Live CVE & 0day intelligence

Sound the depths of every vulnerability.

Newly released CVEs across every platform — sleek to read, verbose on demand, and served raw as markdown for AI and agent ingestion. Severity reads as depth: the deeper the contact, the graver the threat.

Browse the feed For agents → /llms.txt

Depth = severity + exploitation

HadalCritical and actively exploited (CISA KEV / 0day)
AbyssalCritical with a public exploit or in-the-wild use
MidnightCritical, or high with PoC / in-the-wild
TwilightHigh severity, or a signal on a lesser flaw
SunlitLow / medium · no exploitation signal

68673

Tracked CVEs

6383

Critical

701

Exploited in wild

6071

Last 7 days

Trending now

Bluesky + Hacker News mentions, last 7 days

1CVE-2026-109618Critical· 9.2RCE via OOM corruption4896
2CVE-2026-109619Critical· 9.2RCE via stale global state2196
3CVE-2026-111497Critical· 9.2Out-of-Bounds Write in Google Brotli Decoder1280
4CVE-2026-99999Critical· 9.3In the Linux kernel, the following vulnerability has been resolved: ipv4: validate checksum_start before completing checksum If a packet with bad checksum metadata gets into the ipv4 stack, skb_checksum_help can corrupt the network hea…863
5CVE-2026-110264Critical· 10.0Integer Overflow or Wraparound in GitLab267
6CVE-2026-108707Critical· 9.8Wukong_HRM through commit 186115e contains an authentication bypass vulnerability in ParamAspect that allows unauthenticated attackers to call every HRM API endpoint by omitting the AUTH-TOKEN header266

This week's digest →All digests

Feed

32 matches

CVE-2026-116813Medium· 6.5

yesterday

OpenPanel before 3.0.0 ClickHouse SQL Injection via conversion.service.ts

OpenPanel before 3.0.0 contains an sql injection vulnerability in ConversionService.getConversion that allows project-read members and share-link holders to inject ClickHouse SQL through unescaped event names and dates. Attackers can bre…

▾ SunlitOpenpanel-dev · openpanelEPSS 0.23%via CVEORG

CVE-2026-116805Medium· 4.3

yesterday

OpenPanel before 3.0.0 Information Disclosure of Ingestion Secret Hashes via client.list

OpenPanel before 3.0.0 contains an information disclosure vulnerability that allows read-level project members to obtain argon2id hashes of ingestion credentials through the client.list tRPC query. Attackers can request client.list with …

▾ SunlitOpenpanel-dev · openpanelEPSS 0.22%via CVEORG

CVE-2026-116809Medium· 5.3

yesterday

OpenPanel before 3.0.0 Missing Authorization in event.bots tRPC Procedure

OpenPanel before 3.0.0 contains a missing authorization vulnerability in the event.bots tRPC procedure that allows unauthenticated attackers to read bot events by only checking shareOverview row existence. Attackers can send anonymous re…

▾ SunlitOpenpanel-dev · openpanelEPSS 0.21%via CVEORG

CVE-2026-116818High· 8.2

yesterday

OpenPanel before 3.0.0 Unauthenticated ClickHouse SQL Injection via /live/visitors WebSocket

OpenPanel before 3.0.0 contains an unauthenticated ClickHouse sql injection vulnerability that allows remote attackers to inject SQL through the projectId parameter of the /live/visitors/:projectId WebSocket, which lacks session and proj…

▾ TwilightOpenpanel-dev · openpanelEPSS 0.43%via CVEORG

CVE-2026-116817Medium· 6.5

yesterday

OpenPanel before 3.0.0 Missing Authentication on Worker Bull Board

OpenPanel before 3.0.0 contains a missing authentication vulnerability that allows unauthenticated attackers to access the Bull Board dashboard served on the worker HTTP port. Attackers can query /api/queues and call mutating Bull Board …

▾ SunlitOpenpanel-dev · openpanelEPSS 0.27%via CVEORG

CVE-2026-116819High· 8.5

yesterday

OpenPanel before 3.0.0 Credential Disclosure via notification.rules Query

OpenPanel before 3.0.0 contains an information disclosure vulnerability that allows read-level project members to obtain plaintext integration secrets because the notification.rules query skips redactIntegration. Attackers can call the n…

▾ TwilightOpenpanel-dev · openpanelEPSS 0.30%via CVEORG

CVE-2026-116812Medium· 6.5

yesterday

OpenPanel before 3.0.0 ClickHouse SQL Injection via cohort.preview profile filter

OpenPanel before 3.0.0 contains a sql injection vulnerability in profileColumnAccess in cohort.service.ts that allows project-read members to inject SQL by supplying unescaped profile filter column names. Attackers can submit a cohort.pr…

▾ SunlitOpenpanel-dev · openpanelEPSS 0.23%via CVEORG

CVE-2026-116815Medium· 4.3

yesterday

OpenPanel before 3.0.0 Improper ClickHouse Escaping in sankey.service.ts

OpenPanel before 3.0.0 contains an improper escaping vulnerability in sankey.service.ts that allows authenticated project members to break ClickHouse string literals by supplying backslashes in event names. Attackers with read access can…

▾ SunlitOpenpanel-dev · openpanelEPSS 0.23%via CVEORG

CVE-2026-116814Medium· 6.5

yesterday

OpenPanel before 3.0.0 Sensitive Information Exposure via Application Logs

OpenPanel before 3.0.0 contains an information exposure vulnerability that writes database connection URLs and email template data to standard output logs. Users with log access can obtain database credentials from migration startup logs…

▾ SunlitOpenpanel-dev · openpanelEPSS 0.28%via CVEORG

CVE-2026-116811High· 8.8

yesterday

OpenPanel before 3.0.0 Sandbox Escape RCE via Webhook JavaScript Template

OpenPanel before 3.0.0 contains a sandbox escape vulnerability in the js-runtime validator that allows a project member to bypass the AST allowlist by aliasing the Function constructor. Attackers with write access can read payload.constr…

▾ TwilightOpenpanel-dev · openpanelEPSS 0.49%via CVEORG

CVE-2026-116807Medium· 6.5

yesterday

OpenPanel before 3.0.0 ClickHouse SQL Injection via event.events tRPC Query

OpenPanel before 3.0.0 contains an sql injection vulnerability that allows authenticated users to bypass tenant scoping by injecting unescaped profile filter names into a JOIN subquery. Attackers can supply a crafted filter name with a t…

▾ SunlitOpenpanel-dev · openpanelEPSS 0.27%via CVEORG

CVE-2026-116808High· 7.2

yesterday

OpenPanel before 3.0.0 ClickHouse SQL Injection via profile.values

OpenPanel before 3.0.0 contains an sql injection vulnerability that allows authenticated users to read cross-tenant data by supplying a crafted property parameter to profile.values. Attackers can inject a SELECT expression with their own…

▾ TwilightOpenpanel-dev · openpanelEPSS 0.39%via CVEORG

CVE-2026-116810Medium· 5.3

yesterday

OpenPanel before 3.0.0 Missing Authorization via reference.getChartReferences

OpenPanel before 3.0.0 contains a missing authorization vulnerability that allows unauthenticated attackers to read any project's annotations by calling the public reference.getChartReferences tRPC procedure. Attackers can send requests …

▾ SunlitOpenpanel-dev · openpanelEPSS 0.25%via CVEORG

CVE-2026-116806Medium· 5.4

yesterday

OpenPanel before 3.0.0 Privilege Escalation via onboarding.project tRPC Mutation

OpenPanel before 3.0.0 contains a missing authorization vulnerability in the onboarding.project tRPC mutation that allows non-admin organization members to create projects and mint write-type ingestion credentials, bypassing the admin-on…

▾ SunlitOpenpanel-dev · openpanelEPSS 0.24%via CVEORG

CVE-2026-108579Medium· 4.2

2w ago

OpenPanel through 2.3.0 contains a CSV formula injection vulnerability that allows unauthenticated attackers to embed spreadsheet formulas by supplying crafted profile IDs to the /track endpoint

OpenPanel through 2.3.0 contains a CSV formula injection vulnerability that allows unauthenticated attackers to embed spreadsheet formulas by supplying crafted profile IDs to the /track endpoint. Attackers can send tracking events with p…

▾ SunlitOpenpanel-dev · openpanelEPSS 0.20%via NVD

CVE-2026-93983Medium· 5.0PoC

1mo ago

OpenPanel through 2.3.0 fails to escape property keys in ClickHouse SQL queries, allowing authenticated users to inject boolean SQL terms

OpenPanel through 2.3.0 fails to escape property keys in ClickHouse SQL queries, allowing authenticated users to inject boolean SQL terms. Attackers can supply crafted filter names to bypass project isolation and access metrics from othe…

▾ TwilightOpenpanel-dev · openpanelEPSS 0.33%via NVD

CVE-2026-93982Low· 3.3PoC

1mo ago

OpenPanel through 2.3.0 writes Model Context Protocol authentication tokens from URL query parameters to plaintext application logs without redaction

OpenPanel through 2.3.0 writes Model Context Protocol authentication tokens from URL query parameters to plaintext application logs without redaction. Attackers with access to application stdout or centralized logging systems can capture…

▾ TwilightOpenpanel-dev · openpanelEPSS 0.17%via NVD

CVE-2026-93985Critical· 9.9PoC

1mo ago

OpenPanel js-runtime through 2.3.0 contains a sandbox escape vulnerability in the JavaScript webhook template validator that fails to block computed member access to constructor chains

OpenPanel js-runtime through 2.3.0 contains a sandbox escape vulnerability in the JavaScript webhook template validator that fails to block computed member access to constructor chains. Attackers with project write access can create webh…

▾ AbyssalOpenpanel-dev · openpanelEPSS 0.67%via NVD

CVE-2026-93984Medium· 5.3PoC

1mo ago

OpenPanel tracking API through 2.3.0 fails to verify client secret cryptographic hash before authorizing revenue events and bot filtering

OpenPanel tracking API through 2.3.0 fails to verify client secret cryptographic hash before authorizing revenue events and bot filtering. Attackers with only a public client ID can supply arbitrary dummy secrets to inject forged revenue…

▾ TwilightOpenpanel-dev · openpanelEPSS 0.41%via NVD

CVE-2026-88890High· 8.5

1mo ago

OpenPanel through 2.3.0 contains an SQL injection vulnerability in the analytics filter builder that fails to validate profile.* filter column identifiers before interpolating them into ClickHouse WHERE clauses

OpenPanel through 2.3.0 contains an SQL injection vulnerability in the analytics filter builder that fails to validate profile.* filter column identifiers before interpolating them into ClickHouse WHERE clauses. An authenticated attacker…

▾ TwilightOpenpanel-dev · openpanelEPSS 0.39%via NVD

CVE-2026-88893High· 7.5

1mo ago

OpenPanel through 2.3.0 share lookup procedures fail to validate access controls and return password hashes and protected report definitions to unauthenticated callers

OpenPanel through 2.3.0 share lookup procedures fail to validate access controls and return password hashes and protected report definitions to unauthenticated callers. Attackers with a share link can retrieve argon2id password hashes an…

▾ TwilightOpenpanel-dev · openpanelEPSS 0.49%via NVD

CVE-2026-88891High· 8.3PoC

1mo ago

OpenPanel through 2.3.0 fails to enforce read-only project access level on 26 of 29 mutating procedures, allowing read-level members to modify, delete, and publish project data

OpenPanel through 2.3.0 fails to enforce read-only project access level on 26 of 29 mutating procedures, allowing read-level members to modify, delete, and publish project data. Attackers with explicit read-only access can delete reports…

▾ MidnightOpenpanel-dev · openpanelEPSS 0.44%via NVD

CVE-2026-88892Medium· 5.0PoC

1mo ago

In OpenPanel through 2.3.0, the data importer fetches a caller-supplied URL with plain fetch instead of the project's existing SSRF guard (apps/api/src/utils/safe-fetch.ts)

In OpenPanel through 2.3.0, the data importer fetches a caller-supplied URL with plain fetch instead of the project's existing SSRF guard (apps/api/src/utils/safe-fetch.ts). In packages/importer/src/providers/umami.ts, parseRemoteFile ca…

▾ TwilightOpenpanel-dev · openpanelEPSS 0.33%via NVD

CVE-2026-85615Medium· 6.4

1mo ago

Openpanel before 2.3.0 contains an insecure direct object reference vulnerability in the report.getLayouts and report.resetLayout tRPC procedures that fail to bind dashboardId to the authorized projectId

Openpanel before 2.3.0 contains an insecure direct object reference vulnerability in the report.getLayouts and report.resetLayout tRPC procedures that fail to bind dashboardId to the authorized projectId. Authenticated attackers can supp…

▾ SunlitOpenpanel-dev · openpanelEPSS 0.24%via NVD

CVE-2026-85614High· 8.6

1mo ago

OpenPanel before 2.3.0 contains an unauthenticated server-side request forgery vulnerability in the GET /tools/site-checker endpoint that accepts a fully client-controlled URL parameter with no private IP filtering or DNS-rebinding prote…

OpenPanel before 2.3.0 contains an unauthenticated server-side request forgery vulnerability in the GET /tools/site-checker endpoint that accepts a fully client-controlled URL parameter with no private IP filtering or DNS-rebinding prote…

▾ TwilightOpenpanel-dev · openpanelEPSS 0.26%via NVD

From the blog

All posts →

Oct 27, 2026

Sound the depths of every vulnerability.

Trending now

Feed

OpenPanel before 3.0.0 ClickHouse SQL Injection via conversion.service.ts

OpenPanel before 3.0.0 Information Disclosure of Ingestion Secret Hashes via client.list

OpenPanel before 3.0.0 Missing Authorization in event.bots tRPC Procedure

OpenPanel before 3.0.0 Unauthenticated ClickHouse SQL Injection via /live/visitors WebSocket

OpenPanel before 3.0.0 Missing Authentication on Worker Bull Board

OpenPanel before 3.0.0 Credential Disclosure via notification.rules Query

OpenPanel before 3.0.0 ClickHouse SQL Injection via cohort.preview profile filter

OpenPanel before 3.0.0 Improper ClickHouse Escaping in sankey.service.ts

OpenPanel before 3.0.0 Sensitive Information Exposure via Application Logs

OpenPanel before 3.0.0 Sandbox Escape RCE via Webhook JavaScript Template

OpenPanel before 3.0.0 ClickHouse SQL Injection via event.events tRPC Query

OpenPanel before 3.0.0 ClickHouse SQL Injection via profile.values

OpenPanel before 3.0.0 Missing Authorization via reference.getChartReferences

OpenPanel before 3.0.0 Privilege Escalation via onboarding.project tRPC Mutation

OpenPanel through 2.3.0 contains a CSV formula injection vulnerability that allows unauthenticated attackers to embed spreadsheet formulas by supplying crafted profile IDs to the /track endpoint

OpenPanel through 2.3.0 fails to escape property keys in ClickHouse SQL queries, allowing authenticated users to inject boolean SQL terms

OpenPanel through 2.3.0 writes Model Context Protocol authentication tokens from URL query parameters to plaintext application logs without redaction

OpenPanel js-runtime through 2.3.0 contains a sandbox escape vulnerability in the JavaScript webhook template validator that fails to block computed member access to constructor chains

OpenPanel tracking API through 2.3.0 fails to verify client secret cryptographic hash before authorizing revenue events and bot filtering

OpenPanel through 2.3.0 contains an SQL injection vulnerability in the analytics filter builder that fails to validate profile.* filter column identifiers before interpolating them into ClickHouse WHERE clauses

OpenPanel through 2.3.0 share lookup procedures fail to validate access controls and return password hashes and protected report definitions to unauthenticated callers

OpenPanel through 2.3.0 fails to enforce read-only project access level on 26 of 29 mutating procedures, allowing read-level members to modify, delete, and publish project data

In OpenPanel through 2.3.0, the data importer fetches a caller-supplied URL with plain fetch instead of the project's existing SSRF guard (apps/api/src/utils/safe-fetch.ts)

Openpanel before 2.3.0 contains an insecure direct object reference vulnerability in the report.getLayouts and report.resetLayout tRPC procedures that fail to bind dashboardId to the authorized projectId

OpenPanel before 2.3.0 contains an unauthenticated server-side request forgery vulnerability in the GET /tools/site-checker endpoint that accepts a fully client-controlled URL parameter with no private IP filtering or DNS-rebinding prote…

From the blog

VulnSea has moved to vulnsea.com (and what changed since September)

What's new: open corpus, three new MCP tools, vendor advisories, package pages

Wiring VulnSea into an agent: a hands-on tutorial

Sound the depths of every vulnerability.

Trending now

Feed

OpenPanel before 3.0.0 ClickHouse SQL Injection via conversion.service.ts

OpenPanel before 3.0.0 Information Disclosure of Ingestion Secret Hashes via client.list

OpenPanel before 3.0.0 Missing Authorization in event.bots tRPC Procedure

OpenPanel before 3.0.0 Unauthenticated ClickHouse SQL Injection via /live/visitors WebSocket

OpenPanel before 3.0.0 Missing Authentication on Worker Bull Board

OpenPanel before 3.0.0 Credential Disclosure via notification.rules Query

OpenPanel before 3.0.0 ClickHouse SQL Injection via cohort.preview profile filter

OpenPanel before 3.0.0 Improper ClickHouse Escaping in sankey.service.ts

OpenPanel before 3.0.0 Sensitive Information Exposure via Application Logs

OpenPanel before 3.0.0 Sandbox Escape RCE via Webhook JavaScript Template

OpenPanel before 3.0.0 ClickHouse SQL Injection via event.events tRPC Query

OpenPanel before 3.0.0 ClickHouse SQL Injection via profile.values

OpenPanel before 3.0.0 Missing Authorization via reference.getChartReferences

OpenPanel before 3.0.0 Privilege Escalation via onboarding.project tRPC Mutation

OpenPanel through 2.3.0 contains a CSV formula injection vulnerability that allows unauthenticated attackers to embed spreadsheet formulas by supplying crafted profile IDs to the /track endpoint

OpenPanel through 2.3.0 fails to escape property keys in ClickHouse SQL queries, allowing authenticated users to inject boolean SQL terms

OpenPanel through 2.3.0 writes Model Context Protocol authentication tokens from URL query parameters to plaintext application logs without redaction

OpenPanel js-runtime through 2.3.0 contains a sandbox escape vulnerability in the JavaScript webhook template validator that fails to block computed member access to constructor chains

OpenPanel tracking API through 2.3.0 fails to verify client secret cryptographic hash before authorizing revenue events and bot filtering

OpenPanel through 2.3.0 contains an SQL injection vulnerability in the analytics filter builder that fails to validate profile.* filter column identifiers before interpolating them into ClickHouse WHERE clauses

OpenPanel through 2.3.0 share lookup procedures fail to validate access controls and return password hashes and protected report definitions to unauthenticated callers

OpenPanel through 2.3.0 fails to enforce read-only project access level on 26 of 29 mutating procedures, allowing read-level members to modify, delete, and publish project data

In OpenPanel through 2.3.0, the data importer fetches a caller-supplied URL with plain fetch instead of the project's existing SSRF guard (apps/api/src/utils/safe-fetch.ts)

Openpanel before 2.3.0 contains an insecure direct object reference vulnerability in the report.getLayouts and report.resetLayout tRPC procedures that fail to bind dashboardId to the authorized projectId

OpenPanel before 2.3.0 contains an unauthenticated server-side request forgery vulnerability in the GET /tools/site-checker endpoint that accepts a fully client-controlled URL parameter with no private IP filtering or DNS-rebinding prote…

From the blog

VulnSea has moved to vulnsea.com (and what changed since September)

What's new: open corpus, three new MCP tools, vendor advisories, package pages

Wiring VulnSea into an agent: a hands-on tutorial