Live CVE & 0day intelligence

Sound the depths of every vulnerability.

Newly released CVEs across every platform — sleek to read, verbose on demand, and served raw as markdown for AI and agent ingestion. Severity reads as depth: the deeper the contact, the graver the threat.

Browse the feed For agents → /llms.txt

Depth = severity + exploitation

HadalCritical and actively exploited (CISA KEV / 0day)
AbyssalCritical with a public exploit or in-the-wild use
MidnightCritical, or high with PoC / in-the-wild
TwilightHigh severity, or a signal on a lesser flaw
SunlitLow / medium · no exploitation signal

69320

Tracked CVEs

6432

Critical

702

Exploited in wild

4509

Last 7 days

Trending now

Bluesky + Hacker News mentions, last 7 days

1CVE-2026-109618Critical· 9.2RCE via OOM corruption4896
2CVE-2026-109619Critical· 9.2RCE via stale global state2196
3CVE-2026-111497Critical· 9.2Out-of-Bounds Write in Google Brotli Decoder1587
4CVE-2026-99999Critical· 9.3In the Linux kernel, the following vulnerability has been resolved: ipv4: validate checksum_start before completing checksum If a packet with bad checksum metadata gets into the ipv4 stack, skb_checksum_help can corrupt the network hea…963
5CVE-2026-110264Critical· 10.0Integer Overflow or Wraparound in GitLab267
6CVE-2026-108707Critical· 9.8Wukong_HRM through commit 186115e contains an authentication bypass vulnerability in ParamAspect that allows unauthenticated attackers to call every HRM API endpoint by omitting the AUTH-TOKEN header266
7CVE-2026-91403Critical· 9.1Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JSSE)262

This week's digest →All digests

Feed

147 matches

CVE-2026-97204Low· 3.1

1w ago

Gitea label deletion across repository and organization IDs

Deleting a label compared the ID of the repository in the request against the organization ID of organization labels, and the two ID sequences overlap. A user with write access to the issues of a repository could therefore delete the lab…

▾ SunlitGitea · gitea.devEPSS 0.18%via CVEORG

CVE-2026-109553High· 7.5

1w ago

Gitea SSH certificate principal impersonation of other users

Gitea resolved the principals of an SSH certificate by searching the content of all stored public keys instead of only principal keys. When Gitea trusts a user certificate authority (`SSH_TRUSTED_USER_CA_KEYS`) and accepts arbitrary prin…

▾ TwilightGitea · gitea.devEPSS 0.20%via CVEORG

CVE-2026-107618None

1w ago

Gitea cross-site request forgery on repository topics

`POST /{owner}/{repo}/topics` was registered without the sign-in middleware that provides the cross-origin protection, so a request issued by a third-party site was not rejected. A repository administrator who visited a malicious page co…

▾ SunlitGitea · gitea.devEPSS 0.16%via CVEORG

CVE-2026-110324Medium· 6.5

1w ago

Gitea private profile information disclosure through POST request

The visibility check of Gitea user profiles was applied to GET requests only, while `POST /{username}` (follow and unfollow) required only a signed-in user. Any authenticated user could therefore obtain the full name, location, website a…

▾ SunlitGitea · gitea.devEPSS 0.26%via CVEORG

CVE-2026-105661Medium· 5.3

1w ago

Gitea panic on the repositories route of individual users

Requesting `/{username}/-/repositories` for an individual user instead of an organization made the organization home handler dereference a nil organization and panic. The request needs no authentication and no special configuration. The …

▾ SunlitGitea · gitea.devEPSS 0.34%via CVEORG

CVE-2026-104627Medium· 5.4

1w ago

Gitea OpenID account linking without session binding

The Gitea OpenID association callback in the security settings accepted a positive OpenID 2.0 assertion without checking that the signed-in user had started the linking. Because OpenID 2.0 allows unsolicited assertions, an attacker-contr…

▾ SunlitGitea · gitea.devEPSS 0.12%via CVEORG

CVE-2026-109844Medium· 4.3

1w ago

Gitea watched repositories API disclosure after access revocation

`GET /api/v1/user/subscriptions` returned the metadata of every repository a user was watching without checking that the user still had access to it. A user who watched a private repository while having access, and later lost it, for exa…

▾ SunlitGitea · gitea.devEPSS 0.20%via CVEORG

CVE-2026-107686Medium· 4.3

1w ago

Gitea reactions accepted on locked issues and comments

The Gitea web handlers for adding and removing reactions on issues and comments did not refuse locked issues for users without write access, although the API did. A signed-in user who could read an issue could therefore add or remove rea…

▾ SunlitGitea · gitea.devEPSS 0.24%via CVEORG

CVE-2026-110494Medium· 6.3

1w ago

Gitea release attachment re-linking of issue attachments

Adding attachments to a release checked the repository and release of an attachment but not whether it was already linked to an issue or comment. A user with write access to the releases of a repository, who knew the UUID of an attachmen…

▾ SunlitGitea · gitea.devEPSS 0.20%via CVEORG

CVE-2026-110311Medium· 4.3

1w ago

Gitea draft release creation disclosing attachment metadata

Creating a draft release through the API returned an `assets` list that was built from a release without an ID, which matched every attachment that was not linked to a release. A user who could create a draft release in a repository ther…

▾ SunlitGitea · gitea.devEPSS 0.22%via CVEORG

CVE-2026-97859Medium· 6.5PoC

1w ago

Gitea API disclosure of private user social graph, keys and stars

Seven Gitea API routes under `/api/v1/users/{username}` (followers, following, following/{target}, starred, subscriptions, keys and gpg_keys) were registered without the `individualPermsChecker` middleware that enforces the visibility of…

▾ TwilightGitea · gitea.devEPSS 0.31%via CVEORG

CVE-2026-105964Medium· 6.5

1w ago

Gitea Actions artifact v4 API unbounded request body

The Gitea Actions artifact v4 (Twirp) handlers read the whole request body into memory without a size limit. A user who can run a workflow and obtains the runner token of that run could send an oversized request to the artifact service a…

▾ SunlitGitea · gitea.devEPSS 0.30%via CVEORG

CVE-2026-78433Medium· 5.9

2w ago

Gitea's web attachment handler skips its cross-repository ownership check for attachments created before 16 January 2026 and checks permissions against the repository named in the request URL instead

Gitea's web attachment handler skips its cross-repository ownership check for attachments created before 16 January 2026 and checks permissions against the repository named in the request URL instead. An unauthenticated attacker who know…

▾ SunlitGitea · gitea.devEPSS 0.37%via NVD

CVE-2026-78231Medium· 5.3

2w ago

When OpenID sign-in is enabled, Gitea processes unauthenticated assertion parameters and sends an HTTP POST request to the caller-supplied OpenID provider endpoint during verification

When OpenID sign-in is enabled, Gitea processes unauthenticated assertion parameters and sends an HTTP POST request to the caller-supplied OpenID provider endpoint during verification. An attacker controls the destination and much of the…

▾ SunlitGitea · code.gitea.io/giteaEPSS 0.26%via NVD

CVE-2026-73814Medium· 6.5

2w ago

Gitea's collaboration access-mode endpoint accepts the Owner access mode from an authenticated repository collaborator with Admin access

Gitea's collaboration access-mode endpoint accepts the Owner access mode from an authenticated repository collaborator with Admin access. The collaborator can promote their effective permissions from Admin to Owner and then perform owner…

▾ SunlitGitea · gitea.devEPSS 0.47%via NVD

CVE-2026-73804High· 8.1PoC

2w ago

Gitea allows a token with write:user scope to register an attacker-controlled SSH public key on the token owner's account

Gitea allows a token with write:user scope to register an attacker-controlled SSH public key on the token owner's account. API requests signed with the corresponding private key authenticate as that account through HTTP Signature without…

▾ MidnightGitea · gitea.devEPSS 0.48%via NVD

CVE-2026-73800High· 8.8

2w ago

Gitea resolves local reusable workflow files from a fork's head commit when a trusted base-branch workflow runs for a pull_request_target event

Gitea resolves local reusable workflow files from a fork's head commit when a trusted base-branch workflow runs for a pull_request_target event. A fork author can modify a referenced reusable workflow so attacker-controlled code executes…

▾ TwilightGitea · gitea/giteaEPSS 0.53%via NVD

CVE-2026-73539High· 7.5

2w ago

Gitea substitutes a URL derived from the markup Context field into external renderer command templates without escaping the reference path before shell-style argument splitting

Gitea substitutes a URL derived from the markup Context field into external renderer command templates without escaping the reference path before shell-style argument splitting. A crafted Context can inject additional renderer arguments,…

▾ TwilightGitea · giteaEPSS 0.47%via NVD

CVE-2026-73535High· 8.8

2w ago

Gitea's OpenID connect handler accepts a user's password without enforcing enrolled TOTP or WebAuthn verification before completing sign-in and linking an OpenID identifier

Gitea's OpenID connect handler accepts a user's password without enforcing enrolled TOTP or WebAuthn verification before completing sign-in and linking an OpenID identifier. When OpenID sign-in is enabled, an attacker who knows the victi…

▾ TwilightGitea · gitea.devEPSS 0.45%via NVD

CVE-2026-73273Medium· 4.3

2w ago

Gitea's Maven upload handler reads checksum uploads entirely into memory and returns before enforcing package-size quotas

Gitea's Maven upload handler reads checksum uploads entirely into memory and returns before enforcing package-size quotas. An authenticated user with package-publish permission can submit an oversized body to a checksum endpoint despite …

▾ SunlitGitea · code.gitea.io/giteaEPSS 0.39%via NVD

CVE-2026-73135Medium· 5.3

2w ago

Gitea uses inconsistent repository visibility predicates, and the condition used by some repository-listing endpoints admits repositories whose owners are hidden from the viewer

Gitea uses inconsistent repository visibility predicates, and the condition used by some repository-listing endpoints admits repositories whose owners are hidden from the viewer. Those listings disclose repository metadata even though di…

▾ SunlitGitea · gitea.devEPSS 0.36%via NVD

CVE-2026-73130Medium· 4.3

2w ago

Gitea does not limit the length of the gitignores field accepted by repository-creation forms and the API

Gitea does not limit the length of the gitignores field accepted by repository-creation forms and the API. Repository initialization splits the field into template names, repeatedly reads the referenced templates, and buffers their conte…

▾ SunlitGitea · code.gitea.io/giteaEPSS 0.37%via NVD

CVE-2026-73126Medium· 4.3

2w ago

Gitea's Actions workflow status badge endpoint does not enforce repository-read scope or the public-only restriction on the token authenticating the request

Gitea's Actions workflow status badge endpoint does not enforce repository-read scope or the public-only restriction on the token authenticating the request. A token lacking read:repository, or restricted to public repositories, can retr…

▾ SunlitGitea · GiteaEPSS 0.29%via NVD

CVE-2026-71301Medium· 4.3

2w ago

Gitea's repository markup endpoint resolves same-repository pull request references without enforcing the viewer's Pull Requests permission

Gitea's repository markup endpoint resolves same-repository pull request references without enforcing the viewer's Pull Requests permission. A member with only Wiki access to a private repository can submit a markup preview request and r…

▾ SunlitGitea · code.gitea.io/giteaEPSS 0.29%via NVD

CVE-2026-71184High· 8.8

2w ago

Gitea's pull request review notifier does not attach the pull request to the Actions notification, so the fork workflow approval gate does not recognize the run as originating from a fork

Gitea's pull request review notifier does not attach the pull request to the Actions notification, so the fork workflow approval gate does not recognize the run as originating from a fork. Review comment and review approval or rejection …

▾ TwilightGitea · code.gitea.io/giteaEPSS 0.49%via NVD

From the blog

All posts →

Oct 27, 2026

Sound the depths of every vulnerability.

Trending now

Feed

Gitea label deletion across repository and organization IDs

Gitea SSH certificate principal impersonation of other users

Gitea cross-site request forgery on repository topics

Gitea private profile information disclosure through POST request

Gitea panic on the repositories route of individual users

Gitea OpenID account linking without session binding

Gitea watched repositories API disclosure after access revocation

Gitea reactions accepted on locked issues and comments

Gitea release attachment re-linking of issue attachments

Gitea draft release creation disclosing attachment metadata

Gitea API disclosure of private user social graph, keys and stars

Gitea Actions artifact v4 API unbounded request body

Gitea's web attachment handler skips its cross-repository ownership check for attachments created before 16 January 2026 and checks permissions against the repository named in the request URL instead

When OpenID sign-in is enabled, Gitea processes unauthenticated assertion parameters and sends an HTTP POST request to the caller-supplied OpenID provider endpoint during verification

Gitea's collaboration access-mode endpoint accepts the Owner access mode from an authenticated repository collaborator with Admin access

Gitea allows a token with write:user scope to register an attacker-controlled SSH public key on the token owner's account

Gitea resolves local reusable workflow files from a fork's head commit when a trusted base-branch workflow runs for a pull_request_target event

Gitea substitutes a URL derived from the markup Context field into external renderer command templates without escaping the reference path before shell-style argument splitting

Gitea's OpenID connect handler accepts a user's password without enforcing enrolled TOTP or WebAuthn verification before completing sign-in and linking an OpenID identifier

Gitea's Maven upload handler reads checksum uploads entirely into memory and returns before enforcing package-size quotas

Gitea uses inconsistent repository visibility predicates, and the condition used by some repository-listing endpoints admits repositories whose owners are hidden from the viewer

Gitea does not limit the length of the gitignores field accepted by repository-creation forms and the API

Gitea's Actions workflow status badge endpoint does not enforce repository-read scope or the public-only restriction on the token authenticating the request

Gitea's repository markup endpoint resolves same-repository pull request references without enforcing the viewer's Pull Requests permission

Gitea's pull request review notifier does not attach the pull request to the Actions notification, so the fork workflow approval gate does not recognize the run as originating from a fork

From the blog

VulnSea has moved to vulnsea.com (and what changed since September)

What's new: open corpus, three new MCP tools, vendor advisories, package pages

Wiring VulnSea into an agent: a hands-on tutorial

Sound the depths of every vulnerability.

Trending now

Feed

Gitea label deletion across repository and organization IDs

Gitea SSH certificate principal impersonation of other users

Gitea cross-site request forgery on repository topics

Gitea private profile information disclosure through POST request

Gitea panic on the repositories route of individual users

Gitea OpenID account linking without session binding

Gitea watched repositories API disclosure after access revocation

Gitea reactions accepted on locked issues and comments

Gitea release attachment re-linking of issue attachments

Gitea draft release creation disclosing attachment metadata

Gitea API disclosure of private user social graph, keys and stars

Gitea Actions artifact v4 API unbounded request body

Gitea's web attachment handler skips its cross-repository ownership check for attachments created before 16 January 2026 and checks permissions against the repository named in the request URL instead

When OpenID sign-in is enabled, Gitea processes unauthenticated assertion parameters and sends an HTTP POST request to the caller-supplied OpenID provider endpoint during verification

Gitea's collaboration access-mode endpoint accepts the Owner access mode from an authenticated repository collaborator with Admin access

Gitea allows a token with write:user scope to register an attacker-controlled SSH public key on the token owner's account

Gitea resolves local reusable workflow files from a fork's head commit when a trusted base-branch workflow runs for a pull_request_target event

Gitea substitutes a URL derived from the markup Context field into external renderer command templates without escaping the reference path before shell-style argument splitting

Gitea's OpenID connect handler accepts a user's password without enforcing enrolled TOTP or WebAuthn verification before completing sign-in and linking an OpenID identifier

Gitea's Maven upload handler reads checksum uploads entirely into memory and returns before enforcing package-size quotas

Gitea uses inconsistent repository visibility predicates, and the condition used by some repository-listing endpoints admits repositories whose owners are hidden from the viewer

Gitea does not limit the length of the gitignores field accepted by repository-creation forms and the API

Gitea's Actions workflow status badge endpoint does not enforce repository-read scope or the public-only restriction on the token authenticating the request

Gitea's repository markup endpoint resolves same-repository pull request references without enforcing the viewer's Pull Requests permission

Gitea's pull request review notifier does not attach the pull request to the Actions notification, so the fork workflow approval gate does not recognize the run as originating from a fork

From the blog

VulnSea has moved to vulnsea.com (and what changed since September)

What's new: open corpus, three new MCP tools, vendor advisories, package pages

Wiring VulnSea into an agent: a hands-on tutorial