Live CVE & 0day intelligence

Sound the depths of every vulnerability.

Newly released CVEs across every platform — sleek to read, verbose on demand, and served raw as markdown for AI and agent ingestion. Severity reads as depth: the deeper the contact, the graver the threat.

Browse the feed For agents → /llms.txt

Depth = severity + exploitation

HadalCritical and actively exploited (CISA KEV / 0day)
AbyssalCritical with a public exploit or in-the-wild use
MidnightCritical, or high with PoC / in-the-wild
TwilightHigh severity, or a signal on a lesser flaw
SunlitLow / medium · no exploitation signal

69273

Tracked CVEs

6428

Critical

701

Exploited in wild

4740

Last 7 days

Trending now

Bluesky + Hacker News mentions, last 7 days

1CVE-2026-109618Critical· 9.2RCE via OOM corruption4896
2CVE-2026-109619Critical· 9.2RCE via stale global state2196
3CVE-2026-111497Critical· 9.2Out-of-Bounds Write in Google Brotli Decoder1587
4CVE-2026-99999Critical· 9.3In the Linux kernel, the following vulnerability has been resolved: ipv4: validate checksum_start before completing checksum If a packet with bad checksum metadata gets into the ipv4 stack, skb_checksum_help can corrupt the network hea…963
5CVE-2026-110264Critical· 10.0Integer Overflow or Wraparound in GitLab267
6CVE-2026-108707Critical· 9.8Wukong_HRM through commit 186115e contains an authentication bypass vulnerability in ParamAspect that allows unauthenticated attackers to call every HRM API endpoint by omitting the AUTH-TOKEN header266

This week's digest →All digests

Feed

16 matches

CVE-2026-43891High· 7.5

5mo ago

changedetection.io has an Arbitrary Local File Read via a crafted backup restore

▾ Twilightchangedetection-io · changedetection-ioEPSS 0.35%via OSV

CVE-2026-35000None

7mo ago

ChangeDetection.io versions prior to 0.54.7 contain a protection bypass vulnerability in the SafeXPath3Parser implementation that allows …

ChangeDetection.io versions prior to 0.54.7 contain a protection bypass vulnerability in the SafeXPath3Parser implementation that allows attackers to read arbitrary local files by using unblocked XPath 3.0/3.1 functions such as json-doc(…

▾ Sunlitchangedetection-io · changedetection-ioEPSS 0.28%via OSV

CVE-2026-33981High

7mo ago

Changedetection.io Discloses Environment Variables via jq env Builtin in Include Filters

▾ Twilightchangedetection-io · changedetection-ioEPSS 0.48%via OSV

CVE-2026-29038Medium· 6.1

7mo ago

changedetection.io has Reflected XSS in its RSS Tag Error Response

▾ Sunlitchangedetection-io · changedetection-ioEPSS 0.29%via OSV

CVE-2026-29039High

7mo ago

changedetection.io vulnerable to XPath - Arbitrary File Read via unparsed-text()

▾ Twilightchangedetection-io · changedetection-ioEPSS 0.50%via OSV

CVE-2026-29065High

7mo ago

changedetection.io has Zip Slip vulnerability in the backup restore functionality

▾ Twilightchangedetection-io · changedetection-ioEPSS 0.55%via OSV

CVE-2026-27645Medium· 6.1PoC

8mo ago

changedetection.io Vulnerable to Reflected XSS in RSS Single Watch Error Response

▾ Twilightchangedetection-io · changedetection-ioEPSS 0.50%via OSV

CVE-2026-27696High· 8.6

8mo ago

changedetection.io is Vulnerable to SSRF via Watch URLs

▾ Twilightchangedetection-io · changedetection-ioEPSS 0.50%via OSV

CVE-2026-25527Medium· 5.3PoC

8mo ago

changedetection.io is a free open source web page change detection tool. In versions prior to 0.53.2, the `/static/<group>/<filename>` ro…

changedetection.io is a free open source web page change detection tool. In versions prior to 0.53.2, the `/static/<group>/<filename>` route accepts `group=".."`, which causes `send_from_directory("static/..", filename)` to execute. This…

▾ Twilightchangedetection-io · changedetection-ioEPSS 1.0%via OSV

CVE-2025-52558High

1y ago

ChangeDetection.io XSS in watch overview

▾ Twilightchangedetection-io · changedetection-ioEPSS 0.59%via OSV

CVE-2024-56509High· 8.6

1y ago

changedetection.io Vulnerable to Improper Input Validation Leading to LFR/Path Traversal

▾ Twilightchangedetection-io · changedetection-ioEPSS 0.71%via OSV

CVE-2024-51998High· 8.6

1y ago

changedetection.io path traversal using file URI scheme without supplying hostname

▾ Twilightchangedetection-io · changedetection-ioEPSS 0.69%via OSV

CVE-2024-51483Medium· 6.5PoC

1y ago

changedetection.io Path Traversal

▾ Twilightchangedetection-io · changedetection-ioEPSS 2.3%via OSV

CVE-2024-32651Critical· 10.0PoC

2y ago

changedetection.io has a Server Side Template Injection using Jinja2 which allows Remote Command Execution

▾ Abyssalchangedetection-io · changedetection-ioEPSS 84%via OSV

CVE-2024-34061Medium· 4.3PoC

2y ago

changedetection.io Cross-site Scripting vulnerability

▾ Twilightchangedetection-io · changedetection-ioEPSS 1.3%via OSV

CVE-2024-23329Low· 3.7

2y ago

changedetection.io API endpoint is not secured with API token

▾ Sunlitchangedetection-io · changedetection-ioEPSS 0.59%via OSV

From the blog

All posts →

Oct 27, 2026

Sound the depths of every vulnerability.

Trending now

Feed

changedetection.io has an Arbitrary Local File Read via a crafted backup restore

ChangeDetection.io versions prior to 0.54.7 contain a protection bypass vulnerability in the SafeXPath3Parser implementation that allows …

Changedetection.io Discloses Environment Variables via jq env Builtin in Include Filters

changedetection.io has Reflected XSS in its RSS Tag Error Response

changedetection.io vulnerable to XPath - Arbitrary File Read via unparsed-text()

changedetection.io has Zip Slip vulnerability in the backup restore functionality

changedetection.io Vulnerable to Reflected XSS in RSS Single Watch Error Response

changedetection.io is Vulnerable to SSRF via Watch URLs

changedetection.io is a free open source web page change detection tool. In versions prior to 0.53.2, the `/static/<group>/<filename>` ro…

ChangeDetection.io XSS in watch overview

changedetection.io Vulnerable to Improper Input Validation Leading to LFR/Path Traversal

changedetection.io path traversal using file URI scheme without supplying hostname

changedetection.io Path Traversal

changedetection.io has a Server Side Template Injection using Jinja2 which allows Remote Command Execution

changedetection.io Cross-site Scripting vulnerability

changedetection.io API endpoint is not secured with API token

From the blog

VulnSea has moved to vulnsea.com (and what changed since September)

What's new: open corpus, three new MCP tools, vendor advisories, package pages

Wiring VulnSea into an agent: a hands-on tutorial

Sound the depths of every vulnerability.

Trending now

Feed

changedetection.io has an Arbitrary Local File Read via a crafted backup restore

ChangeDetection.io versions prior to 0.54.7 contain a protection bypass vulnerability in the SafeXPath3Parser implementation that allows …

Changedetection.io Discloses Environment Variables via jq env Builtin in Include Filters

changedetection.io has Reflected XSS in its RSS Tag Error Response

changedetection.io vulnerable to XPath - Arbitrary File Read via unparsed-text()

changedetection.io has Zip Slip vulnerability in the backup restore functionality

changedetection.io Vulnerable to Reflected XSS in RSS Single Watch Error Response

changedetection.io is Vulnerable to SSRF via Watch URLs

changedetection.io is a free open source web page change detection tool. In versions prior to 0.53.2, the `/static/<group>/<filename>` ro…

ChangeDetection.io XSS in watch overview

changedetection.io Vulnerable to Improper Input Validation Leading to LFR/Path Traversal

changedetection.io path traversal using file URI scheme without supplying hostname

changedetection.io Path Traversal

changedetection.io has a Server Side Template Injection using Jinja2 which allows Remote Command Execution

changedetection.io Cross-site Scripting vulnerability

changedetection.io API endpoint is not secured with API token

From the blog

VulnSea has moved to vulnsea.com (and what changed since September)

What's new: open corpus, three new MCP tools, vendor advisories, package pages

Wiring VulnSea into an agent: a hands-on tutorial