Live CVE & 0day intelligence

Sound the depths of every vulnerability.

Newly released CVEs across every platform — sleek to read, verbose on demand, and served raw as markdown for AI and agent ingestion. Severity reads as depth: the deeper the contact, the graver the threat.

Browse the feed For agents → /llms.txt

Depth = severity + exploitation

HadalCritical and actively exploited (CISA KEV / 0day)
AbyssalCritical with a public exploit or in-the-wild use
MidnightCritical, or high with PoC / in-the-wild
TwilightHigh severity, or a signal on a lesser flaw
SunlitLow / medium · no exploitation signal

68753

Tracked CVEs

6386

Critical

701

Exploited in wild

4937

Last 7 days

Trending now

Bluesky + Hacker News mentions, last 7 days

1CVE-2026-109618Critical· 9.2RCE via OOM corruption4896
2CVE-2026-109619Critical· 9.2RCE via stale global state2196
3CVE-2026-111497Critical· 9.2Out-of-Bounds Write in Google Brotli Decoder1580
4CVE-2026-99999Critical· 9.3In the Linux kernel, the following vulnerability has been resolved: ipv4: validate checksum_start before completing checksum If a packet with bad checksum metadata gets into the ipv4 stack, skb_checksum_help can corrupt the network hea…863
5CVE-2026-110264Critical· 10.0Integer Overflow or Wraparound in GitLab267
6CVE-2026-108707Critical· 9.8Wukong_HRM through commit 186115e contains an authentication bypass vulnerability in ParamAspect that allows unauthenticated attackers to call every HRM API endpoint by omitting the AUTH-TOKEN header266

This week's digest →All digests

Feed

125 matches

CVE-2026-115408Medium· 5.5

yesterday

ML-KEM key-pair lookup can bind an unrelated or attacker-planted public key, exposing encapsulated shared secrets

In `github.com/eclipse-keypont/crypto11/v2` versions `>= 2.0.0-rc3, <= 2.0.0-rc8`, the ML-KEM key-pair lookup functions (`FindMLKEMKeyPair`, `FindMLKEMKeyPairs`, `FindMLKEMKeyPairsWithAttributes`) locate the public half of an ML-KEM key …

▾ SunlitEclipse Foundation · crypto11via CVEORG

CVE-2026-113644Medium· 5.5

yesterday

iofogctl command injection via Controller provisioning response

In Eclipse ioFog iofogctl versions 1.0.0 through 3.7.0 and 3.8.0-rc.1 through 3.9.1, the provisioning key and CA certificate returned by the Controller API are concatenated into shell commands (`edgelet provision` and `edgelet config cer…

▾ SunlitEclipse Foundation · Eclipse ioFogvia CVEORG

CVE-2026-115216Critical· 9.1

yesterday

Eclipse ioFog Operator disables TLS certificate verification when sending Controller and OIDC credentials

In Eclipse ioFog Operator versions 3.8.0 before 3.9.2, TLS certificate verification is disabled when the operator contacts the Controller API and when it logs in to an external OIDC issuer. An on-path attacker can present any certificate…

▾ MidnightEclipse Foundation · Eclipse ioFogvia CVEORG

CVE-2026-89312Medium· 6.9

5d ago

AesGcmCryptor.Open passes attacker-controlled nonce to cipher.AEAD.Open without length check, causing panic on wrong-size IV

`AesGcmCryptor.Open` passed a caller-supplied nonce straight to `cipher.AEAD.Open` without checking its length. The Go standard library **panics** rather than returning an error when a GCM nonce is not exactly `NonceSize()` bytes, so a J…

▾ SunlitEclipse Foundation · github.com/ThalesGroup/goseEPSS 0.28%via CVEORG

CVE-2026-89314Medium· 6.9

5d ago

Quadratic-time key_ops duplicate check lets a sub-1 MB JWKS body pin a CPU core for ~15 s

`jwkFields.CheckConsistency` detected duplicate `key_ops` entries with a pairwise nested loop, making validation cost grow with the **square** of the entry count. Because the check runs on every JWK and JWKS unmarshal, a modestly sized b…

▾ SunlitEclipse Foundation · github.com/ThalesGroup/goseEPSS 0.25%via CVEORG

CVE-2026-89313Medium· 6.3

5d ago

JwksTrustStore.Get returns the last fetched JWKS key (err=nil) when the requested kid is absent, instead of nil

`JwksTrustStore.Get` assigned each parsed key to the function's **named return value** while refreshing the JWKS cache. When the requested `kid` was not present, the trailing naked `return` handed the caller the last key in the JWKS docu…

▾ SunlitEclipse Foundation · github.com/ThalesGroup/goseEPSS 0.23%via CVEORG

CVE-2026-89316Medium· 6.3

5d ago

LoadPublicKey panics on kty/alg mismatch (kty=EC with a non-EC alg) via unchecked *ECDSAOptions type assertion

`LoadPublicKey` resolved an EC key's curve with an unchecked type assertion, `algToOptsMap[alg].(*ECDSAOptions)`. A JWK declaring `"kty":"EC"` together with a non-EC `"alg"` — which RFC 7517 §4.4 permits — reaches that assertion and **pa…

▾ SunlitEclipse Foundation · github.com/ThalesGroup/goseEPSS 0.21%via CVEORG

CVE-2026-89319Medium· 6.3

5d ago

JweDirectDecryptorBlock.Decrypt: unchecked _thales_aad length header reachable with forged tag → index-out-of-range / slice-bounds panic and unbounded allocation

`JweDirectDecryptorBlock.Decrypt` read a 64-bit plaintext length from the `_thales_aad` protected-header field and used it without any validation. A truncated field panics `binary.BigEndian.Uint64`, an oversized value drives an unbounded…

▾ SunlitEclipse Foundation · github.com/ThalesGroup/goseEPSS 0.21%via CVEORG

CVE-2026-89318Medium· 6.9

5d ago

JweRsaKeyEncryptionDecryptorImpl.Decrypt panics on attacker-chosen IV length (stdlib GCM.Open reached without nonce-size check)

`JweRsaKeyEncryptionDecryptorImpl.Decrypt` passed the JWE's initialization vector to `cipher.AEAD.Open` without checking its length. The Go standard library **panics** rather than returning an error when a GCM nonce is not exactly `Nonce…

▾ SunlitEclipse Foundation · github.com/ThalesGroup/goseEPSS 0.17%via CVEORG

CVE-2026-89317Medium· 6.3

5d ago

JwtVerifierImpl.Verify does not enforce the JWS `crit` header (RFC 7515 §4.1.11)

gose parsed the JWS `crit` header into `JwsHeader.Crit` and then never read it. RFC 7515 §4.1.11 requires a recipient to reject a JWS whose listed critical extension parameters it does not understand. gose implements no header extensions…

▾ SunlitEclipse Foundation · github.com/ThalesGroup/goseEPSS 0.15%via CVEORG

CVE-2026-89320High· 8.8

5d ago

HmacShaCryptor.Hash never hashes its input — returns constant HMAC_K("") for all inputs, voiding CBC-HMAC JWE integrity

`HmacShaCryptor.Hash` never hashed its input. For any input it returned `HMAC_K("")` — the MAC of the empty message under the key. Every AES-CBC-HMAC JWE produced or verified by gose therefore carried an authentication tag that is consta…

▾ TwilightEclipse Foundation · github.com/ThalesGroup/goseEPSS 0.17%via CVEORG

CVE-2026-89315Medium· 6.9

5d ago

JwtClaims.MarshalJSON panics via reflect.StructOf when any untyped claim key is not a valid Go identifier suffix

`JwtClaims.MarshalJSON` built a Go struct at runtime with `reflect.StructOf`, synthesising a field named `"A" + claimName` for each untyped claim. `reflect.StructOf` **panics** when a field name is not a valid Go identifier, or when it d…

▾ SunlitEclipse Foundation · github.com/ThalesGroup/goseEPSS 0.25%via CVEORG

CVE-2026-111074High· 8.7

1w ago

JITServer: Pre-authentication remote Denial of Service via integer overflow infinite loop in MessageBuffer::computeRequiredCapacity()

In Eclipse OpenJ9 versions prior to 0.63.0, the JITServer component is vulnerable to a pre-authentication remote denial of service. When processing the initial 4-byte length field of an incoming TCP connection, an integer overflow in `Me…

▾ TwilightEclipse Foundation · Eclipse OpenJ9EPSS 0.42%via CVEORG

CVE-2026-111075High· 8.7

1w ago

JITServer: Pre-authentication remote crash via integer underflow and out-of-bounds heap read in DataDescriptor deserialization

In Eclipse OpenJ9 versions prior to 0.63.0, the JITServer component fails to perform cross-field validation on attacker-controlled `_size`, `_paddingSize`, and `_dataOffset` fields during `DataDescriptor` message deserialization. An unau…

▾ TwilightEclipse Foundation · Eclipse OpenJ9EPSS 0.37%via CVEORG

CVE-2026-110938High· 8.7

1w ago

JITServer: Multiple Denial of Service vulnerabilities via out-of-bounds heap reads during message and reply parsing

In Eclipse OpenJ9 versions up to 0.63.0, the JITServer component is vulnerable to denial of service due to improper boundary checks during protocol message and reply handling. An unauthenticated remote attacker or malicious JITServer can…

▾ TwilightEclipse Foundation · Eclipse OpenJ9EPSS 0.41%via CVEORG

CVE-2026-91057Medium· 4.6

1w ago

Out-of-bounds read when a multi-line text view string ends with a carriage return

`_gx_multi_line_text_view_display_info_get()` reads one byte past the end of the application's text buffer when the string it is given ends with a carriage return (`\r`). The over-read can also cause callers to advance their index past t…

▾ SunlitEclipse Foundation · GUIXEPSS 0.16%via CVEORG

CVE-2026-93475Critical· 9.3

1w ago

Out-of-bounds Write via an Unbounded RSA Modulus in NetX Secure X.509

The X.509 parser in NetX Secure accepts an RSA public key of any size, but every signature-verification path decrypts into fixed-size buffers dimensioned for the `NX_CRYPTO_MAX_RSA_MODULUS_SIZE` default of 4096 bits. A certificate carryi…

▾ MidnightEclipse Foundation · NetX DuoEPSS 0.25%via CVEORG

CVE-2026-92853High· 8.7

1w ago

Out-of-bounds Read via a Zero-length TLS 1.3 Certificate Message in NetX Secure

The TLS 1.3 Certificate-message parser in NetX Secure decrements the message length to skip a context byte without first establishing that the message has a byte to skip. A zero-length Certificate message therefore wraps the unsigned len…

▾ TwilightEclipse Foundation · NetX DuoEPSS 0.30%via CVEORG

CVE-2026-94018High· 8.8

1w ago

NetX Duo Web HTTP server releases an uninitialized packet pointer on the PUT Content-Length underflow path

The Web add-on's HTTP server dereferences and releases an uninitialized pointer when it detects a `Content-Length` underflow while processing a `PUT` request. The condition is reachable by an unauthenticated remote client with a single m…

▾ TwilightEclipse Foundation · NetX DuoEPSS 0.40%via CVEORG

CVE-2026-92843High· 8.7

1w ago

Out-of-bounds Read via the TLS 1.3 Certificate extensions_length in NetX Secure

A missing bounds check in the TLS 1.3 Certificate-message parser of NetX Secure lets a malicious TLS 1.3 server trigger an unsigned-integer underflow and a subsequent heap out-of-bounds read in any peer that processes a remote Certificat…

▾ TwilightEclipse Foundation · NetX DuoEPSS 0.30%via CVEORG

CVE-2026-94192High· 8.5

1w ago

Module object deallocation can free a live ThreadX kernel object

A ThreadX module allocates the control blocks of its kernel objects from the Module Manager's object pool, and can ask for that memory back by address with `txm_module_object_deallocate`. The manager released it whatever was in it, inclu…

▾ TwilightEclipse Foundation · ThreadXEPSS 0.15%via CVEORG

CVE-2026-94023Medium· 6.9

1w ago

Module delete dispatchers do not enforce kernel-object ownership before irreversible deletion

A ThreadX module reaches a kernel object's delete service through the Module Manager's dispatch layer, which asked one question about the pointer: does the object lie outside the module's own code and data. That is the policy for *using*…

▾ SunlitEclipse Foundation · ThreadXEPSS 0.13%via CVEORG

CVE-2026-95109High· 8.5

1w ago

Cortex-A7 module data validation checks only the first address of a caller-supplied range

The Cortex-A7 MMU Modules port validates a caller-supplied buffer by translating **one address** — the first byte. The common Module Manager hands its range check the module instance, the start address and the complete byte size; the Cor…

▾ TwilightEclipse Foundation · ThreadXEPSS 0.15%via CVEORG

CVE-2026-94024Medium· 6.9

1w ago

Module Manager object lookup validates one byte of a module's search name

The Module Manager's object lookup validated one byte of a memory-protected module's search name and then walked as much of it as the module declared, in privileged mode, with the kernel's preemption count raised. Both lookup dispatchers…

▾ SunlitEclipse Foundation · ThreadXEPSS 0.14%via CVEORG

CVE-2026-95108Medium· 6.8

1w ago

Deleting a user-mode module thread leaks its privileged kernel stack

One logical thread of a user-mode ThreadX module costs the Module Manager's shared object pool two allocations, not one. The module asks for a `TX_THREAD` control block through `txm_module_object_allocate`; `_txm_module_manager_thread_cr…

▾ SunlitEclipse Foundation · ThreadXEPSS 0.17%via CVEORG

From the blog

All posts →

Oct 27, 2026

Sound the depths of every vulnerability.

Trending now

Feed

ML-KEM key-pair lookup can bind an unrelated or attacker-planted public key, exposing encapsulated shared secrets

iofogctl command injection via Controller provisioning response

Eclipse ioFog Operator disables TLS certificate verification when sending Controller and OIDC credentials

AesGcmCryptor.Open passes attacker-controlled nonce to cipher.AEAD.Open without length check, causing panic on wrong-size IV

Quadratic-time key_ops duplicate check lets a sub-1 MB JWKS body pin a CPU core for ~15 s

JwksTrustStore.Get returns the last fetched JWKS key (err=nil) when the requested kid is absent, instead of nil

LoadPublicKey panics on kty/alg mismatch (kty=EC with a non-EC alg) via unchecked *ECDSAOptions type assertion

JweDirectDecryptorBlock.Decrypt: unchecked _thales_aad length header reachable with forged tag → index-out-of-range / slice-bounds panic and unbounded allocation

JweRsaKeyEncryptionDecryptorImpl.Decrypt panics on attacker-chosen IV length (stdlib GCM.Open reached without nonce-size check)

JwtVerifierImpl.Verify does not enforce the JWS `crit` header (RFC 7515 §4.1.11)

HmacShaCryptor.Hash never hashes its input — returns constant HMAC_K("") for all inputs, voiding CBC-HMAC JWE integrity

JwtClaims.MarshalJSON panics via reflect.StructOf when any untyped claim key is not a valid Go identifier suffix

JITServer: Pre-authentication remote Denial of Service via integer overflow infinite loop in MessageBuffer::computeRequiredCapacity()

JITServer: Pre-authentication remote crash via integer underflow and out-of-bounds heap read in DataDescriptor deserialization

JITServer: Multiple Denial of Service vulnerabilities via out-of-bounds heap reads during message and reply parsing

Out-of-bounds read when a multi-line text view string ends with a carriage return

Out-of-bounds Write via an Unbounded RSA Modulus in NetX Secure X.509

Out-of-bounds Read via a Zero-length TLS 1.3 Certificate Message in NetX Secure

NetX Duo Web HTTP server releases an uninitialized packet pointer on the PUT Content-Length underflow path

Out-of-bounds Read via the TLS 1.3 Certificate extensions_length in NetX Secure

Module object deallocation can free a live ThreadX kernel object

Module delete dispatchers do not enforce kernel-object ownership before irreversible deletion

Cortex-A7 module data validation checks only the first address of a caller-supplied range

Module Manager object lookup validates one byte of a module's search name

Deleting a user-mode module thread leaks its privileged kernel stack

From the blog

VulnSea has moved to vulnsea.com (and what changed since September)

What's new: open corpus, three new MCP tools, vendor advisories, package pages

Wiring VulnSea into an agent: a hands-on tutorial

Sound the depths of every vulnerability.

Trending now

Feed

ML-KEM key-pair lookup can bind an unrelated or attacker-planted public key, exposing encapsulated shared secrets

iofogctl command injection via Controller provisioning response

Eclipse ioFog Operator disables TLS certificate verification when sending Controller and OIDC credentials

AesGcmCryptor.Open passes attacker-controlled nonce to cipher.AEAD.Open without length check, causing panic on wrong-size IV

Quadratic-time key_ops duplicate check lets a sub-1 MB JWKS body pin a CPU core for ~15 s

JwksTrustStore.Get returns the last fetched JWKS key (err=nil) when the requested kid is absent, instead of nil

LoadPublicKey panics on kty/alg mismatch (kty=EC with a non-EC alg) via unchecked *ECDSAOptions type assertion

JweDirectDecryptorBlock.Decrypt: unchecked _thales_aad length header reachable with forged tag → index-out-of-range / slice-bounds panic and unbounded allocation

JweRsaKeyEncryptionDecryptorImpl.Decrypt panics on attacker-chosen IV length (stdlib GCM.Open reached without nonce-size check)

JwtVerifierImpl.Verify does not enforce the JWS `crit` header (RFC 7515 §4.1.11)

HmacShaCryptor.Hash never hashes its input — returns constant HMAC_K("") for all inputs, voiding CBC-HMAC JWE integrity

JwtClaims.MarshalJSON panics via reflect.StructOf when any untyped claim key is not a valid Go identifier suffix

JITServer: Pre-authentication remote Denial of Service via integer overflow infinite loop in MessageBuffer::computeRequiredCapacity()

JITServer: Pre-authentication remote crash via integer underflow and out-of-bounds heap read in DataDescriptor deserialization

JITServer: Multiple Denial of Service vulnerabilities via out-of-bounds heap reads during message and reply parsing

Out-of-bounds read when a multi-line text view string ends with a carriage return

Out-of-bounds Write via an Unbounded RSA Modulus in NetX Secure X.509

Out-of-bounds Read via a Zero-length TLS 1.3 Certificate Message in NetX Secure

NetX Duo Web HTTP server releases an uninitialized packet pointer on the PUT Content-Length underflow path

Out-of-bounds Read via the TLS 1.3 Certificate extensions_length in NetX Secure

Module object deallocation can free a live ThreadX kernel object

Module delete dispatchers do not enforce kernel-object ownership before irreversible deletion

Cortex-A7 module data validation checks only the first address of a caller-supplied range

Module Manager object lookup validates one byte of a module's search name

Deleting a user-mode module thread leaks its privileged kernel stack

From the blog

VulnSea has moved to vulnsea.com (and what changed since September)

What's new: open corpus, three new MCP tools, vendor advisories, package pages

Wiring VulnSea into an agent: a hands-on tutorial