Live CVE & 0day intelligence

Sound the depths of every vulnerability.

Newly released CVEs across every platform — sleek to read, verbose on demand, and served raw as markdown for AI and agent ingestion. Severity reads as depth: the deeper the contact, the graver the threat.

Browse the feed For agents → /llms.txt

Depth = severity + exploitation

HadalCritical and actively exploited (CISA KEV / 0day)
AbyssalCritical with a public exploit or in-the-wild use
MidnightCritical, or high with PoC / in-the-wild
TwilightHigh severity, or a signal on a lesser flaw
SunlitLow / medium · no exploitation signal

68897

Tracked CVEs

6392

Critical

701

Exploited in wild

4998

Last 7 days

Trending now

Bluesky + Hacker News mentions, last 7 days

1CVE-2026-109618Critical· 9.2RCE via OOM corruption4896
2CVE-2026-109619Critical· 9.2RCE via stale global state2196
3CVE-2026-111497Critical· 9.2Out-of-Bounds Write in Google Brotli Decoder1587
4CVE-2026-99999Critical· 9.3In the Linux kernel, the following vulnerability has been resolved: ipv4: validate checksum_start before completing checksum If a packet with bad checksum metadata gets into the ipv4 stack, skb_checksum_help can corrupt the network hea…863
5CVE-2026-110264Critical· 10.0Integer Overflow or Wraparound in GitLab267
6CVE-2026-108707Critical· 9.8Wukong_HRM through commit 186115e contains an authentication bypass vulnerability in ParamAspect that allows unauthenticated attackers to call every HRM API endpoint by omitting the AUTH-TOKEN header266

This week's digest →All digests

Feed

78 matches

CVE-2026-96386Medium· 6.5

6d ago

Smart Content - Moderately critical - Access bypass - SA-CONTRIB-2026-190

Missing Authorization vulnerability in Drupal Smart Content allows Forceful Browsing. This issue affects Smart Content versions: from 0.0.0 to 3.2.1.

▾ SunlitDrupal · Smart ContentEPSS 0.22%via CVEORG

CVE-2026-96382Medium· 4.6

6d ago

Diba carousel slider - Moderately critical - Cross Site Scripting (XSS) - SA-CONTRIB-2026-191

Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Diba carousel slider allows Stored XSS. This issue affects Diba carousel slider versions: from 0.0.0 to 3.0.2.

▾ SunlitDrupal · Diba carousel sliderEPSS 0.17%via CVEORG

CVE-2026-96392Low· 3.5

6d ago

AI CKEditor - Moderately critical - Code execution via Twig templates - SA-CONTRIB-2026-187

Improper Neutralization of Special Elements Used in a Template Engine vulnerability in Drupal AI CKEditor allows Code Injection. This issue affects AI CKEditor versions: from 0.0.0 to 1.4.3.

▾ SunlitDrupal · AI CKEditorEPSS 0.21%via CVEORG

CVE-2026-96380Medium· 6.5

6d ago

CSS Usage Analyzer - Moderately critical - Improper access control - SA-CONTRIB-2026-189

Missing Authorization vulnerability in Drupal CSS Usage Analyzer allows Forceful Browsing. This issue affects CSS Usage Analyzer versions: from 1.0.0 to 1.0.2.

▾ SunlitDrupal · CSS Usage AnalyzerEPSS 0.22%via CVEORG

CVE-2026-96377Medium· 5.3

6d ago

Combined image style - Moderately critical - Improper access control - SA-CONTRIB-2026-188

Allocation of Resources Without Limits or Throttling vulnerability in Drupal Combined image style allows Excessive Allocation. This issue affects Combined image style versions: from 0.0.0 to 1.0.7.

▾ SunlitDrupal · Combined image styleEPSS 0.34%via CVEORG

CVE-2026-96391None

6d ago

Webform REST - Less critical - Access bypass - SA-CONTRIB-2026-186

Missing Authorization vulnerability in Drupal Webform REST allows Forceful Browsing. This issue affects Webform REST versions: from 0.0.0 to 4.2.1.

▾ SunlitDrupal · Webform RESTEPSS 0.18%via CVEORG

CVE-2026-96390Medium· 4.3

6d ago

Editoria11y Accessibility Checker - Moderately critical - Access bypass - SA-CONTRIB-2026-185

Privilege Defined With Unsafe Actions vulnerability in Drupal Editoria11y Accessibility Checker allows Privilege Escalation. This issue affects Editoria11y Accessibility Checker versions: from 0.0.0 to 2.2.23, from 3.0.0 to 3.0.9.

▾ SunlitDrupal · Editoria11y Accessibility CheckerEPSS 0.21%via CVEORG

CVE-2026-96388Medium· 5.4

6d ago

Tawk.to - Live chat application - Critical - Cross Site Request Forgery - SA-CONTRIB-2026-184

Cross-Site Request Forgery (CSRF) vulnerability in Drupal Tawk.to - Live chat application allows Cross Site Request Forgery. This issue affects Tawk.to - Live chat application versions: from 0.0.0 to 3.0.4.

▾ SunlitDrupal · Tawk.to - Live chat applicationEPSS 0.12%via CVEORG

CVE-2026-96398Medium· 4.3

6d ago

Webform - Less critical - Access bypass - SA-CONTRIB-2026-173

Incorrect Authorization vulnerability in Drupal Webform allows Forceful Browsing. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.

▾ SunlitDrupal · WebformEPSS 0.32%via CVEORG

CVE-2026-96387Low· 3.8

6d ago

Stop administrator login - Moderately critical - Access bypass - SA-CONTRIB-2026-183

Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Stop administrator login allows Authentication Bypass. This issue affects Stop administrator login versions: from 1.0 to 1.6.

▾ SunlitDrupal · Stop administrator loginEPSS 0.27%via CVEORG

CVE-2026-96385Medium· 6.5

6d ago

REST & JSON API Authentication for Drupal - Moderately critical - Access bypass - SA-CONTRIB-2026-182

Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal REST & JSON API Authentication for Drupal allows Authentication Bypass. This issue affects REST & JSON API Authentication for Drupal versions: from 0.0.0 to…

▾ SunlitDrupal · REST & JSON API Authentication for DrupalEPSS 0.28%via CVEORG

CVE-2026-96384Low· 3.5

6d ago

Mermaid Diagram Field - Moderately critical - Access bypass - SA-CONTRIB-2026-180

Incorrect Authorization vulnerability in Drupal Mermaid Diagram Field allows Forceful Browsing. This issue affects Mermaid Diagram Field versions: from 1.0.4 to 1.0.9.

▾ SunlitDrupal · Mermaid Diagram FieldEPSS 0.20%via CVEORG

CVE-2026-96379None

6d ago

CookieCuttr - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-181

Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal CookieCuttr allows Stored XSS. This issue affects CookieCuttr versions: from 2.0.0 to 2.0.3.

▾ SunlitDrupal · CookieCuttrEPSS 0.15%via CVEORG

CVE-2026-96378Medium· 4.3

6d ago

Commerce Decoupled Checkout - Moderately critical - Access bypass - SA-CONTRIB-2026-179

Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Commerce Decoupled Checkout allows Object Injection. This issue affects Commerce Decoupled Checkout versions: from 1.0.0 to 1.8.0.

▾ SunlitDrupal · Commerce Decoupled CheckoutEPSS 0.23%via CVEORG

CVE-2026-96376Medium· 6.4

6d ago

Cloud - Critical - Remote code execution - SA-CONTRIB-2026-177

Improper Neutralization of Special Elements used in an OS Command ("OS Command Injection") vulnerability in Drupal Cloud allows OS Command Injection. This issue affects Cloud versions: from 0.0.0 to 7.0.1.

▾ SunlitDrupal · CloudEPSS 0.58%via CVEORG

CVE-2026-96374Medium· 4.2

6d ago

Project Browser - Critical - Cross-site request forgery - SA-CONTRIB-2026-178

Cross-Site Request Forgery (CSRF) vulnerability in Drupal Project Browser allows Cross Site Request Forgery. This issue affects Project Browser versions: from 0.0.0 to 2.0.3, from 2.1.0 to 2.1.5.

▾ SunlitDrupal · Project BrowserEPSS 0.10%via CVEORG

CVE-2026-96355Critical· 9.1

6d ago

Webform - Critical - Remote Code Execution - SA-CONTRIB-2026-175

Improper Neutralization of Special Elements Used in a Template Engine vulnerability in Drupal Webform allows Code Injection. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.

▾ MidnightDrupal · WebformEPSS 0.42%via CVEORG

CVE-2026-96375Medium· 4.8

6d ago

Cloud - Critical - Remote code execution - SA-CONTRIB-2026-176

Improper Certificate Validation vulnerability in Drupal Cloud allows Adversary in the Middle (AiTM). This issue affects Cloud versions: from 0.0.0 to 7.0.1.

▾ SunlitDrupal · CloudEPSS 0.12%via CVEORG

CVE-2026-96364Medium· 5.3

6d ago

Webform - Moderately critical - Access bypass - SA-CONTRIB-2026-171

Improper Control of Interaction Frequency vulnerability in Drupal Webform allows Functionality Misuse. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.

▾ SunlitDrupal · WebformEPSS 0.29%via CVEORG

CVE-2026-96356Medium· 5.3

6d ago

Webform - Moderately critical - Access bypass - SA-CONTRIB-2026-174

Incorrect Authorization vulnerability in Drupal Webform allows Forceful Browsing. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.

▾ SunlitDrupal · WebformEPSS 0.41%via CVEORG

CVE-2026-96366Medium· 5.3

6d ago

Webform - Moderately critical - Access bypass - SA-CONTRIB-2026-169

Incorrect Authorization vulnerability in Drupal Webform allows Forceful Browsing. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.

▾ SunlitDrupal · WebformEPSS 0.40%via CVEORG

CVE-2026-96365High· 7.5

6d ago

Webform - Less critical - Denial of service - SA-CONTRIB-2026-170

Allocation of Resources Without Limits or Throttling vulnerability in Drupal Webform allows Excessive Allocation. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.

▾ TwilightDrupal · WebformEPSS 0.41%via CVEORG

CVE-2026-96357Medium· 4.6

6d ago

Webform - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-172

Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Webform allows Stored XSS. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.

▾ SunlitDrupal · WebformEPSS 0.22%via CVEORG

CVE-2026-96373Low· 3.3

6d ago

Webform - Moderately critical - Access bypass - SA-CONTRIB-2026-168

Incorrect Authorization vulnerability in Drupal Webform allows Forceful Browsing. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.

▾ SunlitDrupal · WebformEPSS 0.23%via CVEORG

CVE-2026-96368Medium· 4.6

6d ago

Webform - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-163

▾ SunlitDrupal · WebformEPSS 0.17%via CVEORG

From the blog

All posts →

Oct 27, 2026

Sound the depths of every vulnerability.

Trending now

Feed

Smart Content - Moderately critical - Access bypass - SA-CONTRIB-2026-190

Diba carousel slider - Moderately critical - Cross Site Scripting (XSS) - SA-CONTRIB-2026-191

AI CKEditor - Moderately critical - Code execution via Twig templates - SA-CONTRIB-2026-187

CSS Usage Analyzer - Moderately critical - Improper access control - SA-CONTRIB-2026-189

Combined image style - Moderately critical - Improper access control - SA-CONTRIB-2026-188

Webform REST - Less critical - Access bypass - SA-CONTRIB-2026-186

Editoria11y Accessibility Checker - Moderately critical - Access bypass - SA-CONTRIB-2026-185

Tawk.to - Live chat application - Critical - Cross Site Request Forgery - SA-CONTRIB-2026-184

Webform - Less critical - Access bypass - SA-CONTRIB-2026-173

Stop administrator login - Moderately critical - Access bypass - SA-CONTRIB-2026-183

REST & JSON API Authentication for Drupal - Moderately critical - Access bypass - SA-CONTRIB-2026-182

Mermaid Diagram Field - Moderately critical - Access bypass - SA-CONTRIB-2026-180

CookieCuttr - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-181

Commerce Decoupled Checkout - Moderately critical - Access bypass - SA-CONTRIB-2026-179

Cloud - Critical - Remote code execution - SA-CONTRIB-2026-177

Project Browser - Critical - Cross-site request forgery - SA-CONTRIB-2026-178

Webform - Critical - Remote Code Execution - SA-CONTRIB-2026-175

Cloud - Critical - Remote code execution - SA-CONTRIB-2026-176

Webform - Moderately critical - Access bypass - SA-CONTRIB-2026-171

Webform - Moderately critical - Access bypass - SA-CONTRIB-2026-174

Webform - Moderately critical - Access bypass - SA-CONTRIB-2026-169

Webform - Less critical - Denial of service - SA-CONTRIB-2026-170

Webform - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-172

Webform - Moderately critical - Access bypass - SA-CONTRIB-2026-168

Webform - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-163

From the blog

VulnSea has moved to vulnsea.com (and what changed since September)

What's new: open corpus, three new MCP tools, vendor advisories, package pages

Wiring VulnSea into an agent: a hands-on tutorial

Sound the depths of every vulnerability.

Trending now

Feed

Smart Content - Moderately critical - Access bypass - SA-CONTRIB-2026-190

Diba carousel slider - Moderately critical - Cross Site Scripting (XSS) - SA-CONTRIB-2026-191

AI CKEditor - Moderately critical - Code execution via Twig templates - SA-CONTRIB-2026-187

CSS Usage Analyzer - Moderately critical - Improper access control - SA-CONTRIB-2026-189

Combined image style - Moderately critical - Improper access control - SA-CONTRIB-2026-188

Webform REST - Less critical - Access bypass - SA-CONTRIB-2026-186

Editoria11y Accessibility Checker - Moderately critical - Access bypass - SA-CONTRIB-2026-185

Tawk.to - Live chat application - Critical - Cross Site Request Forgery - SA-CONTRIB-2026-184

Webform - Less critical - Access bypass - SA-CONTRIB-2026-173

Stop administrator login - Moderately critical - Access bypass - SA-CONTRIB-2026-183

REST & JSON API Authentication for Drupal - Moderately critical - Access bypass - SA-CONTRIB-2026-182

Mermaid Diagram Field - Moderately critical - Access bypass - SA-CONTRIB-2026-180

CookieCuttr - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-181

Commerce Decoupled Checkout - Moderately critical - Access bypass - SA-CONTRIB-2026-179

Cloud - Critical - Remote code execution - SA-CONTRIB-2026-177

Project Browser - Critical - Cross-site request forgery - SA-CONTRIB-2026-178

Webform - Critical - Remote Code Execution - SA-CONTRIB-2026-175

Cloud - Critical - Remote code execution - SA-CONTRIB-2026-176

Webform - Moderately critical - Access bypass - SA-CONTRIB-2026-171

Webform - Moderately critical - Access bypass - SA-CONTRIB-2026-174

Webform - Moderately critical - Access bypass - SA-CONTRIB-2026-169

Webform - Less critical - Denial of service - SA-CONTRIB-2026-170

Webform - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-172

Webform - Moderately critical - Access bypass - SA-CONTRIB-2026-168

Webform - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-163

From the blog

VulnSea has moved to vulnsea.com (and what changed since September)

What's new: open corpus, three new MCP tools, vendor advisories, package pages

Wiring VulnSea into an agent: a hands-on tutorial