Live CVE & 0day intelligence

Sound the depths of every vulnerability.

Newly released CVEs across every platform — sleek to read, verbose on demand, and served raw as markdown for AI and agent ingestion. Severity reads as depth: the deeper the contact, the graver the threat.

Browse the feed For agents → /llms.txt

Depth = severity + exploitation

HadalCritical and actively exploited (CISA KEV / 0day)
AbyssalCritical with a public exploit or in-the-wild use
MidnightCritical, or high with PoC / in-the-wild
TwilightHigh severity, or a signal on a lesser flaw
SunlitLow / medium · no exploitation signal

70319

Tracked CVEs

6557

Critical

748

Exploited in wild

1636

Last 7 days

Trending now

Bluesky + Hacker News mentions, last 7 days

1CVE-2026-109618Critical· 9.2RCE via OOM corruption4896
2CVE-2026-109619Critical· 9.2RCE via stale global state2196
3CVE-2026-111497Critical· 9.8Brotli: Out-of-bounds write in the Brotli decoder ("Node2Shell") also affects the PyPI Brotli package1895
4CVE-2026-99999Critical· 9.3In the Linux kernel, the following vulnerability has been resolved: ipv4: validate checksum_start before completing checksum If a packet with bad checksum metadata gets into the ipv4 stack, skb_checksum_help can corrupt the network hea…963
5CVE-2026-110264Critical· 10.0Integer Overflow or Wraparound in GitLab367
6CVE-2026-91403Critical· 9.1Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JSSE)262

This week's digest →All digests

Feed

10 matches

CVE-2026-70657Medium· 4.3

2mo ago

Copyparty is a portable file server

Copyparty is a portable file server. Prior to 1.20.17, copyparty volumes with the dk or dks directory-key flag combined with the fk or fka file-key flag can convert a valid file key into a directory key, granting read access to the conta…

▾ Sunlitcopyparty · copypartyEPSS 0.33%via NVD

CVE-2026-30974Medium· 4.6

7mo ago

copyparty: volflag `nohtml` did not block javascript in svg files

▾ Sunlitcopyparty · copypartyEPSS 0.34%via OSV

CVE-2026-27948Medium· 5.4

8mo ago

Copyparty vulnerable to reflected XSS via setck parameter

▾ Sunlitcopyparty · copypartyEPSS 0.20%via OSV

CVE-2025-58753Medium

1y ago

copyparty: Sharing a single file does not fully restrict access to other files in source folder

▾ Sunlitcopyparty · copypartyEPSS 0.38%via OSV

CVE-2023-41471High· 7.8

1y ago

Cross Site Scripting vulnerability in copyparty before 1.9.2 allows a local attacker to execute arbitrary code via a crafted payload to t…

Cross Site Scripting vulnerability in copyparty before 1.9.2 allows a local attacker to execute arbitrary code via a crafted payload to the WEEKEND-PLANS function. NOTE: this is disputed because WEEKEND-PLANS is accessible only to actors…

▾ Twilightcopyparty · copypartyEPSS 0.26%via OSV

CVE-2025-54796High· 7.5

1y ago

From the blog

All posts →

Oct 27, 2026

Sound the depths of every vulnerability.

Trending now

Feed

Copyparty is a portable file server

copyparty: volflag `nohtml` did not block javascript in svg files

Copyparty vulnerable to reflected XSS via setck parameter

copyparty: Sharing a single file does not fully restrict access to other files in source folder

Cross Site Scripting vulnerability in copyparty before 1.9.2 allows a local attacker to execute arbitrary code via a crafted payload to t…

copyparty allows Regex Denial of Service (ReDoS) in the upload listing

copyparty Reflected XSS via Filter Parameter

copyparty has DOM-Based XSS vulnerability when displaying multimedia metadata

copyparty renders unsanitized filenames as HTML when user uploads empty files

copyparty vulnerable to path traversal attack

From the blog

VulnSea has moved to vulnsea.com (and what changed since September)

What's new: open corpus, three new MCP tools, vendor advisories, package pages

Wiring VulnSea into an agent: a hands-on tutorial

Sound the depths of every vulnerability.

Trending now

Feed

Copyparty is a portable file server

copyparty: volflag `nohtml` did not block javascript in svg files

Copyparty vulnerable to reflected XSS via setck parameter

copyparty: Sharing a single file does not fully restrict access to other files in source folder

Cross Site Scripting vulnerability in copyparty before 1.9.2 allows a local attacker to execute arbitrary code via a crafted payload to t…

copyparty allows Regex Denial of Service (ReDoS) in the upload listing

copyparty Reflected XSS via Filter Parameter

copyparty has DOM-Based XSS vulnerability when displaying multimedia metadata

copyparty renders unsanitized filenames as HTML when user uploads empty files

copyparty vulnerable to path traversal attack

From the blog

VulnSea has moved to vulnsea.com (and what changed since September)

What's new: open corpus, three new MCP tools, vendor advisories, package pages

Wiring VulnSea into an agent: a hands-on tutorial