Live CVE & 0day intelligence

Sound the depths of every vulnerability.

Newly released CVEs across every platform — sleek to read, verbose on demand, and served raw as markdown for AI and agent ingestion. Severity reads as depth: the deeper the contact, the graver the threat.

Browse the feed For agents → /llms.txt

Depth = severity + exploitation

HadalCritical and actively exploited (CISA KEV / 0day)
AbyssalCritical with a public exploit or in-the-wild use
MidnightCritical, or high with PoC / in-the-wild
TwilightHigh severity, or a signal on a lesser flaw
SunlitLow / medium · no exploitation signal

68882

Tracked CVEs

6390

Critical

701

Exploited in wild

5013

Last 7 days

Trending now

Bluesky + Hacker News mentions, last 7 days

1CVE-2026-109618Critical· 9.2RCE via OOM corruption4896
2CVE-2026-109619Critical· 9.2RCE via stale global state2196
3CVE-2026-111497Critical· 9.2Out-of-Bounds Write in Google Brotli Decoder1587
4CVE-2026-99999Critical· 9.3In the Linux kernel, the following vulnerability has been resolved: ipv4: validate checksum_start before completing checksum If a packet with bad checksum metadata gets into the ipv4 stack, skb_checksum_help can corrupt the network hea…863
5CVE-2026-110264Critical· 10.0Integer Overflow or Wraparound in GitLab267
6CVE-2026-108707Critical· 9.8Wukong_HRM through commit 186115e contains an authentication bypass vulnerability in ParamAspect that allows unauthenticated attackers to call every HRM API endpoint by omitting the AUTH-TOKEN header266

This week's digest →All digests

Feed

11 matches

CVE-2026-115570High· 7.4

5d ago

Electron: Mitigation for compromised eMudhra intermediate certificates

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 42.11.16, 43.8.1, 44.9.1, and 45.0.0-beta.6, Electron does not block compromised eMudhra intermediate certificates in Chromi…

▾ Twilightelectron · electronEPSS 0.38%via CVEORG

CVE-2026-113797Low· 3.1

6d ago

Electron: Extension tabs.query returns tab URLs and titles without the tabs permission

▾ Sunlitelectron · electronEPSS 0.59%via GHSA

CVE-2026-114121Medium· 5.4

6d ago

Electron: openExternal permission requests can be attributed to the wrong origin

▾ Sunlitelectron · electronEPSS 0.22%via GHSA

CVE-2026-114124Low· 3.9

1w ago

Electron: Off-screen rendering on macOS trusts GPU-supplied frame geometry

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to versions 42.11.6, 43.7.3, 44.4.3, and 45.0.0-alpha.9, frame data received from the GPU process for macOS offscreen rendering…

▾ Sunlitelectron · electronEPSS 0.18%via CVEORG

CVE-2026-113796Medium· 4.2

1w ago

Electron: SameSite cookie restrictions are not applied to windows opened from links

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to versions 42.11.3, 43.7.0, 44.3.0, and 45.0.0-alpha.6, Electron treated pages opened into a new window from links as applicat…

▾ Sunlitelectron · electronEPSS 0.22%via CVEORG

CVE-2026-113798Medium· 5.4

1w ago

Electron: Pointer lock permission requests can be attributed to the wrong frame

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to versions 42.11.9, 43.7.6, 44.5.0, and 45.0.0-alpha.13, pointerLock permission requests from some cross-origin iframes caused…

▾ Sunlitelectron · electronEPSS 0.24%via CVEORG

CVE-2026-113800Medium· 5.4

1w ago

Electron: HID and USB permission checks can be attributed to the wrong origin

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to versions 42.11.3, 43.7.0, 44.3.0, and 45.0.0-alpha.5, hid and usb permission checks made from an iframe caused setPermission…

▾ Sunlitelectron · electronEPSS 0.24%via CVEORG

CVE-2026-114122Low· 3.9

1w ago

Electron: Frame subscription trusts GPU-supplied frame geometry

▾ Sunlitelectron · electronEPSS 0.19%via CVEORG

CVE-2026-102672Medium· 6.7

2w ago

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.10, 41.10.5, and 42.0.0-beta.2, Electron applications on macOS that use Squirrel.Mac-based automatic updates are vulner…

▾ Sunlitelectron · electronEPSS 0.09%via NVD

CVE-2026-102675High· 7.4

4w ago

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 41.10.6, 42.9.2, 43.4.1, and 44.0.0-beta.5, responses served through protocol.registerFileProtocol or protocol.registerHttpP…

▾ Twilightelectron · electronEPSS 0.21%via NVD

CVE-2026-54257Critical

4mo ago

Electron: Buffer performs incorrect byte length calculations resulting in heap buffer under/overflow

▾ Midnightelectron · electronEPSS 0.43%via GHSA

From the blog

All posts →

Oct 27, 2026

Sound the depths of every vulnerability.

Trending now

Feed

Electron: Mitigation for compromised eMudhra intermediate certificates

Electron: Extension tabs.query returns tab URLs and titles without the tabs permission

Electron: openExternal permission requests can be attributed to the wrong origin

Electron: Off-screen rendering on macOS trusts GPU-supplied frame geometry

Electron: SameSite cookie restrictions are not applied to windows opened from links

Electron: Pointer lock permission requests can be attributed to the wrong frame

Electron: HID and USB permission checks can be attributed to the wrong origin

Electron: Frame subscription trusts GPU-supplied frame geometry

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS

Electron: Buffer performs incorrect byte length calculations resulting in heap buffer under/overflow

From the blog

VulnSea has moved to vulnsea.com (and what changed since September)

What's new: open corpus, three new MCP tools, vendor advisories, package pages

Wiring VulnSea into an agent: a hands-on tutorial

Sound the depths of every vulnerability.

Trending now

Feed

Electron: Mitigation for compromised eMudhra intermediate certificates

Electron: Extension tabs.query returns tab URLs and titles without the tabs permission

Electron: openExternal permission requests can be attributed to the wrong origin

Electron: Off-screen rendering on macOS trusts GPU-supplied frame geometry

Electron: SameSite cookie restrictions are not applied to windows opened from links

Electron: Pointer lock permission requests can be attributed to the wrong frame

Electron: HID and USB permission checks can be attributed to the wrong origin

Electron: Frame subscription trusts GPU-supplied frame geometry

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS

Electron: Buffer performs incorrect byte length calculations resulting in heap buffer under/overflow

From the blog

VulnSea has moved to vulnsea.com (and what changed since September)

What's new: open corpus, three new MCP tools, vendor advisories, package pages

Wiring VulnSea into an agent: a hands-on tutorial