Notes) and CISA’s Hunt & Hardening Guidance for…

View in the CISA KEV catalog →

CISA KEVAdded May 8, 2026

CVE-2026-42208: BerriAI LiteLLM SQL Injection Vulnerability

BerriAI · LiteLLM

BerriAI LiteLLM contains a SQL injection vulnerability that allows an attacker to read data from the proxy's database and potentially modify it, leading to unauthorized access to the proxy and the credentials it manages.

Federal remediation due May 11, 2026Ransomware use: Not confirmed by CISA

Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

View in the CISA KEV catalog →

CISA KEVAdded May 7, 2026

CVE-2026-6973: Ivanti Endpoint Manager Mobile (EPMM) Improper Input Validation Vulnerability

Ivanti · Endpoint Manager Mobile (EPMM)

Ivanti Endpoint Manager Mobile (EPMM) contains an improper input validation vulnerability that allows a remotely authenticated user with administrative access to achieve remote code execution.

Federal remediation due May 10, 2026Ransomware use: Not confirmed by CISA

Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

View in the CISA KEV catalog →

CISA KEVAdded May 6, 2026

CVE-2026-0300: Palo Alto Networks PAN-OS Out-of-bounds Write Vulnerability

Palo Alto Networks · PAN-OS

Palo Alto Networks PAN-OS contains an out-of-bounds write vulnerability in the User-ID Authentication Portal (aka Captive Portal) service that can allow an unauthenticated attacker to execute arbitrary code with root privileges on the PA-Series and VM-Series firewalls by sending specially crafted packets.

Federal remediation due May 9, 2026Ransomware use: Not confirmed by CISA

Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Until the vendor releases an official fix, the following workaround should be…

View in the CISA KEV catalog →

CISA KEVAdded May 1, 2026

CVE-2026-31431: Linux Kernel Incorrect Resource Transfer Between Spheres Vulnerability

Linux · Kernel

Linux Kernel contains an incorrect resource transfer between spheres vulnerability that could allow for privilege escalation.

Federal remediation due May 15, 2026Ransomware use: Not confirmed by CISA

Required action: "Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

View in the CISA KEV catalog →

CISA KEVAdded Apr 30, 2026

CVE-2026-41940: WebPros cPanel & WHM and WP2 (WordPress Squared) Missing Authentication for Critical Function Vulnerability

WebPros · cPanel & WHM and WP2 (WordPress Squared)

WebPros cPanel & WHM (WebHost Manager) and WP2 (WordPress Squared) contain an authentication bypass vulnerability in the login flow that allows unauthenticated remote attackers to gain unauthorized access to the control panel.

Federal remediation due May 3, 2026Ransomware use: Known

Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

View in the CISA KEV catalog →

CISA KEVAdded Apr 28, 2026

CVE-2026-32202: Microsoft Windows Protection Mechanism Failure Vulnerability

Microsoft · Windows

Microsoft Windows Shell contains a protection mechanism failure vulnerability that allows an unauthorized attacker to perform spoofing over a network.

Federal remediation due May 12, 2026Ransomware use: Not confirmed by CISA

Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

View in the CISA KEV catalog →

CISA KEVAdded Apr 28, 2026

CVE-2024-1708: ConnectWise ScreenConnect Path Traversal Vulnerability

ConnectWise · ScreenConnect

ConnectWise ScreenConnect contains a path traversal vulnerability which could allow an attacker to execute remote code or directly impact confidential data and critical systems.

Federal remediation due May 12, 2026Ransomware use: Known

Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

View in the CISA KEV catalog →

CISA KEVAdded Apr 24, 2026

CVE-2025-29635: D-Link DIR-823X Command Injection Vulnerability

D-Link · DIR-823X

D-Link DIR-823X contains a command injection vulnerability that allows an authorized attacker to execute arbitrary commands on remote devices by sending a POST request to /goform/set_prohibiting via the corresponding function. The impacted product could be end-of-life (EoL) and/or end-of-service (EoS). Users should…

Federal remediation due May 8, 2026Ransomware use: Not confirmed by CISA

Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

View in the CISA KEV catalog →

CISA KEVAdded Apr 24, 2026

CVE-2024-7399: Samsung MagicINFO 9 Server Path Traversal Vulnerability

Samsung · MagicINFO 9 Server

Samsung MagicINFO 9 Server contains a path traversal vulnerability that could allow an attacker to write arbitrary files as system authority.

Federal remediation due May 8, 2026Ransomware use: Not confirmed by CISA

Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

View in the CISA KEV catalog →

CISA KEVAdded Apr 24, 2026

CVE-2024-57728: SimpleHelp Path Traversal Vulnerability

SimpleHelp · SimpleHelp

SimpleHelp contains a path traversal vulnerability that allows admin users to upload arbitrary files anywhere on the file system by uploading a crafted zip file (i.e. zip slip). This can be exploited to execute arbitrary code on the host in the context…

Federal remediation due May 8, 2026Ransomware use: Known

Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

View in the CISA KEV catalog →

CISA KEVAdded Apr 24, 2026

CVE-2024-57726: SimpleHelp Missing Authorization Vulnerability

SimpleHelp · SimpleHelp

SimpleHelp contains a missing authorization vulnerability that could allow low-privileged technicians to create API keys with excessive permissions. These API keys can be used to escalate privileges to the server admin role.

Federal remediation due May 8, 2026Ransomware use: Known

Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

View in the CISA KEV catalog →

CISA KEVAdded Apr 23, 2026

CVE-2026-39987: Marimo Remote Code Execution Vulnerability

Marimo · Marimo

Marimo contains an pre-authorization remote code execution vulnerability, allowing an unauthenticated attacked to shell access and execute arbitrary system commands.

Federal remediation due May 7, 2026Ransomware use: Not confirmed by CISA

Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

View in the CISA KEV catalog →

CISA KEVAdded Apr 22, 2026

CVE-2026-33825: Microsoft Defender Insufficient Granularity of Access Control Vulnerability

Microsoft · Defender

Microsoft Defender contains an insufficient granularity of access control vulnerability that could allow an authorized attacker to escalate privileges locally.

Federal remediation due May 6, 2026Ransomware use: Known

Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

View in the CISA KEV catalog →

Source: Official CISA KEV JSONCatalog released Nov 6, 2026, 7:44 PM GMT+0000Site snapshot: Nov 8, 2026, 5:19 AM GMT+0000Showing 24 of 1,769Source text normalized: network addresses and restricted context omittedRefresh interval: 30 minutes

Complete fixed-window snapshot

CVEs — Past 48 Hours

All unique CVEs returned by NVD for the displayed UTC publication window. The snapshot is accepted only when its normalized unique-item count exactly equals the API totalResults value.

Current snapshot

Entries 25–48 of 1,057