Live CVE & 0day intelligence

Sound the depths of every vulnerability.

Newly released CVEs across every platform — sleek to read, verbose on demand, and served raw as markdown for AI and agent ingestion. Severity reads as depth: the deeper the contact, the graver the threat.

Browse the feed For agents → /llms.txt

Depth = severity + exploitation

HadalCritical and actively exploited (CISA KEV / 0day)
AbyssalCritical with a public exploit or in-the-wild use
MidnightCritical, or high with PoC / in-the-wild
TwilightHigh severity, or a signal on a lesser flaw
SunlitLow / medium · no exploitation signal

68753

Tracked CVEs

6386

Critical

701

Exploited in wild

4937

Last 7 days

Trending now

Bluesky + Hacker News mentions, last 7 days

1CVE-2026-109618Critical· 9.2RCE via OOM corruption4896
2CVE-2026-109619Critical· 9.2RCE via stale global state2196
3CVE-2026-111497Critical· 9.2Out-of-Bounds Write in Google Brotli Decoder1580
4CVE-2026-99999Critical· 9.3In the Linux kernel, the following vulnerability has been resolved: ipv4: validate checksum_start before completing checksum If a packet with bad checksum metadata gets into the ipv4 stack, skb_checksum_help can corrupt the network hea…863
5CVE-2026-110264Critical· 10.0Integer Overflow or Wraparound in GitLab267
6CVE-2026-108707Critical· 9.8Wukong_HRM through commit 186115e contains an authentication bypass vulnerability in ParamAspect that allows unauthenticated attackers to call every HRM API endpoint by omitting the AUTH-TOKEN header266

This week's digest →All digests

Feed

11 matches

CVE-2026-88264Medium· 5.6

1mo ago

A flaw was found in crun

A flaw was found in crun. When the container configuration does not give /dev a dedicated mount, terminal setup can redirect /dev/console onto an attacker-controlled path, including via the read-only-rootfs bind-mount fallback. Affected …

▾ Sunlitcontainers · crunEPSS 0.12%via NVD

CVE-2026-44517Medium· 6.3

2mo ago

Buildah is a tool that facilitates building OCI images

Buildah is a tool that facilitates building OCI images. From 1.38.1 until 1.43.2 and 1.44.0, TempDirForURL in define/types.go does not securely confine Git repository subdirectories to the downloaded build context, and downloadToDirector…

▾ Sunlitcontainers · github.com/containers/buildahEPSS 0.18%via NVD

CVE-2026-55686Medium· 5.3

4mo ago

Podman: WORKDIR symlink traversal vulnerability

▾ Sunlitcontainers · github.com/containers/podman/v5EPSS 0.40%via GHSA

CVE-2025-6032High· 8.3

1y ago

A flaw was found in Podman

A flaw was found in Podman. The podman machine init command fails to verify the TLS certificate when downloading the VM images from an OCI registry. This issue results in a Man In The Middle attack.

▾ Twilightcontainers · github.com/containers/podman/v4EPSS 0.52%via NVD

CVE-2024-11218High· 8.6

1y ago

A vulnerability was found in `podman build` and `buildah.` This issue occurs in a container breakout by using --jobs=2 and a race condition when building a malicious Containerfile

A vulnerability was found in `podman build` and `buildah.` This issue occurs in a container breakout by using --jobs=2 and a race condition when building a malicious Containerfile. SELinux might mitigate it, but even with SELinux on, it …

▾ Twilightcontainers · github.com/containers/buildahEPSS 0.36%via NVD

CVE-2024-9341Medium· 5.4

2y ago

A flaw was found in Go

A flaw was found in Go. When FIPS mode is enabled on a system, container runtimes may incorrectly handle certain file paths due to improper validation in the containers/common Go library. This flaw allows an attacker to exploit symbolic …

▾ Sunlitcontainers · commonEPSS 1.0%via NVD

CVE-2024-8418High· 7.5

2y ago

A flaw was found in Aardvark-dns, which is vulnerable to a Denial of Service attack due to the serial processing of TCP DNS queries

A flaw was found in Aardvark-dns, which is vulnerable to a Denial of Service attack due to the serial processing of TCP DNS queries. An attacker can exploit this flaw by keeping a TCP connection open indefinitely, causing the server to b…

▾ Twilightcontainers · aardvark-dnsEPSS 0.81%via NVD

CVE-2022-1227High· 8.8PoC

4y ago

Buildah processes using chroot isolation may leak environment values to intermediate processes

▾ Sunlitcontainers · github.com/containers/buildahEPSS 0.33%via OSV

From the blog

All posts →

Oct 27, 2026

Sound the depths of every vulnerability.

Trending now

Feed

A flaw was found in crun

Buildah is a tool that facilitates building OCI images

Podman: WORKDIR symlink traversal vulnerability

A flaw was found in Podman

A vulnerability was found in `podman build` and `buildah.` This issue occurs in a container breakout by using --jobs=2 and a race condition when building a malicious Containerfile

A flaw was found in Go

A flaw was found in Aardvark-dns, which is vulnerable to a Denial of Service attack due to the serial processing of TCP DNS queries

Podman publishes a malicious image to public registries

Podman's default inheritable capabilities for linux container not empty

Non-empty default inheritable capabilities for linux container in Buildah

Buildah processes using chroot isolation may leak environment values to intermediate processes

From the blog

VulnSea has moved to vulnsea.com (and what changed since September)

What's new: open corpus, three new MCP tools, vendor advisories, package pages

Wiring VulnSea into an agent: a hands-on tutorial

Sound the depths of every vulnerability.

Trending now

Feed

A flaw was found in crun

Buildah is a tool that facilitates building OCI images

Podman: WORKDIR symlink traversal vulnerability

A flaw was found in Podman

A vulnerability was found in `podman build` and `buildah.` This issue occurs in a container breakout by using --jobs=2 and a race condition when building a malicious Containerfile

A flaw was found in Go

A flaw was found in Aardvark-dns, which is vulnerable to a Denial of Service attack due to the serial processing of TCP DNS queries

Podman publishes a malicious image to public registries

Podman's default inheritable capabilities for linux container not empty

Non-empty default inheritable capabilities for linux container in Buildah

Buildah processes using chroot isolation may leak environment values to intermediate processes

From the blog

VulnSea has moved to vulnsea.com (and what changed since September)

What's new: open corpus, three new MCP tools, vendor advisories, package pages

Wiring VulnSea into an agent: a hands-on tutorial