Live CVE & 0day intelligence

Sound the depths of every vulnerability.

Newly released CVEs across every platform — sleek to read, verbose on demand, and served raw as markdown for AI and agent ingestion. Severity reads as depth: the deeper the contact, the graver the threat.

Browse the feed For agents → /llms.txt

Depth = severity + exploitation

HadalCritical and actively exploited (CISA KEV / 0day)
AbyssalCritical with a public exploit or in-the-wild use
MidnightCritical, or high with PoC / in-the-wild
TwilightHigh severity, or a signal on a lesser flaw
SunlitLow / medium · no exploitation signal

72782

Tracked CVEs

6850

Critical

764

Exploited in wild

3403

Last 7 days

Trending now

Bluesky + Hacker News mentions, last 7 days

1CVE-2026-109618Critical· 9.2RCE via OOM corruption4896
2CVE-2026-109619Critical· 9.2RCE via stale global state2196
3CVE-2026-111497Critical· 9.8Brotli: Out-of-bounds write in the Brotli decoder ("Node2Shell") also affects the PyPI Brotli package1895
4CVE-2026-99999Critical· 9.3In the Linux kernel, the following vulnerability has been resolved: ipv4: validate checksum_start before completing checksum If a packet with bad checksum metadata gets into the ipv4 stack, skb_checksum_help can corrupt the network hea…963
5CVE-2026-110264Critical· 10.0Integer Overflow or Wraparound in GitLab367
6CVE-2026-112816Critical· 10.0Improper certificate validation in the HTTPS listener in LXD367
7CVE-2026-116366Critical· 9.5Unauthenticated RCE vulnerability against ClickHouse Server364
8CVE-2026-97631Critical· 9.5Pre-boot RCE in EDK II PXE driver264

This week's digest →All digests

Feed

13 matches

CVE-2026-120091High· 8.7

3d ago

Temporal Server Kubernetes compute provider builds a client from caller-supplied configuration and runs a caller-chosen command on the Worker Service host

Temporal Server compiles a Worker Controller Instance module, go.temporal.io/auto-scaled-workers, into its Worker Service, and that module registers a compute provider named k8s whose function is to manage workers running in a Kubernetes…

▾ TwilightTemporal Technologies, Inc. · go.temporal.io/serverEPSS 0.48%via CVEORG

CVE-2026-108126Medium· 6.0

3w ago

temporal-proxy 0.2.0 through 0.8.0 does not bind encrypted payloads to the namespace they were encrypted for

temporal-proxy 0.2.0 through 0.8.0 does not bind encrypted payloads to the namespace they were encrypted for. When payload encryption is enabled, the proxy chooses the decryption key by an identifier stored in the payload rather than by …

▾ SunlitTemporal Technologies, Inc. · github.com/temporalio/temporal-proxyEPSS 0.36%via NVD

CVE-2026-89140Medium· 6.0

3w ago

Temporal Server does not bind internal completion callbacks to the namespace that attached them, which allows an authenticated caller with write permission in one namespace to alter Scheduler V2 schedule state in another namespace

Temporal Server does not bind internal completion callbacks to the namespace that attached them, which allows an authenticated caller with write permission in one namespace to alter Scheduler V2 schedule state in another namespace. The c…

▾ SunlitTemporal Technologies, Inc. · go.temporal.io/serverEPSS 0.33%via NVD

CVE-2026-104355High· 7.0

3w ago

A connected peer cluster can modify a Temporal Server cluster's local namespaces, which are never replicated to that peer, because the receiving cluster applies inbound namespace replication updates to them

A connected peer cluster can modify a Temporal Server cluster's local namespaces, which are never replicated to that peer, because the receiving cluster applies inbound namespace replication updates to them. In a multi-cluster deployment…

▾ TwilightTemporal Technologies, Inc. · go.temporal.io/serverEPSS 0.36%via NVD

CVE-2026-96770Critical· 9.3

1mo ago

All published s2s-proxy versions through 0.2.2 are affected

All published s2s-proxy versions through 0.2.2 are affected. In versions 0.1.16 through 0.2.2, TLS server listeners use Go's RequireAnyClientCert mode when skipCAVerification is false. This mode checks that the client holds the certifica…

▾ MidnightTemporal Technologies, Inc. · github.com/temporalio/s2s-proxyEPSS 0.32%via NVD

CVE-2026-89139High· 8.7

1mo ago

Temporal Server compiles a Worker Controller Instance module into its Worker Service, and that module registers a compute provider named subprocess whose function is to launch a worker by running a command on the machine hosting the Work…

Temporal Server compiles a Worker Controller Instance module into its Worker Service, and that module registers a compute provider named subprocess whose function is to launch a worker by running a command on the machine hosting the Work…

▾ TwilightTemporal Technologies, Inc. · go.temporal.io/serverEPSS 0.58%via NVD

CVE-2026-87858High· 7.2

1mo ago

Temporal Server decided whether a Workflow completion callback was internal by reading a caller-supplied HTTP header

Temporal Server decided whether a Workflow completion callback was internal by reading a caller-supplied HTTP header. An authenticated caller holding only write permission in a single namespace could attach a completion callback whose UR…

▾ TwilightTemporal Technologies, Inc. · go.temporal.io/serverEPSS 0.78%via NVD

CVE-2026-65654High· 8.7

1mo ago

github.com/temporalio/ringpop-go enforces configured LabelOptions limits when an application changes the local node's labels, but affected versions do not apply those limits to label maps received in SWIM membership changes

github.com/temporalio/ringpop-go enforces configured LabelOptions limits when an application changes the local node's labels, but affected versions do not apply those limits to label maps received in SWIM membership changes. A network pe…

▾ TwilightTemporal Technologies, Inc. · github.com/temporalio/ringpop-goEPSS 0.58%via NVD

CVE-2026-65653High· 8.7

1mo ago

github.com/temporalio/tchannel-go did not reject TChannel call fragments containing checksum metadata but no length-prefixed argument chunks

github.com/temporalio/tchannel-go did not reject TChannel call fragments containing checksum metadata but no length-prefixed argument chunks. The fragment reader left its chunk slice empty and then unconditionally selected the first elem…

▾ TwilightTemporal Technologies, Inc. · github.com/temporalio/tchannel-goEPSS 0.71%via NVD

CVE-2026-65652High· 8.7

1mo ago

github.com/temporalio/tchannel-go did not validate the one-byte checksum-type field in inbound TChannel call frames

github.com/temporalio/tchannel-go did not validate the one-byte checksum-type field in inbound TChannel call frames. A network peer that can reach a listener can complete the standard initialization handshake and send a call request with…

▾ TwilightTemporal Technologies, Inc. · github.com/temporalio/tchannel-goEPSS 0.71%via NVD

CVE-2026-65651High· 8.7

1mo ago

temporalio/sqlparser accepts SQL containing deeply nested unary expressions and can return a correspondingly deep abstract syntax tree without enforcing an applicable nesting limit

temporalio/sqlparser accepts SQL containing deeply nested unary expressions and can return a correspondingly deep abstract syntax tree without enforcing an applicable nesting limit. The library's String and Walk operations recursively tr…

▾ TwilightTemporal Technologies, Inc. · github.com/temporalio/sqlparserEPSS 0.67%via NVD

CVE-2026-16651High· 8.7

1mo ago

temporalio/sqlparser can panic when Parse, ParseStrictDDL, or ParseNext processes a MySQL version comment whose contents are empty or consist only of one to five decimal digits

temporalio/sqlparser can panic when Parse, ParseStrictDDL, or ParseNext processes a MySQL version comment whose contents are empty or consist only of one to five decimal digits. ExtractMysqlComment does not check the -1 result returned b…

▾ TwilightTemporal Technologies, Inc. · github.com/temporalio/sqlparserEPSS 0.53%via NVD

CVE-2026-16652High· 7.1

1mo ago

Temporal Server did not bound the work performed while searching for a Schedule's next action time

Temporal Server did not bound the work performed while searching for a Schedule's next action time. An authenticated caller with namespace write permission could create or update a Schedule that combines a fine-grained cadence with an ex…

▾ TwilightTemporal Technologies, Inc. · go.temporal.io/serverEPSS 0.47%via NVD

From the blog

All posts →

Oct 27, 2026

Sound the depths of every vulnerability.

Trending now

Feed

Temporal Server Kubernetes compute provider builds a client from caller-supplied configuration and runs a caller-chosen command on the Worker Service host

temporal-proxy 0.2.0 through 0.8.0 does not bind encrypted payloads to the namespace they were encrypted for

Temporal Server does not bind internal completion callbacks to the namespace that attached them, which allows an authenticated caller with write permission in one namespace to alter Scheduler V2 schedule state in another namespace

A connected peer cluster can modify a Temporal Server cluster's local namespaces, which are never replicated to that peer, because the receiving cluster applies inbound namespace replication updates to them

All published s2s-proxy versions through 0.2.2 are affected

Temporal Server compiles a Worker Controller Instance module into its Worker Service, and that module registers a compute provider named subprocess whose function is to launch a worker by running a command on the machine hosting the Work…

Temporal Server decided whether a Workflow completion callback was internal by reading a caller-supplied HTTP header

github.com/temporalio/ringpop-go enforces configured LabelOptions limits when an application changes the local node's labels, but affected versions do not apply those limits to label maps received in SWIM membership changes

github.com/temporalio/tchannel-go did not reject TChannel call fragments containing checksum metadata but no length-prefixed argument chunks

github.com/temporalio/tchannel-go did not validate the one-byte checksum-type field in inbound TChannel call frames

temporalio/sqlparser accepts SQL containing deeply nested unary expressions and can return a correspondingly deep abstract syntax tree without enforcing an applicable nesting limit

temporalio/sqlparser can panic when Parse, ParseStrictDDL, or ParseNext processes a MySQL version comment whose contents are empty or consist only of one to five decimal digits

Temporal Server did not bound the work performed while searching for a Schedule's next action time

From the blog

VulnSea has moved to vulnsea.com (and what changed since September)

What's new: open corpus, three new MCP tools, vendor advisories, package pages

Wiring VulnSea into an agent: a hands-on tutorial

Sound the depths of every vulnerability.

Trending now

Feed

Temporal Server Kubernetes compute provider builds a client from caller-supplied configuration and runs a caller-chosen command on the Worker Service host

temporal-proxy 0.2.0 through 0.8.0 does not bind encrypted payloads to the namespace they were encrypted for

Temporal Server does not bind internal completion callbacks to the namespace that attached them, which allows an authenticated caller with write permission in one namespace to alter Scheduler V2 schedule state in another namespace

A connected peer cluster can modify a Temporal Server cluster's local namespaces, which are never replicated to that peer, because the receiving cluster applies inbound namespace replication updates to them

All published s2s-proxy versions through 0.2.2 are affected

Temporal Server compiles a Worker Controller Instance module into its Worker Service, and that module registers a compute provider named subprocess whose function is to launch a worker by running a command on the machine hosting the Work…

Temporal Server decided whether a Workflow completion callback was internal by reading a caller-supplied HTTP header

github.com/temporalio/ringpop-go enforces configured LabelOptions limits when an application changes the local node's labels, but affected versions do not apply those limits to label maps received in SWIM membership changes

github.com/temporalio/tchannel-go did not reject TChannel call fragments containing checksum metadata but no length-prefixed argument chunks

github.com/temporalio/tchannel-go did not validate the one-byte checksum-type field in inbound TChannel call frames

temporalio/sqlparser accepts SQL containing deeply nested unary expressions and can return a correspondingly deep abstract syntax tree without enforcing an applicable nesting limit

temporalio/sqlparser can panic when Parse, ParseStrictDDL, or ParseNext processes a MySQL version comment whose contents are empty or consist only of one to five decimal digits

Temporal Server did not bound the work performed while searching for a Schedule's next action time

From the blog

VulnSea has moved to vulnsea.com (and what changed since September)

What's new: open corpus, three new MCP tools, vendor advisories, package pages

Wiring VulnSea into an agent: a hands-on tutorial