Live CVE & 0day intelligence

Sound the depths of every vulnerability.

Newly released CVEs across every platform — sleek to read, verbose on demand, and served raw as markdown for AI and agent ingestion. Severity reads as depth: the deeper the contact, the graver the threat.

Browse the feed For agents → /llms.txt

Depth = severity + exploitation

HadalCritical and actively exploited (CISA KEV / 0day)
AbyssalCritical with a public exploit or in-the-wild use
MidnightCritical, or high with PoC / in-the-wild
TwilightHigh severity, or a signal on a lesser flaw
SunlitLow / medium · no exploitation signal

69319

Tracked CVEs

6432

Critical

702

Exploited in wild

4643

Last 7 days

Trending now

Bluesky + Hacker News mentions, last 7 days

1CVE-2026-109618Critical· 9.2RCE via OOM corruption4896
2CVE-2026-109619Critical· 9.2RCE via stale global state2196
3CVE-2026-111497Critical· 9.2Out-of-Bounds Write in Google Brotli Decoder1587
4CVE-2026-99999Critical· 9.3In the Linux kernel, the following vulnerability has been resolved: ipv4: validate checksum_start before completing checksum If a packet with bad checksum metadata gets into the ipv4 stack, skb_checksum_help can corrupt the network hea…963
5CVE-2026-110264Critical· 10.0Integer Overflow or Wraparound in GitLab267
6CVE-2026-108707Critical· 9.8Wukong_HRM through commit 186115e contains an authentication bypass vulnerability in ParamAspect that allows unauthenticated attackers to call every HRM API endpoint by omitting the AUTH-TOKEN header266
7CVE-2026-91403Critical· 9.1Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JSSE)262

This week's digest →All digests

Feed

399 matches

CVE-2026-110985None

yesterday

Apache Kafka: Broker silently skips JWT signature verification for SASL/OAUTHBEARER when the JWKS endpoint URL is not configured

A Kafka broker using SASL/OAUTHBEARER with the default validator (sasl.oauthbearer.jwt.validator.class=DefaultJwtValidator) selects its implementation from configuration. When sasl.oauthbearer.jwks.endpoint.url is set, the validator veri…

▾ SunlitApache Software Foundation · org.apache.kafka:kafkavia CVEORG

CVE-2026-110952None

yesterday

Apache Kafka: Broker does not enforce JWT issuer and audience validation for SASL/OAUTHBEARER by default

A Kafka broker that authenticates clients with SASL/OAUTHBEARER using the bundled JWKS-backed validator always verifies the JWT signature, but two further checks are only performed when explicitly configured: - The issuer (iss) claim is…

▾ SunlitApache Software Foundation · org.apache.kafka:kafkavia CVEORG

CVE-2026-83525None

yesterday

Apache Kafka: Incorrect boolean operator in FetchSnapshot RPC handler allows authenticated network clients to crash the KRaft controller via a malformed request.

Incorrect operator (CWE-480) in the FetchSnapshot RPC handler in Apache Kafka from 2.8.0 before 4.2.2, and from 4.3.0 before 4.3.2 on all platforms allows an authenticated attacker with CLUSTER_ACTION privilege to cause a denial of servi…

▾ SunlitApache Software Foundation · org.apache.kafka:kafka-raftvia CVEORG

CVE-2026-111073None

yesterday

Apache Kafka: PushTelemetry (KIP-714) metrics payloads are decompressed without a size limit, allowing a broker out-of-memory denial of service

The broker-side PushTelemetry API (KIP-714) validates only the compressed size of a client's metrics payload against telemetry.max.bytes (default 1 MB) before decompressing it. ClientTelemetryUtils.decompress() then decompresses the payl…

▾ SunlitApache Software Foundation · org.apache.kafka:kafkavia CVEORG

CVE-2026-111108None

yesterday

Apache Kafka: Broker OutOfMemoryError via array allocation amplification in code-generated protocol readers

Apache Kafka's code-generated protocol readers pre-size an array's collection from the element count declared by the sender. That count is checked only against the bytes remaining in the request buffer, which assumes about one byte per e…

▾ SunlitApache Software Foundation · org.apache.kafka:kafkavia CVEORG

CVE-2026-111496None

yesterday

Apache Kafka: Kafka Streams StreamThread hang from integer overflow in stream-time punctuation

Kafka Streams derives its stream-time clock from record timestamps. PunctuationSchedule.next() computed the next punctuation time as timestamp + (intervalsMissed + 1) * interval with no overflow check. A record with a timestamp at or nea…

▾ SunlitApache Software Foundation · org.apache.kafka:kafka-streamsvia CVEORG

CVE-2026-111115None

yesterday

Apache Kafka: Broker OutOfMemoryError via tagged-field allocation amplification in flexible protocol request parsing

Apache Kafka's code-generated readers for flexible protocol versions read a tagged-field count declared by the sender and retain a RawTaggedField object for each unknown field. That count was bounded only by the outer request frame size …

▾ SunlitApache Software Foundation · org.apache.kafka:kafkavia CVEORG

CVE-2026-111551None

yesterday

Apache Kafka: Denial of service in Kafka Streams and client deserializers via unbounded memory allocation

Several Kafka deserialization paths read a size or count field from input data and use it directly to allocate an array, collection, or byte buffer, with no check against the bytes actually available. A small crafted input can therefore …

▾ SunlitApache Software Foundation · org.apache.kafka:kafka-streamsvia CVEORG

CVE-2026-115644None

yesterday

Apache Kafka: Connect Admin REST API Authentication Bypass via Unapplied REST Extensions

Apache Kafka Connect contains an authentication bypass vulnerability affecting the admin REST API when admin.listeners is configured with a separate listener from the main listeners property. When operators isolate the admin REST API by…

▾ SunlitApache Software Foundation · org.apache.kafka:connect-runtimevia CVEORG

CVE-2026-114349None

yesterday

Apache Kafka: Denial of service via unbounded memory allocation when decoding compressed record batches

When a broker decodes a compressed record batch, the per-record decoder reads a declared body size from the decompressed stream and allocates a buffer of that size before validating it against the bytes available or any configured limit.…

▾ SunlitApache Software Foundation · org.apache.kafka:kafkavia CVEORG

CVE-2026-116593None

yesterday

Apache Kafka: Kafka Connect configuration provider values exposed via validation REST API endpoint

Apache Kafka Connect has the /connector-plugins/{connector-type}/config/validate endpoint on its REST API to validate connector configurations. Apache Kafka Connect also support Configuration Providers which enable to hide the values of …

▾ SunlitApache Software Foundation · org.apache.kafka:connect-runtimevia CVEORG

CVE-2026-112375None

yesterday

Apache Kafka: Unauthorized principal can read arbitrary broker files via IncrementalAlterConfigs

An authenticated Kafka principal with no authorization grants (not even ALTER_CONFIGS) can make a broker read a file or an environment variable from the broker host and return its contents. An IncrementalAlterConfigs (or AlterConfigs) re…

▾ SunlitApache Software Foundation · org.apache.kafka:kafkavia CVEORG

CVE-2026-111422None

3d ago

Apache Airflow SSH provider: SSHRemoteJobOperator: `environment` values are executed as shell on the remote host

In apache-airflow-providers-ssh before 7.0.1, SSHRemoteJobOperator quoted the values of its templated `environment` parameter only once, although they are placed inside an already-quoted wrapper script, so shell syntax such as `$(...)` i…

▾ SunlitApache Software Foundation · apache-airflow-providers-sshEPSS 0.27%via CVEORG

CVE-2026-110733Medium· 5.4

3d ago

Apache SIS: SQL injection via unvalidated ORDER BY sort expression in the SQL feature store

Vulnerability in the SQL storage module of Apache SIS. When sorting a stream of features, the clause is copied after ORDER BY without quoting the identifier character. A crafter sort clause could inject SQL in the query. This issue …

▾ SunlitApache Software Foundation · org.apache.sis.storage:sis-sqlstoreEPSS 0.32%via CVEORG

CVE-2026-110748None

3d ago

Apache SIS: CWE-22: improper limitation of paths to GML, GeoTIFF, NADCON or NTv2 files

This issue affects Apache SIS from version 0.7 through 1.6 inclusive. When a data file contains links to other files, Apache SIS opened these files regardless their paths. It was possible, for example, to specify a path to a local file. …

▾ SunlitApache Software Foundation · org.apache.sis:sis-metadataEPSS 0.16%via CVEORG

CVE-2026-90885High· 7.5

3d ago

Apache Camel: Camel-Saxon XML External Entity Processing - XQueryBuilder Parsed a Message Body That Was Already a javax.xml.transform.Source With Saxon's Default Parser Settings, so an External Entity Declared in That Body Was Resolved

Improper Restriction of XML External Entity Reference vulnerability in Apache Camel Saxon component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.2. XQueryBuilder in camel-saxon, which evaluate…

▾ TwilightApache Software Foundation · org.apache.camel:camel-saxonEPSS 0.60%via CVEORG

CVE-2026-94386Medium· 4.8

3d ago

Apache Camel: Camel-OAuth Cross-Scope Token Reuse via an Under-Keyed JVM-Global Client Credentials Token Cache

Use of Cache Containing Sensitive Information vulnerability in Apache Camel Oauth component. This issue affects Apache Camel: from 4.19.0 before 4.22.2. OAuthClientCredentialsTokenResolver obtains OAuth 2.0 bearer tokens through th…

▾ SunlitApache Software Foundation · org.apache.camel:camel-oauthEPSS 0.34%via CVEORG

CVE-2026-115748High· 8.8

3d ago

Apache Vysper: Authorization bypass

**UNSUPPORTED WHEN ASSIGNED** Authorization bypass in Apache Vysper, all versions. Apache Vysper is an XMPP (Jabber) server library. Its XEP-0077 (In-Band Registration) implementation is missing an authentication check, allowing any…

▾ TwilightApache Software Foundation · org.apache.vysper:vysperEPSS 0.61%via CVEORG

CVE-2026-115721High· 7.5

3d ago

Apache Vysper: Unbounded allocation

**UNSUPPORTED WHEN ASSIGNED** Unbounded allocation in XML parsing in Apache Vysper; all versions, may lead to an out of memory condition. This issue affects all versions of Apache Vysper. Apache Vysper is an XMPP (Jabber) server lib…

▾ TwilightApache Software Foundation · org.apache.vysper:vysperEPSS 0.47%via CVEORG

CVE-2026-101259Medium· 5.3

3d ago

Apache Camel: Camel-CoAP Information Disclosure via Unmuted Consumer Exceptions

Generation of Error Message Containing Sensitive Information vulnerability in Apache Camel CoAP component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.2. When the CoAP consumer could not build…

▾ SunlitApache Software Foundation · org.apache.camel:camel-coapEPSS 0.34%via CVEORG

CVE-2026-95664Medium· 5.4

3d ago

Apache Camel: Camel-AWS2-S3 Producer Evaluates Untrusted S3 Object Keys From the CamelAwsS3Key Header as Simple Expressions

Improper Neutralization of Special Elements used in an Expression Language Statement ('Expression Language Injection') vulnerability in Apache Camel AWS2-s3 component. This issue affects Apache Camel: from 4.8.0 before 4.18.5, from 4.…

▾ SunlitApache Software Foundation · org.apache.camel:camel-aws2-s3EPSS 0.30%via CVEORG

CVE-2026-95663Medium· 4.8

3d ago

Apache Camel: Camel-Keycloak Security Policy Accepts Expired Access Tokens Because Cached Token Introspection Results Are Not Bounded by the Token Expiry

Insufficient Session Expiration vulnerability in Apache Camel Keycloak component. This issue affects Apache Camel: from 4.16.0 before 4.18.5, from 4.19.0 before 4.22.2. When token introspection is enabled on the camel-keycloak Keyc…

▾ SunlitApache Software Foundation · org.apache.camel:camel-keycloakEPSS 0.24%via CVEORG

CVE-2026-95629Medium· 5.4

3d ago

Apache Camel: Camel-Docling Unvalidated Output Path Header Enables Writing Conversion Output to an Arbitrary Directory

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache Camel Docling component. This issue affects Apache Camel: from 4.15.0 before 4.18.5, from 4.19.0 before 4.22.2. DoclingProducer …

▾ SunlitApache Software Foundation · org.apache.camel:camel-doclingEPSS 0.34%via CVEORG

CVE-2026-95628Medium· 5.4

3d ago

Apache Camel: Camel-Docling Custom CLI Argument Path Validation Does Not Reject Absolute Paths (Incomplete Fix of CVE-2026-40047)

▾ SunlitApache Software Foundation · org.apache.camel:camel-doclingEPSS 0.34%via CVEORG

CVE-2026-113582High· 7.5

1w ago

Apache Abdera: XML external entity expansion in Atom document parsing

UNSUPPORTED WHEN ASSIGNED Improper restriction of XML external entity references in Apache Abdera allows an attacker to access sensitive data or make server-side requests when an application parses attacker-controlled XML with Abdera. …

▾ TwilightApache Software Foundation · org.apache.abdera:abdera-parserEPSS 0.46%via CVEORG

From the blog

All posts →

Oct 27, 2026

Sound the depths of every vulnerability.

Trending now

Feed

Apache Kafka: Broker silently skips JWT signature verification for SASL/OAUTHBEARER when the JWKS endpoint URL is not configured

Apache Kafka: Broker does not enforce JWT issuer and audience validation for SASL/OAUTHBEARER by default

Apache Kafka: Incorrect boolean operator in FetchSnapshot RPC handler allows authenticated network clients to crash the KRaft controller via a malformed request.

Apache Kafka: PushTelemetry (KIP-714) metrics payloads are decompressed without a size limit, allowing a broker out-of-memory denial of service

Apache Kafka: Broker OutOfMemoryError via array allocation amplification in code-generated protocol readers

Apache Kafka: Kafka Streams StreamThread hang from integer overflow in stream-time punctuation

Apache Kafka: Broker OutOfMemoryError via tagged-field allocation amplification in flexible protocol request parsing

Apache Kafka: Denial of service in Kafka Streams and client deserializers via unbounded memory allocation

Apache Kafka: Connect Admin REST API Authentication Bypass via Unapplied REST Extensions

Apache Kafka: Denial of service via unbounded memory allocation when decoding compressed record batches

Apache Kafka: Kafka Connect configuration provider values exposed via validation REST API endpoint

Apache Kafka: Unauthorized principal can read arbitrary broker files via IncrementalAlterConfigs

Apache Airflow SSH provider: SSHRemoteJobOperator: `environment` values are executed as shell on the remote host

Apache SIS: SQL injection via unvalidated ORDER BY sort expression in the SQL feature store

Apache SIS: CWE-22: improper limitation of paths to GML, GeoTIFF, NADCON or NTv2 files

Apache Camel: Camel-Saxon XML External Entity Processing - XQueryBuilder Parsed a Message Body That Was Already a javax.xml.transform.Source With Saxon's Default Parser Settings, so an External Entity Declared in That Body Was Resolved

Apache Camel: Camel-OAuth Cross-Scope Token Reuse via an Under-Keyed JVM-Global Client Credentials Token Cache

Apache Vysper: Authorization bypass

Apache Vysper: Unbounded allocation

Apache Camel: Camel-CoAP Information Disclosure via Unmuted Consumer Exceptions

Apache Camel: Camel-AWS2-S3 Producer Evaluates Untrusted S3 Object Keys From the CamelAwsS3Key Header as Simple Expressions

Apache Camel: Camel-Keycloak Security Policy Accepts Expired Access Tokens Because Cached Token Introspection Results Are Not Bounded by the Token Expiry

Apache Camel: Camel-Docling Unvalidated Output Path Header Enables Writing Conversion Output to an Arbitrary Directory

Apache Camel: Camel-Docling Custom CLI Argument Path Validation Does Not Reject Absolute Paths (Incomplete Fix of CVE-2026-40047)

Apache Abdera: XML external entity expansion in Atom document parsing

From the blog

VulnSea has moved to vulnsea.com (and what changed since September)

What's new: open corpus, three new MCP tools, vendor advisories, package pages

Wiring VulnSea into an agent: a hands-on tutorial

Sound the depths of every vulnerability.

Trending now

Feed

Apache Kafka: Broker silently skips JWT signature verification for SASL/OAUTHBEARER when the JWKS endpoint URL is not configured

Apache Kafka: Broker does not enforce JWT issuer and audience validation for SASL/OAUTHBEARER by default

Apache Kafka: Incorrect boolean operator in FetchSnapshot RPC handler allows authenticated network clients to crash the KRaft controller via a malformed request.

Apache Kafka: PushTelemetry (KIP-714) metrics payloads are decompressed without a size limit, allowing a broker out-of-memory denial of service

Apache Kafka: Broker OutOfMemoryError via array allocation amplification in code-generated protocol readers

Apache Kafka: Kafka Streams StreamThread hang from integer overflow in stream-time punctuation

Apache Kafka: Broker OutOfMemoryError via tagged-field allocation amplification in flexible protocol request parsing

Apache Kafka: Denial of service in Kafka Streams and client deserializers via unbounded memory allocation

Apache Kafka: Connect Admin REST API Authentication Bypass via Unapplied REST Extensions

Apache Kafka: Denial of service via unbounded memory allocation when decoding compressed record batches

Apache Kafka: Kafka Connect configuration provider values exposed via validation REST API endpoint

Apache Kafka: Unauthorized principal can read arbitrary broker files via IncrementalAlterConfigs

Apache Airflow SSH provider: SSHRemoteJobOperator: `environment` values are executed as shell on the remote host

Apache SIS: SQL injection via unvalidated ORDER BY sort expression in the SQL feature store

Apache SIS: CWE-22: improper limitation of paths to GML, GeoTIFF, NADCON or NTv2 files

Apache Camel: Camel-Saxon XML External Entity Processing - XQueryBuilder Parsed a Message Body That Was Already a javax.xml.transform.Source With Saxon's Default Parser Settings, so an External Entity Declared in That Body Was Resolved

Apache Camel: Camel-OAuth Cross-Scope Token Reuse via an Under-Keyed JVM-Global Client Credentials Token Cache

Apache Vysper: Authorization bypass

Apache Vysper: Unbounded allocation

Apache Camel: Camel-CoAP Information Disclosure via Unmuted Consumer Exceptions

Apache Camel: Camel-AWS2-S3 Producer Evaluates Untrusted S3 Object Keys From the CamelAwsS3Key Header as Simple Expressions

Apache Camel: Camel-Keycloak Security Policy Accepts Expired Access Tokens Because Cached Token Introspection Results Are Not Bounded by the Token Expiry

Apache Camel: Camel-Docling Unvalidated Output Path Header Enables Writing Conversion Output to an Arbitrary Directory

Apache Camel: Camel-Docling Custom CLI Argument Path Validation Does Not Reject Absolute Paths (Incomplete Fix of CVE-2026-40047)

Apache Abdera: XML external entity expansion in Atom document parsing

From the blog

VulnSea has moved to vulnsea.com (and what changed since September)

What's new: open corpus, three new MCP tools, vendor advisories, package pages

Wiring VulnSea into an agent: a hands-on tutorial