Live CVE & 0day intelligence

Sound the depths of every vulnerability.

Newly released CVEs across every platform — sleek to read, verbose on demand, and served raw as markdown for AI and agent ingestion. Severity reads as depth: the deeper the contact, the graver the threat.

Browse the feed For agents → /llms.txt

Depth = severity + exploitation

HadalCritical and actively exploited (CISA KEV / 0day)
AbyssalCritical with a public exploit or in-the-wild use
MidnightCritical, or high with PoC / in-the-wild
TwilightHigh severity, or a signal on a lesser flaw
SunlitLow / medium · no exploitation signal

68673

Tracked CVEs

6383

Critical

701

Exploited in wild

6071

Last 7 days

Trending now

Bluesky + Hacker News mentions, last 7 days

1CVE-2026-109618Critical· 9.2RCE via OOM corruption4896
2CVE-2026-109619Critical· 9.2RCE via stale global state2196
3CVE-2026-111497Critical· 9.2Out-of-Bounds Write in Google Brotli Decoder1280
4CVE-2026-99999Critical· 9.3In the Linux kernel, the following vulnerability has been resolved: ipv4: validate checksum_start before completing checksum If a packet with bad checksum metadata gets into the ipv4 stack, skb_checksum_help can corrupt the network hea…863
5CVE-2026-110264Critical· 10.0Integer Overflow or Wraparound in GitLab267
6CVE-2026-108707Critical· 9.8Wukong_HRM through commit 186115e contains an authentication bypass vulnerability in ParamAspect that allows unauthenticated attackers to call every HRM API endpoint by omitting the AUTH-TOKEN header266

This week's digest →All digests

Feed

11 matches

CVE-2026-116620High· 7.3PoC

today

Tencent RapidJSON Regex stream.h Take out-of-bounds

A security vulnerability has been detected in Tencent RapidJSON up to 1.1.0. This issue affects the function GenericStringStream<UTF8<char>>::Take in the library include/rapidjson/stream.h of the component Regex Parser. The manipulation …

▾ MidnightTencent · RapidJSONEPSS 0.30%via CVEORG

CVE-2026-112074Medium· 6.3PoC

1w ago

Tencent ncnn Conversion API mat_pixel.cpp yuv420sp2rgb integer overflow

A security flaw has been discovered in Tencent ncnn up to 44b02dabdcf97499281a4692ebd65bad73dcf8b6. Affected by this issue is the function ncnn::yuv420sp2rgb of the file src/mat_pixel.cpp of the component Conversion API. The manipulation…

▾ TwilightTencent · ncnnEPSS 0.24%via CVEORG

CVE-2026-112073Medium· 6.3PoC

1w ago

Tencent ncnn MatMul matmul.cpp matmul_transb out-of-bounds

A vulnerability was identified in Tencent ncnn up to 44b02dabdcf97499281a4692ebd65bad73dcf8b6. Affected by this vulnerability is the function matmul_transb of the file src/layer/matmul.cpp of the component MatMul. The manipulation leads …

▾ TwilightTencent · ncnnEPSS 0.24%via CVEORG

CVE-2026-108821Medium· 6.3PoC

2w ago

A security vulnerability has been detected in Tencent WeKnora up to 0.8.1

A security vulnerability has been detected in Tencent WeKnora up to 0.8.1. Impacted is the function validateSubquery of the file internal/utils/inject.go of the component SQL Validator. The manipulation leads to sql injection. The attack…

▾ TwilightTencent · WeKnoraEPSS 0.24%via NVD

CVE-2026-101080Medium· 4.8PoC

4w ago

A vulnerability was identified in Tencent AI-Infra-Guard up to 4.5.2/4.6.2

A vulnerability was identified in Tencent AI-Infra-Guard up to 4.5.2/4.6.2. This affects the function startsWith of the file skill_scan/tools/dir/dir_actions.py of the component File Access. The manipulation leads to path traversal. The …

▾ TwilightTencent · AI-Infra-GuardEPSS 0.14%via NVD

CVE-2026-94111Medium· 6.6

1mo ago

Tencent BrowserSkill through 0.3.0 contains an authentication bypass vulnerability in the local daemon WebSocket origin validation that accepts any chrome-extension origin with 32 characters in range a-p

Tencent BrowserSkill through 0.3.0 contains an authentication bypass vulnerability in the local daemon WebSocket origin validation that accepts any chrome-extension origin with 32 characters in range a-p. Attackers can register a malicio…

▾ SunlitTencent · BrowserSkillEPSS 0.14%via NVD

CVE-2026-89040Critical· 9.8

1mo ago

Tencent Mass Service Engine in Cluster (MSEC) allows a remote, unauthenticated attacker to send a crafted POST request including ../ and gain root access on the target device

Tencent Mass Service Engine in Cluster (MSEC) allows a remote, unauthenticated attacker to send a crafted POST request including ../ and gain root access on the target device. An attacker who uploads a webshell can execute arbitrary code…

▾ MidnightTencent · Mass Service Engine in Cluster (MSEC)EPSS 1.1%via NVD

CVE-2026-91750Medium· 6.5PoC

1mo ago

WeKnora before 0.7.0 fails to re-validate HTTP redirect targets in the POST /api/v1/knowledge-bases/:id/knowledge/url endpoint when downloading documents from user-supplied URLs

WeKnora before 0.7.0 fails to re-validate HTTP redirect targets in the POST /api/v1/knowledge-bases/:id/knowledge/url endpoint when downloading documents from user-supplied URLs. Authenticated attackers can bypass initial SSRF validation…

▾ TwilightTencent · WeKnoraEPSS 0.44%via NVD

CVE-2026-84809Medium· 6.5PoC

1mo ago

Tencent AI-Infra-Guard's skill-scan component excludes compiled Python bytecode files from analysis by hardcoding pycache directories and .pyc/.pyo/.pyd extensions into skip lists across multiple scanning surfaces

Tencent AI-Infra-Guard's skill-scan component excludes compiled Python bytecode files from analysis by hardcoding __pycache__ directories and .pyc/.pyo/.pyd extensions into skip lists across multiple scanning surfaces. Attackers can dist…

▾ TwilightTencent · AI-Infra-GuardEPSS 0.57%via NVD

CVE-2026-8786Medium· 6.3

5mo ago

A vulnerability has been found in Tencent WeKnora up to 0.3.6

A vulnerability has been found in Tencent WeKnora up to 0.3.6. Affected by this issue is the function getKnowledgeBaseForInitialization of the file internal/handler/initialization.go of the component Config API Endpoint. The manipulation…

▾ Sunlittencent · weknoraEPSS 0.27%via NVD

CVE-2025-11046High· 7.3

1y ago

A security flaw has been discovered in Tencent WeKnora 0.1.0

A security flaw has been discovered in Tencent WeKnora 0.1.0. This impacts the function testEmbeddingModel of the file /api/v1/initialization/embedding/test. The manipulation of the argument baseUrl results in server-side request forgery…

▾ Twilighttencent · weknoraEPSS 0.47%via NVD

From the blog

All posts →

Oct 27, 2026

Sound the depths of every vulnerability.

Trending now

Feed

Tencent RapidJSON Regex stream.h Take out-of-bounds

Tencent ncnn Conversion API mat_pixel.cpp yuv420sp2rgb integer overflow

Tencent ncnn MatMul matmul.cpp matmul_transb out-of-bounds

A security vulnerability has been detected in Tencent WeKnora up to 0.8.1

A vulnerability was identified in Tencent AI-Infra-Guard up to 4.5.2/4.6.2

Tencent BrowserSkill through 0.3.0 contains an authentication bypass vulnerability in the local daemon WebSocket origin validation that accepts any chrome-extension origin with 32 characters in range a-p

Tencent Mass Service Engine in Cluster (MSEC) allows a remote, unauthenticated attacker to send a crafted POST request including ../ and gain root access on the target device

WeKnora before 0.7.0 fails to re-validate HTTP redirect targets in the POST /api/v1/knowledge-bases/:id/knowledge/url endpoint when downloading documents from user-supplied URLs

Tencent AI-Infra-Guard's skill-scan component excludes compiled Python bytecode files from analysis by hardcoding pycache directories and .pyc/.pyo/.pyd extensions into skip lists across multiple scanning surfaces

A vulnerability has been found in Tencent WeKnora up to 0.3.6

A security flaw has been discovered in Tencent WeKnora 0.1.0

From the blog

VulnSea has moved to vulnsea.com (and what changed since September)

What's new: open corpus, three new MCP tools, vendor advisories, package pages

Wiring VulnSea into an agent: a hands-on tutorial

Sound the depths of every vulnerability.

Trending now

Feed

Tencent RapidJSON Regex stream.h Take out-of-bounds

Tencent ncnn Conversion API mat_pixel.cpp yuv420sp2rgb integer overflow

Tencent ncnn MatMul matmul.cpp matmul_transb out-of-bounds

A security vulnerability has been detected in Tencent WeKnora up to 0.8.1

A vulnerability was identified in Tencent AI-Infra-Guard up to 4.5.2/4.6.2

Tencent BrowserSkill through 0.3.0 contains an authentication bypass vulnerability in the local daemon WebSocket origin validation that accepts any chrome-extension origin with 32 characters in range a-p

Tencent Mass Service Engine in Cluster (MSEC) allows a remote, unauthenticated attacker to send a crafted POST request including ../ and gain root access on the target device

WeKnora before 0.7.0 fails to re-validate HTTP redirect targets in the POST /api/v1/knowledge-bases/:id/knowledge/url endpoint when downloading documents from user-supplied URLs

Tencent AI-Infra-Guard's skill-scan component excludes compiled Python bytecode files from analysis by hardcoding pycache directories and .pyc/.pyo/.pyd extensions into skip lists across multiple scanning surfaces

A vulnerability has been found in Tencent WeKnora up to 0.3.6

A security flaw has been discovered in Tencent WeKnora 0.1.0

From the blog

VulnSea has moved to vulnsea.com (and what changed since September)

What's new: open corpus, three new MCP tools, vendor advisories, package pages

Wiring VulnSea into an agent: a hands-on tutorial