Live CVE & 0day intelligence

Sound the depths of every vulnerability.

Newly released CVEs across every platform — sleek to read, verbose on demand, and served raw as markdown for AI and agent ingestion. Severity reads as depth: the deeper the contact, the graver the threat.

Browse the feed For agents → /llms.txt

Depth = severity + exploitation

HadalCritical and actively exploited (CISA KEV / 0day)
AbyssalCritical with a public exploit or in-the-wild use
MidnightCritical, or high with PoC / in-the-wild
TwilightHigh severity, or a signal on a lesser flaw
SunlitLow / medium · no exploitation signal

68683

Tracked CVEs

6383

Critical

701

Exploited in wild

4976

Last 7 days

Trending now

Bluesky + Hacker News mentions, last 7 days

1CVE-2026-109618Critical· 9.2RCE via OOM corruption4896
2CVE-2026-109619Critical· 9.2RCE via stale global state2196
3CVE-2026-111497Critical· 9.2Out-of-Bounds Write in Google Brotli Decoder1280
4CVE-2026-99999Critical· 9.3In the Linux kernel, the following vulnerability has been resolved: ipv4: validate checksum_start before completing checksum If a packet with bad checksum metadata gets into the ipv4 stack, skb_checksum_help can corrupt the network hea…863
5CVE-2026-110264Critical· 10.0Integer Overflow or Wraparound in GitLab267
6CVE-2026-108707Critical· 9.8Wukong_HRM through commit 186115e contains an authentication bypass vulnerability in ParamAspect that allows unauthenticated attackers to call every HRM API endpoint by omitting the AUTH-TOKEN header266

This week's digest →All digests

Feed

31 matches

CVE-2026-34006Critical· 9.3

1w ago

A missing authentication for critical function vulnerability has been reported to affect sMedio DTCP MOVE

A missing authentication for critical function vulnerability has been reported to affect sMedio DTCP MOVE. If exploited, the vulnerability could allow remote attackers to gain access to the system. We have already fixed the vulnerabilit…

▾ MidnightQNAP Systems Inc. · sMedio DTCP MOVEEPSS 0.40%via NVD

CVE-2026-26243High· 7.2

1w ago

A path traversal vulnerability has been reported to affect Qsync Central

A path traversal vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to read the contents of unexpected files or system data. We have already fixed …

▾ TwilightQNAP Systems Inc. · Qsync CentralEPSS 0.42%via NVD

CVE-2026-34014High· 8.4

1w ago

An incorrect permission assignment for critical resource vulnerability has been reported to affect Download Station

An incorrect permission assignment for critical resource vulnerability has been reported to affect Download Station. If a local attacker gains an administrator account, they can then exploit the vulnerability to compromise the security o…

▾ TwilightQNAP Systems Inc. · Download StationEPSS 0.10%via NVD

CVE-2026-39989Medium· 5.3

1w ago

A server-side request forgery (SSRF) vulnerability has been reported to affect Download Station

A server-side request forgery (SSRF) vulnerability has been reported to affect Download Station. If a remote attacker gains a user account, they can then exploit the vulnerability to read application data. We have already fixed the vuln…

▾ SunlitQNAP Systems Inc. · Download StationEPSS 0.26%via NVD

CVE-2026-50612Critical· 9.4

1w ago

An unix symbolic link (symlink) following vulnerability has been reported to affect QuMagie

An unix symbolic link (symlink) following vulnerability has been reported to affect QuMagie. If a remote attacker gains a user account, they can then exploit the vulnerability to compromise the security of the system. We have already fi…

▾ MidnightQNAP Systems Inc. · QuMagieEPSS 0.38%via NVD

CVE-2026-41545High· 8.6

1w ago

A relative path traversal vulnerability has been reported to affect QuMagie

A relative path traversal vulnerability has been reported to affect QuMagie. If a remote attacker gains an administrator account, they can then exploit the vulnerability to read the contents of unexpected files or system data. We have a…

▾ TwilightQNAP Systems Inc. · QuMagieEPSS 0.42%via NVD

CVE-2026-53882High· 8.7

1w ago

An improper link resolution before file access ('link following') vulnerability has been reported to affect Virtualization Station

An improper link resolution before file access ('link following') vulnerability has been reported to affect Virtualization Station. If a remote attacker gains a user account, they can then exploit the vulnerability to compromise the secu…

▾ TwilightQNAP Systems Inc. · Virtualization StationEPSS 0.36%via NVD

CVE-2026-41541Medium· 5.3

1w ago

An unix symbolic link (symlink) following vulnerability has been reported to affect Qsync Central

An unix symbolic link (symlink) following vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to compromise the security of the system. We have alre…

▾ SunlitQNAP Systems Inc. · Qsync CentralEPSS 0.38%via NVD

CVE-2026-34008High· 8.5

1w ago

An incorrect permission assignment for critical resource vulnerability has been reported to affect Notes Station 3

An incorrect permission assignment for critical resource vulnerability has been reported to affect Notes Station 3. If a local attacker gains a user account, they can then exploit the vulnerability to compromise the security of the syste…

▾ TwilightQNAP Systems Inc. · Notes Station 3EPSS 0.10%via NVD

CVE-2026-47790Medium· 6.3

1w ago

A cross-site scripting (XSS) vulnerability has been reported to affect QuFTP Service

A cross-site scripting (XSS) vulnerability has been reported to affect QuFTP Service. If a remote attacker gains a user account, they can then exploit the vulnerability to inject malicious code. We have already fixed the vulnerability i…

▾ SunlitQNAP Systems Inc. · QuFTP ServiceEPSS 0.28%via NVD

CVE-2026-39991Medium· 4.8

1w ago

A cross-site scripting (XSS) vulnerability has been reported to affect Notes Station 3

A cross-site scripting (XSS) vulnerability has been reported to affect Notes Station 3. If a remote attacker gains a user account, they can then exploit the vulnerability to inject malicious code. We have already fixed the vulnerability…

▾ SunlitQNAP Systems Inc. · Notes Station 3EPSS 0.29%via NVD

CVE-2026-34007Medium· 6.9

1w ago

An OS command injection vulnerability has been reported to affect Notes Station 3

An OS command injection vulnerability has been reported to affect Notes Station 3. If exploited, the vulnerability could allow remote attackers to execute arbitrary commands. We have already fixed the vulnerability in the following vers…

▾ SunlitQNAP Systems Inc. · Notes Station 3EPSS 1.4%via NVD

CVE-2026-39997High· 8.9

1w ago

A missing authentication for critical function vulnerability has been reported to affect HybridDesk Station

A missing authentication for critical function vulnerability has been reported to affect HybridDesk Station. If exploited, the vulnerability could allow remote attackers to gain access to the system. We have already fixed the vulnerabil…

▾ TwilightQNAP Systems Inc. · HybridDesk StationEPSS 0.24%via NVD

CVE-2026-34009High· 8.4

1w ago

An improper isolation or compartmentalization vulnerability has been reported to affect Notes Station 3

An improper isolation or compartmentalization vulnerability has been reported to affect Notes Station 3. If a local attacker gains an administrator account, they can then exploit the vulnerability to compromise the security of the system…

▾ TwilightQNAP Systems Inc. · Notes Station 3EPSS 0.11%via NVD

CVE-2026-50619Critical· 9.3

1w ago

A path traversal vulnerability has been reported to affect Qsirch

A path traversal vulnerability has been reported to affect Qsirch. If exploited, the vulnerability could allow remote attackers to read the contents of unexpected files or system data. We have already fixed the vulnerability in the foll…

▾ MidnightQNAP Systems Inc. · QsirchEPSS 0.43%via NVD

CVE-2026-47786Critical· 9.3

1w ago

An OS command injection vulnerability has been reported to affect HybridDesk Station

An OS command injection vulnerability has been reported to affect HybridDesk Station. If exploited, the vulnerability could allow remote attackers to execute arbitrary commands. We have already fixed the vulnerability in the following v…

▾ MidnightQNAP Systems Inc. · HybridDesk StationEPSS 1.1%via NVD

CVE-2026-41544High· 8.7

1w ago

A path traversal vulnerability has been reported to affect QcalAgent

A path traversal vulnerability has been reported to affect QcalAgent. If a remote attacker gains a user account, they can then exploit the vulnerability to read the contents of unexpected files or system data. We have already fixed the …

▾ TwilightQNAP Systems Inc. · QcalAgentEPSS 0.36%via NVD

CVE-2026-39993High· 8.7

1w ago

A relative path traversal vulnerability has been reported to affect Download Station

A relative path traversal vulnerability has been reported to affect Download Station. If a remote attacker gains a user account, they can then exploit the vulnerability to read the contents of unexpected files or system data. We have al…

▾ TwilightQNAP Systems Inc. · Download StationEPSS 0.36%via NVD

CVE-2026-24718Medium· 5.3

1w ago

A path traversal vulnerability has been reported to affect Qsync Central

▾ SunlitQNAP Systems Inc. · Qsync CentralEPSS 0.36%via NVD

CVE-2026-24715Medium· 5.3

1w ago

An observable timing discrepancy vulnerability has been reported to affect QuRouter

An observable timing discrepancy vulnerability has been reported to affect QuRouter. If exploited, the vulnerability could allow remote attackers to obtain sensitive data. We have already fixed the vulnerability in the following version…

▾ SunlitQNAP Systems Inc. · QuRouterEPSS 0.19%via NVD

CVE-2026-22896Medium· 6.2

1w ago

A cross-site scripting (XSS) vulnerability has been reported to affect Network & Virtual Switch

A cross-site scripting (XSS) vulnerability has been reported to affect Network & Virtual Switch. If a remote attacker gains an administrator account, they can then exploit the vulnerability to inject malicious code. We have already fixe…

▾ SunlitQNAP Systems Inc. · Network & Virtual SwitchEPSS 0.36%via NVD

CVE-2025-68404High· 7.5

1w ago

A time-of-check time-of-use (toctou) race condition vulnerability has been reported to affect QuRouter

A time-of-check time-of-use (toctou) race condition vulnerability has been reported to affect QuRouter. If exploited, the vulnerability could allow remote attackers to compromise the security of the system. We have already fixed the vul…

▾ TwilightQNAP Systems Inc. · QuRouterEPSS 0.15%via NVD

CVE-2025-68403Medium· 4.6

1w ago

An external control of system or configuration setting vulnerability has been reported to affect QuRouter

An external control of system or configuration setting vulnerability has been reported to affect QuRouter. If a local attacker gains an administrator account, they can then exploit the vulnerability to modify data on the system. We have…

▾ SunlitQNAP Systems Inc. · QuRouterEPSS 0.11%via NVD

CVE-2025-66275High· 7.7

1w ago

A path traversal vulnerability has been reported to affect Video Station

A path traversal vulnerability has been reported to affect Video Station. If a remote attacker gains a user account, they can then exploit the vulnerability to read the contents of unexpected files or system data. We have already fixed …

▾ TwilightQNAP Systems Inc. · Video StationEPSS 0.37%via NVD

CVE-2025-66272High· 7.7

1w ago

A path traversal vulnerability has been reported to affect Video Station

▾ TwilightQNAP Systems Inc. · Video StationEPSS 0.37%via NVD

From the blog

All posts →

Oct 27, 2026

Sound the depths of every vulnerability.

Trending now

Feed

A missing authentication for critical function vulnerability has been reported to affect sMedio DTCP MOVE

A path traversal vulnerability has been reported to affect Qsync Central

An incorrect permission assignment for critical resource vulnerability has been reported to affect Download Station

A server-side request forgery (SSRF) vulnerability has been reported to affect Download Station

An unix symbolic link (symlink) following vulnerability has been reported to affect QuMagie

A relative path traversal vulnerability has been reported to affect QuMagie

An improper link resolution before file access ('link following') vulnerability has been reported to affect Virtualization Station

An unix symbolic link (symlink) following vulnerability has been reported to affect Qsync Central

An incorrect permission assignment for critical resource vulnerability has been reported to affect Notes Station 3

A cross-site scripting (XSS) vulnerability has been reported to affect QuFTP Service

A cross-site scripting (XSS) vulnerability has been reported to affect Notes Station 3

An OS command injection vulnerability has been reported to affect Notes Station 3

A missing authentication for critical function vulnerability has been reported to affect HybridDesk Station

An improper isolation or compartmentalization vulnerability has been reported to affect Notes Station 3

A path traversal vulnerability has been reported to affect Qsirch

An OS command injection vulnerability has been reported to affect HybridDesk Station

A path traversal vulnerability has been reported to affect QcalAgent

A relative path traversal vulnerability has been reported to affect Download Station

A path traversal vulnerability has been reported to affect Qsync Central

An observable timing discrepancy vulnerability has been reported to affect QuRouter

A cross-site scripting (XSS) vulnerability has been reported to affect Network & Virtual Switch

A time-of-check time-of-use (toctou) race condition vulnerability has been reported to affect QuRouter

An external control of system or configuration setting vulnerability has been reported to affect QuRouter

A path traversal vulnerability has been reported to affect Video Station

A path traversal vulnerability has been reported to affect Video Station

From the blog

VulnSea has moved to vulnsea.com (and what changed since September)

What's new: open corpus, three new MCP tools, vendor advisories, package pages

Wiring VulnSea into an agent: a hands-on tutorial

Sound the depths of every vulnerability.

Trending now

Feed

A missing authentication for critical function vulnerability has been reported to affect sMedio DTCP MOVE

A path traversal vulnerability has been reported to affect Qsync Central

An incorrect permission assignment for critical resource vulnerability has been reported to affect Download Station

A server-side request forgery (SSRF) vulnerability has been reported to affect Download Station

An unix symbolic link (symlink) following vulnerability has been reported to affect QuMagie

A relative path traversal vulnerability has been reported to affect QuMagie

An improper link resolution before file access ('link following') vulnerability has been reported to affect Virtualization Station

An unix symbolic link (symlink) following vulnerability has been reported to affect Qsync Central

An incorrect permission assignment for critical resource vulnerability has been reported to affect Notes Station 3

A cross-site scripting (XSS) vulnerability has been reported to affect QuFTP Service

A cross-site scripting (XSS) vulnerability has been reported to affect Notes Station 3

An OS command injection vulnerability has been reported to affect Notes Station 3

A missing authentication for critical function vulnerability has been reported to affect HybridDesk Station

An improper isolation or compartmentalization vulnerability has been reported to affect Notes Station 3

A path traversal vulnerability has been reported to affect Qsirch

An OS command injection vulnerability has been reported to affect HybridDesk Station

A path traversal vulnerability has been reported to affect QcalAgent

A relative path traversal vulnerability has been reported to affect Download Station

A path traversal vulnerability has been reported to affect Qsync Central

An observable timing discrepancy vulnerability has been reported to affect QuRouter

A cross-site scripting (XSS) vulnerability has been reported to affect Network & Virtual Switch

A time-of-check time-of-use (toctou) race condition vulnerability has been reported to affect QuRouter

An external control of system or configuration setting vulnerability has been reported to affect QuRouter

A path traversal vulnerability has been reported to affect Video Station

A path traversal vulnerability has been reported to affect Video Station

From the blog

VulnSea has moved to vulnsea.com (and what changed since September)

What's new: open corpus, three new MCP tools, vendor advisories, package pages

Wiring VulnSea into an agent: a hands-on tutorial