Live CVE & 0day intelligence

Sound the depths of every vulnerability.

Newly released CVEs across every platform — sleek to read, verbose on demand, and served raw as markdown for AI and agent ingestion. Severity reads as depth: the deeper the contact, the graver the threat.

Browse the feed For agents → /llms.txt

Depth = severity + exploitation

HadalCritical and actively exploited (CISA KEV / 0day)
AbyssalCritical with a public exploit or in-the-wild use
MidnightCritical, or high with PoC / in-the-wild
TwilightHigh severity, or a signal on a lesser flaw
SunlitLow / medium · no exploitation signal

69579

Tracked CVEs

6478

Critical

738

Exploited in wild

3793

Last 7 days

Trending now

Bluesky + Hacker News mentions, last 7 days

1CVE-2026-109618Critical· 9.2RCE via OOM corruption4896
2CVE-2026-109619Critical· 9.2RCE via stale global state2196
3CVE-2026-111497Critical· 9.2Out-of-Bounds Write in Google Brotli Decoder1592
4CVE-2026-99999Critical· 9.3In the Linux kernel, the following vulnerability has been resolved: ipv4: validate checksum_start before completing checksum If a packet with bad checksum metadata gets into the ipv4 stack, skb_checksum_help can corrupt the network hea…963
5CVE-2026-110264Critical· 10.0Integer Overflow or Wraparound in GitLab267
6CVE-2026-108707Critical· 9.8Wukong_HRM through commit 186115e contains an authentication bypass vulnerability in ParamAspect that allows unauthenticated attackers to call every HRM API endpoint by omitting the AUTH-TOKEN header266
7CVE-2026-91403Critical· 9.1Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JSSE)262

This week's digest →All digests

Feed

9 matches

CVE-2026-118259Medium· 5.3

3d ago

opentelemetry-java: Quadratic CPU consumption in W3C tracestate parsing

▾ Sunlitopentelemetry · io.opentelemetry:opentelemetry-apivia GHSA

CVE-2026-112006Medium· 6.5

1w ago

OpenTelemetry opentelemetry-exporter-otlp-proto-http 1.5.0 before 1.45.0 Improper Certificate Validation

OpenTelemetry opentelemetry-exporter-otlp-proto-http 1.5.0 before 1.45.0 contains an improper certificate validation vulnerability that disables TLS verification when OTEL_EXPORTER_OTLP_CERTIFICATE variables are empty strings. Man-in-the…

▾ SunlitOpenTelemetry · opentelemetry-exporter-otlp-proto-httpEPSS 0.21%via CVEORG

CVE-2026-54712Medium· 5.3

3mo ago

OpenTelemetry Javaagent RMI context propagation allows resource exhaustion

▾ Sunlitopentelemetry · io.opentelemetry.javaagent:opentelemetry-javaagentEPSS 0.46%via GHSA

CVE-2026-54704Medium· 6.5

3mo ago

OpenTelemetry Java Instrumentation: JDBC Auto-Instrumentation Logging Clear-Text Passwords

▾ Sunlitopentelemetry · io.opentelemetry.javaagent:opentelemetry-javaagentEPSS 0.38%via GHSA

CVE-2026-59892High· 7.5

3mo ago

OpenTelemetry JavaScript: Denial of service in `JaegerPropagator` via unhandled exception on a malformed header

▾ Twilightopentelemetry · @opentelemetry/propagator-jaegerEPSS 0.56%via GHSA

CVE-2026-54285Medium· 5.3

4mo ago

OpenTelemetry Core: Unbounded memory allocation in W3C Baggage propagation

▾ Sunlitopentelemetry · @opentelemetry/coreEPSS 0.40%via GHSA

CVE-2026-44902High· 7.5

5mo ago

Prometheus exporter process crash via malformed HTTP request

▾ Twilightopentelemetry · @opentelemetry/exporter-prometheusEPSS 0.47%via GHSA

CVE-2026-39883High· 7.0

6mo ago

OpenTelemetry-Go is the Go implementation of OpenTelemetry

OpenTelemetry-Go is the Go implementation of OpenTelemetry. From 1.15.0 to 1.42.0, the fix for CVE-2026-24051 changed the Darwin ioreg command to use an absolute path but left the BSD kenv command using a bare name, allowing the same PAT…

▾ Twilightopentelemetry · opentelemetryEPSS 0.25%via NVD

CVE-2026-29181High· 7.5PoC

6mo ago

OpenTelemetry-Go is the Go implementation of OpenTelemetry

OpenTelemetry-Go is the Go implementation of OpenTelemetry. From 1.36.0 to 1.40.0, multi-value baggage: header extraction parses each header field-value independently and aggregates members across values. This allows an attacker to ampli…

▾ Midnightopentelemetry · opentelemetryEPSS 0.79%via NVD

From the blog

All posts →

Oct 27, 2026

Sound the depths of every vulnerability.

Trending now

Feed

opentelemetry-java: Quadratic CPU consumption in W3C tracestate parsing

OpenTelemetry opentelemetry-exporter-otlp-proto-http 1.5.0 before 1.45.0 Improper Certificate Validation

OpenTelemetry Javaagent RMI context propagation allows resource exhaustion

OpenTelemetry Java Instrumentation: JDBC Auto-Instrumentation Logging Clear-Text Passwords

OpenTelemetry JavaScript: Denial of service in `JaegerPropagator` via unhandled exception on a malformed header

OpenTelemetry Core: Unbounded memory allocation in W3C Baggage propagation

Prometheus exporter process crash via malformed HTTP request

OpenTelemetry-Go is the Go implementation of OpenTelemetry

OpenTelemetry-Go is the Go implementation of OpenTelemetry

From the blog

VulnSea has moved to vulnsea.com (and what changed since September)

What's new: open corpus, three new MCP tools, vendor advisories, package pages

Wiring VulnSea into an agent: a hands-on tutorial

Sound the depths of every vulnerability.

Trending now

Feed

opentelemetry-java: Quadratic CPU consumption in W3C tracestate parsing

OpenTelemetry opentelemetry-exporter-otlp-proto-http 1.5.0 before 1.45.0 Improper Certificate Validation

OpenTelemetry Javaagent RMI context propagation allows resource exhaustion

OpenTelemetry Java Instrumentation: JDBC Auto-Instrumentation Logging Clear-Text Passwords

OpenTelemetry JavaScript: Denial of service in `JaegerPropagator` via unhandled exception on a malformed header

OpenTelemetry Core: Unbounded memory allocation in W3C Baggage propagation

Prometheus exporter process crash via malformed HTTP request

OpenTelemetry-Go is the Go implementation of OpenTelemetry

OpenTelemetry-Go is the Go implementation of OpenTelemetry

From the blog

VulnSea has moved to vulnsea.com (and what changed since September)

What's new: open corpus, three new MCP tools, vendor advisories, package pages

Wiring VulnSea into an agent: a hands-on tutorial