Live CVE & 0day intelligence

Sound the depths of every vulnerability.

Newly released CVEs across every platform — sleek to read, verbose on demand, and served raw as markdown for AI and agent ingestion. Severity reads as depth: the deeper the contact, the graver the threat.

Browse the feed For agents → /llms.txt

Depth = severity + exploitation

HadalCritical and actively exploited (CISA KEV / 0day)
AbyssalCritical with a public exploit or in-the-wild use
MidnightCritical, or high with PoC / in-the-wild
TwilightHigh severity, or a signal on a lesser flaw
SunlitLow / medium · no exploitation signal

70371

Tracked CVEs

6568

Critical

756

Exploited in wild

1051

Last 7 days

Trending now

Bluesky + Hacker News mentions, last 7 days

1CVE-2026-109618Critical· 9.2RCE via OOM corruption4896
2CVE-2026-109619Critical· 9.2RCE via stale global state2196
3CVE-2026-111497Critical· 9.8Brotli: Out-of-bounds write in the Brotli decoder ("Node2Shell") also affects the PyPI Brotli package1895
4CVE-2026-99999Critical· 9.3In the Linux kernel, the following vulnerability has been resolved: ipv4: validate checksum_start before completing checksum If a packet with bad checksum metadata gets into the ipv4 stack, skb_checksum_help can corrupt the network hea…963
5CVE-2026-110264Critical· 10.0Integer Overflow or Wraparound in GitLab367
6CVE-2026-91403Critical· 9.1Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JSSE)262

This week's digest →All digests

Feed

36 matches

CVE-2026-21157High· 8.3

1w ago

Improper input validation in Bixby prior to version 4.0.85.6 allows privileged local attackers to launch arbitrary activity.

▾ TwilightSamsung Mobile · BixbyEPSS 0.11%via CVEORG

CVE-2026-21139High· 7.3

3w ago

Improper access control in Samsung Continuity Service for windows prior to version 4.6.1217.0 allows adjacent attackers to manipulate the connected mobile device.

▾ TwilightSamsung Mobile · Samsung Continuity Service for windowsEPSS 0.12%via NVD

CVE-2026-21138Medium· 6.9

3w ago

Insufficient verification of data authenticity in Smart Switch prior to version 3.7.73 allows physical attackers to install arbitrary applications.

▾ SunlitSamsung Mobile · Smart SwitchEPSS 0.10%via NVD

CVE-2026-21137Medium· 5.1

3w ago

Path traversal in Smart Switch prior to version 3.7.73 allows physical attackers to access files with Smart Switch privilege.

▾ SunlitSamsung Mobile · Smart SwitchEPSS 0.17%via NVD

CVE-2026-21136Medium· 6.8

3w ago

Improper authorization in Smart Switch prior to version 3.7.73 allows physical attackers to invoke application restore process.

▾ SunlitSamsung Mobile · Smart SwitchEPSS 0.14%via NVD

CVE-2026-21135Medium· 5.9

3w ago

Improper access control in Samsung Internet prior to version 30.0.5.6 allows local attackers to access sensitive information.

▾ SunlitSamsung Mobile · Samsung InternetEPSS 0.10%via NVD

CVE-2026-21134Medium· 6.1

3w ago

Improper authentication in Samsung Flow prior to version 4.9.22.4 allows adjacent attackers to access sensitive information.

▾ SunlitSamsung Mobile · Samsung FlowEPSS 0.19%via NVD

CVE-2026-21133Medium· 5.1

3w ago

Path traversal in Samsung Flow prior to version 4.9.22.1 allows local attackers to access clipboard data.

▾ SunlitSamsung Mobile · Samsung FlowEPSS 0.14%via NVD

CVE-2026-21132Medium· 6.0

3w ago

Improper input validation in Samsung Internet prior to version 30.0.5.24 allows remote attackers to inject arbitrary script

Improper input validation in Samsung Internet prior to version 30.0.5.24 allows remote attackers to inject arbitrary script. User interaction is required for triggering this vulnerability.

▾ SunlitSamsung Mobile · Samsung InternetEPSS 0.31%via NVD

CVE-2026-21131Low· 2.1

3w ago

Incorrect default permission in Samsung Flow prior to version 4.9.22.4 allows local attackers to launch an arbitrary activity with Samsung Flow privileges on the connected device.

▾ SunlitSamsung Mobile · Samsung FlowEPSS 0.10%via NVD

CVE-2026-21130Medium· 5.1

3w ago

Improper input validation in CreditCardRetrieveActivity of Samsung Checkout prior to version 5.1.03.1 allows local attackers to launch an arbitrary activity with Samsung Checkout privileges.

▾ SunlitSamsung Mobile · Samsung CheckoutEPSS 0.11%via NVD

CVE-2026-21129Medium· 5.1

3w ago

Improper input validation in GuestCreditCardRegisterActivity of Samsung Checkout prior to version 5.1.03.1 allows local attackers to launch an arbitrary activity with Samsung Checkout privileges.

▾ SunlitSamsung Mobile · Samsung CheckoutEPSS 0.11%via NVD

CVE-2026-21128Medium· 5.1

3w ago

Improper input validation in CreditCardRegisterActivity of Samsung Checkout prior to version 5.1.03.1 allows local attackers to launch arbitrary activity with Samsung Checkout privileges.

▾ SunlitSamsung Mobile · Samsung CheckoutEPSS 0.12%via NVD

CVE-2026-21127Medium· 6.9

3w ago

Improper export of android application components in Samsung Account prior to version 15.7.01.1 allows local attackers to access sensitive data.

▾ SunlitSamsung Mobile · Samsung AccountEPSS 0.11%via NVD

CVE-2026-21126Medium· 6.9

3w ago

Improper input validation in getting cover image in libsimba.heifdec.media.samsung.so prior to SMR Oct-2026 Release 1 allows local attackers to write out-of-bounds memory.

▾ SunlitSamsung Mobile · Samsung Mobile DevicesEPSS 0.12%via NVD

CVE-2026-21125High· 8.6

3w ago

Improper input validation in parsing sheifd in libsimba.heifdec.media.samsung.so prior to SMR Oct-2026 Release 1 allows local attackers to potentially execute arbitrary code.

▾ TwilightSamsung Mobile · Samsung Mobile DevicesEPSS 0.12%via NVD

CVE-2026-21124High· 8.6

3w ago

Improper input validation in getting cover image in libsimba.heifdec.media.samsung.so prior to SMR Oct-2026 Release 1 allows local attackers to potentially execute arbitrary code.

▾ TwilightSamsung Mobile · Samsung Mobile DevicesEPSS 0.12%via NVD

CVE-2026-21123Medium· 6.7

3w ago

Improper privilege management in Locksettings prior to SMR Oct-2026 Release 1 allows local privileged attackers with root privilege to access data of the tied profile in before first unlock.

▾ SunlitSamsung Mobile · Samsung Mobile DevicesEPSS 0.11%via NVD

CVE-2026-21122High· 7.0

3w ago

Out-of-bounds write in libsamsungtts.so prior to SMR Oct-2026 Release 1 allows local attackers to execute arbitrary code.

▾ TwilightSamsung Mobile · Samsung Mobile DevicesEPSS 0.13%via NVD

CVE-2026-21121Medium· 6.9

3w ago

Improper handling of insufficient permission in CmcCore prior to SMR Oct-2026 Release 1 allows local attackers to use the privileged APIs.

▾ SunlitSamsung Mobile · Samsung Mobile DevicesEPSS 0.11%via NVD

CVE-2026-21120High· 8.9

3w ago

Use after free in WSM service prior to SMR Oct-2026 Release 1 allows local attackers to potentially execute arbitrary code with system privilege.

▾ TwilightSamsung Mobile · Samsung Mobile DevicesEPSS 0.12%via NVD

CVE-2026-21119Medium· 4.8

3w ago

Out-of-bounds read and write in lib_sag_ai_sound_sep_v2.00.so prior to SMR Oct-2026 Release 1 allows local attackers to read and write out-of-bounds memory.

▾ SunlitSamsung Mobile · Samsung Mobile DevicesEPSS 0.11%via NVD

CVE-2026-21118Medium· 6.9

3w ago

Improper access control in DownloadProvider prior to SMR Oct-2026 Release 1 allows local attackers to access files in scoped storage.

▾ SunlitSamsung Mobile · Samsung Mobile DevicesEPSS 0.10%via NVD

CVE-2026-21117Medium· 5.1

3w ago

Improper access control in CocktailBarService prior to SMR Oct-2026 Release 1 allows local attackers to access sensitive information.

▾ SunlitSamsung Mobile · Samsung Mobile DevicesEPSS 0.11%via NVD

CVE-2026-21116Medium· 5.1

3w ago

Out-of-bounds write in libsmkvextractor.so prior to SMR Oct-2026 Release 1 allows local attackers to write out-of-bounds memory.

▾ SunlitSamsung Mobile · Samsung Mobile DevicesEPSS 0.12%via NVD

From the blog

All posts →

Oct 27, 2026

VulnSea has moved to vulnsea.com (and what changed since September)

The beta is over. VulnSea now runs at vulnsea.com, every old beta link redirects to the same page, and your account, API keys and watchlists came with it. Plus a round of hardening, faster pages, and new request limits agents should know about.

Sep 8, 2026

What's new: open corpus, three new MCP tools, vendor advisories, package pages

A summary of everything that shipped over the last two weeks — the whole corpus is open, agents get change feeds, alias resolution and EPSS movers, and the data now includes CVE.org, vendor CSAF, aggregated exploits and per-source scores.

Jul 1, 2026

Wiring VulnSea into an agent: a hands-on tutorial

A step-by-step guide to plugging VulnSea into automated and agentic workflows — poll the delta, triage without burning tokens, match an SBOM, and let an MCP-native model do the reasoning.