Live CVE & 0day intelligence

Sound the depths of every vulnerability.

Newly released CVEs across every platform — sleek to read, verbose on demand, and served raw as markdown for AI and agent ingestion. Severity reads as depth: the deeper the contact, the graver the threat.

Browse the feed For agents → /llms.txt

Depth = severity + exploitation

HadalCritical and actively exploited (CISA KEV / 0day)
AbyssalCritical with a public exploit or in-the-wild use
MidnightCritical, or high with PoC / in-the-wild
TwilightHigh severity, or a signal on a lesser flaw
SunlitLow / medium · no exploitation signal

70474

Tracked CVEs

6600

Critical

756

Exploited in wild

1154

Last 7 days

Trending now

Bluesky + Hacker News mentions, last 7 days

1CVE-2026-109618Critical· 9.2RCE via OOM corruption4896
2CVE-2026-109619Critical· 9.2RCE via stale global state2196
3CVE-2026-111497Critical· 9.8Brotli: Out-of-bounds write in the Brotli decoder ("Node2Shell") also affects the PyPI Brotli package1895
4CVE-2026-99999Critical· 9.3In the Linux kernel, the following vulnerability has been resolved: ipv4: validate checksum_start before completing checksum If a packet with bad checksum metadata gets into the ipv4 stack, skb_checksum_help can corrupt the network hea…963
5CVE-2026-110264Critical· 10.0Integer Overflow or Wraparound in GitLab367
6CVE-2026-91403Critical· 9.1Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JSSE)262

This week's digest →All digests

Feed

20 matches

CVE-2026-114099Medium· 5.8PoC

2w ago

Coraza 3.0.0 before 3.8.1 WAF Bypass via JSON Key Collision

Coraza from 3.0.0 before 3.8.1 has a JSON body processor that flattens nested properties into dot-separated ARGS_POST names without escaping literal dots, so distinct properties collide. Unauthenticated attackers can add a later dotted p…

▾ Twilightcorazawaf · corazaEPSS 0.20%via CVEORG

CVE-2026-114101Medium· 4.0PoC

2w ago

Coraza before 3.8.1 Multipart filename* Charset Handling FILES Rule Bypass

Coraza before 3.8.1 extracts multipart upload filenames with Go's mime.ParseMediaType, which silently ignores RFC 5987 filename* parameters whose charset is not utf-8 or us-ascii. Unauthenticated attackers can send a decoy filename with …

▾ Twilightcorazawaf · corazaEPSS 0.25%via CVEORG

CVE-2026-114100Medium· 5.8

2w ago

Coraza from 3.0.4 before 3.8.1 Request Body Inspection Bypass via Content-Type

Coraza from 3.0.4 before 3.8.1 contains a request body inspection bypass because request-body processor selection compares the entire Content-Type value exactly, so URL-encoded bodies whose Content-Type carries a media-type parameter are…

▾ Sunlitcorazawaf · corazaEPSS 0.28%via CVEORG

CVE-2026-104774Medium· 5.8PoC

3w ago

OWASP Coraza WAF is a golang modsecurity compatible web application firewall library

OWASP Coraza WAF is a golang modsecurity compatible web application firewall library. From 3.0.0 until 3.8.0, the t:jsDecode transformation in internal/transformations/js_decode.go:64-70 includes the backslash in the octal buffer, causin…

▾ Twilightcorazawaf · github.com/corazawaf/coraza/v3EPSS 0.32%via NVD

CVE-2026-41504Medium· 5.8PoC

3w ago

OWASP Coraza WAF is a golang modsecurity compatible web application firewall library

OWASP Coraza WAF is a golang modsecurity compatible web application firewall library. From 3.0.0 until 3.8.0, the Native audit-log formatter in internal/auditlog/formats.go writes attacker-influenced request and response fields without n…

▾ Twilightcorazawaf · github.com/corazawaf/coraza/v3EPSS 0.36%via NVD

CVE-2026-41510High· 7.2PoC

3w ago

OWASP Coraza WAF is a golang modsecurity compatible web application firewall library

OWASP Coraza WAF is a golang modsecurity compatible web application firewall library. From 3.0.0 until 3.8.1, Coraza silently drops arguments after SecArgumentsLimit in internal/corazawaf/transaction.go, while internal/bodyprocessors/url…

▾ Midnightcorazawaf · github.com/corazawaf/coraza/v3EPSS 0.38%via NVD

CVE-2026-41508Medium· 5.8

3w ago

OWASP Coraza WAF is a golang modsecurity compatible web application firewall library

OWASP Coraza WAF is a golang modsecurity compatible web application firewall library. From 3.4.0 until 3.8.0, the multipart processor in internal/bodyprocessors/multipart.go treats io.ErrUnexpectedEOF as nonfatal without setting MULTIPAR…

▾ Sunlitcorazawaf · github.com/corazawaf/coraza/v3EPSS 0.50%via NVD

CVE-2026-107835Medium· 4.0PoC

3w ago

OWASP Coraza WAF is a golang modsecurity compatible web application firewall library

OWASP Coraza WAF is a golang modsecurity compatible web application firewall library. Prior to 3.8.1, internal/cookies.ParseCookies in internal/cookies/cookies.go handles boundary ASCII control characters and control-only or empty cookie…

▾ Twilightcorazawaf · github.com/corazawaf/coraza/v3EPSS 0.30%via NVD

CVE-2026-107825Medium· 4.0PoC

3w ago

OWASP Coraza WAF is a golang modsecurity compatible web application firewall library

OWASP Coraza WAF is a golang modsecurity compatible web application firewall library. From 3.0.0 until 3.8.0, ProcessURI in internal/corazawaf/transaction.go handles a url.ParseRequestURI failure by retaining the raw URI but leaving QUER…

▾ Twilightcorazawaf · github.com/corazawaf/coraza/v3EPSS 0.32%via NVD

CVE-2026-107834Medium· 5.3

3w ago

OWASP Coraza WAF is a golang modsecurity compatible web application firewall library

OWASP Coraza WAF is a golang modsecurity compatible web application firewall library. From 3.0.0 until 3.8.0, the multipart loop in internal/bodyprocessors/multipart.go executes defer temp.Close() for every uploaded file part, so each te…

▾ Sunlitcorazawaf · github.com/corazawaf/coraza/v3EPSS 0.32%via NVD

CVE-2026-107833Medium· 5.9PoC

3w ago

OWASP Coraza WAF is a golang modsecurity compatible web application firewall library

OWASP Coraza WAF is a golang modsecurity compatible web application firewall library. From 3.0.0 until 3.8.0, ProcessResponse in internal/bodyprocessors/json.go passes the ignoreJSONRecursionLimit value of -1 to readJSON, while the recur…

▾ Twilightcorazawaf · github.com/corazawaf/coraza/v3EPSS 0.39%via NVD

CVE-2026-107826High· 7.5PoC

3w ago

OWASP Coraza WAF is a golang modsecurity compatible web application firewall library

OWASP Coraza WAF is a golang modsecurity compatible web application firewall library. From 3.0.0 until 3.8.1, readJSON in internal/bodyprocessors/json.go can stop its bounded flattening walk after reaching SecArgumentsLimit or the byte b…

▾ Midnightcorazawaf · github.com/corazawaf/coraza/v3EPSS 0.46%via NVD

GHSA-6gcq-wc29-5xf2High· 7.5

4w ago

Coraza JSON body processor: argument-limit truncation reopens an unbounded-depth gjson.Valid stack overflow (process crash)

▾ Twilightcorazawaf · github.com/corazawaf/coraza/v3via OSV

GHSA-5gj4-9gm7-2fx2Medium· 5.8

4w ago

Coraza body processor has a JSON key collision that allows unauthenticated attackers to bypass OWASP CRS inspection

▾ Sunlitcorazawaf · github.com/corazawaf/coraza/v3via OSV

GHSA-x26q-wvhg-fh4mMedium· 4.0

4w ago

Coraza: ProcessURI silently drops QUERY_STRING and ARGS_GET on URI parse failure — defense-in-depth bypass for non-net/http integrations

▾ Sunlitcorazawaf · github.com/corazawaf/coraza/v3via OSV

GHSA-g4qm-m288-5cp9Medium· 4.0

4w ago

Coraza has Cookie Parser Confusion

▾ Sunlitcorazawaf · github.com/corazawaf/coraza/v3via OSV

GHSA-3wr7-993q-jrffMedium· 4.0

4w ago

Coraza: Multipart filename* (RFC 5987) charset restriction lets a decoy filename bypass FILES-based rules

▾ Sunlitcorazawaf · github.com/corazawaf/coraza/v3via OSV

GHSA-3c6w-j9xm-8h2hMedium· 5.9

4w ago

Coraza: Unbounded recursion in JSON response body processor causes CPU exhaustion

▾ Sunlitcorazawaf · github.com/corazawaf/coraza/v3via OSV

GHSA-w253-m66g-rx24Medium· 5.8

4w ago

Coraza: URL-encoded form Content-Type parameters bypass Coraza body inspection

▾ Sunlitcorazawaf · github.com/corazawaf/coraza/v3via OSV

GHSA-rp9v-7xv3-r6g3Medium· 5.3

4w ago

Coraza: Resource exhaustion via deferred file handle accumulation in multipart body processor

▾ Sunlitcorazawaf · github.com/corazawaf/coraza/v3via OSV

From the blog

All posts →

Oct 27, 2026

Sound the depths of every vulnerability.

Trending now

Feed

Coraza 3.0.0 before 3.8.1 WAF Bypass via JSON Key Collision

Coraza before 3.8.1 Multipart filename* Charset Handling FILES Rule Bypass

Coraza from 3.0.4 before 3.8.1 Request Body Inspection Bypass via Content-Type

OWASP Coraza WAF is a golang modsecurity compatible web application firewall library

OWASP Coraza WAF is a golang modsecurity compatible web application firewall library

OWASP Coraza WAF is a golang modsecurity compatible web application firewall library

OWASP Coraza WAF is a golang modsecurity compatible web application firewall library

OWASP Coraza WAF is a golang modsecurity compatible web application firewall library

OWASP Coraza WAF is a golang modsecurity compatible web application firewall library

OWASP Coraza WAF is a golang modsecurity compatible web application firewall library

OWASP Coraza WAF is a golang modsecurity compatible web application firewall library

OWASP Coraza WAF is a golang modsecurity compatible web application firewall library

Coraza JSON body processor: argument-limit truncation reopens an unbounded-depth gjson.Valid stack overflow (process crash)

Coraza body processor has a JSON key collision that allows unauthenticated attackers to bypass OWASP CRS inspection

Coraza: ProcessURI silently drops QUERY_STRING and ARGS_GET on URI parse failure — defense-in-depth bypass for non-net/http integrations

Coraza has Cookie Parser Confusion

Coraza: Multipart filename* (RFC 5987) charset restriction lets a decoy filename bypass FILES-based rules

Coraza: Unbounded recursion in JSON response body processor causes CPU exhaustion

Coraza: URL-encoded form Content-Type parameters bypass Coraza body inspection

Coraza: Resource exhaustion via deferred file handle accumulation in multipart body processor

From the blog

VulnSea has moved to vulnsea.com (and what changed since September)

What's new: open corpus, three new MCP tools, vendor advisories, package pages

Wiring VulnSea into an agent: a hands-on tutorial

Sound the depths of every vulnerability.

Trending now

Feed

Coraza 3.0.0 before 3.8.1 WAF Bypass via JSON Key Collision

Coraza before 3.8.1 Multipart filename* Charset Handling FILES Rule Bypass

Coraza from 3.0.4 before 3.8.1 Request Body Inspection Bypass via Content-Type

OWASP Coraza WAF is a golang modsecurity compatible web application firewall library

OWASP Coraza WAF is a golang modsecurity compatible web application firewall library

OWASP Coraza WAF is a golang modsecurity compatible web application firewall library

OWASP Coraza WAF is a golang modsecurity compatible web application firewall library

OWASP Coraza WAF is a golang modsecurity compatible web application firewall library

OWASP Coraza WAF is a golang modsecurity compatible web application firewall library

OWASP Coraza WAF is a golang modsecurity compatible web application firewall library

OWASP Coraza WAF is a golang modsecurity compatible web application firewall library

OWASP Coraza WAF is a golang modsecurity compatible web application firewall library

Coraza JSON body processor: argument-limit truncation reopens an unbounded-depth gjson.Valid stack overflow (process crash)

Coraza body processor has a JSON key collision that allows unauthenticated attackers to bypass OWASP CRS inspection

Coraza: ProcessURI silently drops QUERY_STRING and ARGS_GET on URI parse failure — defense-in-depth bypass for non-net/http integrations

Coraza has Cookie Parser Confusion

Coraza: Multipart filename* (RFC 5987) charset restriction lets a decoy filename bypass FILES-based rules

Coraza: Unbounded recursion in JSON response body processor causes CPU exhaustion

Coraza: URL-encoded form Content-Type parameters bypass Coraza body inspection

Coraza: Resource exhaustion via deferred file handle accumulation in multipart body processor

From the blog

VulnSea has moved to vulnsea.com (and what changed since September)

What's new: open corpus, three new MCP tools, vendor advisories, package pages

Wiring VulnSea into an agent: a hands-on tutorial