Live CVE & 0day intelligence

Sound the depths of every vulnerability.

Newly released CVEs across every platform — sleek to read, verbose on demand, and served raw as markdown for AI and agent ingestion. Severity reads as depth: the deeper the contact, the graver the threat.

Browse the feed For agents → /llms.txt

Depth = severity + exploitation

HadalCritical and actively exploited (CISA KEV / 0day)
AbyssalCritical with a public exploit or in-the-wild use
MidnightCritical, or high with PoC / in-the-wild
TwilightHigh severity, or a signal on a lesser flaw
SunlitLow / medium · no exploitation signal

70332

Tracked CVEs

6560

Critical

748

Exploited in wild

1445

Last 7 days

Trending now

Bluesky + Hacker News mentions, last 7 days

1CVE-2026-109618Critical· 9.2RCE via OOM corruption4896
2CVE-2026-109619Critical· 9.2RCE via stale global state2196
3CVE-2026-111497Critical· 9.8Brotli: Out-of-bounds write in the Brotli decoder ("Node2Shell") also affects the PyPI Brotli package1895
4CVE-2026-99999Critical· 9.3In the Linux kernel, the following vulnerability has been resolved: ipv4: validate checksum_start before completing checksum If a packet with bad checksum metadata gets into the ipv4 stack, skb_checksum_help can corrupt the network hea…963
5CVE-2026-110264Critical· 10.0Integer Overflow or Wraparound in GitLab367
6CVE-2026-91403Critical· 9.1Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JSSE)262

This week's digest →All digests

Feed

13 matches

CVE-2026-119052High· 7.5

6d ago

llama.cpp b2877 before b11935 ggml-rpc Server DoS via Oversized recv_msg Length

llama.cpp b2877 before b11935 contains an uncaught exception vulnerability in the ggml-rpc server that allows unauthenticated remote attackers to crash the rpc-server by sending oversized message lengths. After the HELLO handshake, attac…

▾ Twilightggml-org · llama.cppEPSS 0.61%via CVEORG

CVE-2026-118375High· 8.1

1w ago

llama.cpp b8841 before b11865 Stack-based Buffer Overflow via ggml-rpc RDMA rdma_recv()

llama.cpp b8841 before b11865 contains an out-of-bounds write vulnerability in the ggml-rpc RDMA transport rdma_recv() function that allows unauthenticated peers to overflow the rpc-server stack. Attackers advertising RDMA capabilities i…

▾ Twilightggml-org · llama.cppvia CVEORG

CVE-2024-58400High· 8.2

1w ago

llama.cpp before b3701 Out-of-Bounds Read in llama_decode via Token IDs

llama.cpp before b3701 contains an out-of-bounds read vulnerability in llama_decode_internal and llama_encode_internal that allows remote unauthenticated attackers to read memory by supplying unvalidated token IDs. Attackers can send int…

▾ Twilightggml-org · llama.cppEPSS 0.42%via CVEORG

CVE-2026-116840Medium· 6.1

1w ago

llama.cpp b5854 before b11275 Integer Overflow in gguf_init_from_reader

llama.cpp b5854 before b11275 contains an integer overflow vulnerability in gguf_init_from_reader that bypasses the CVE-2025-53630 size check when padding near-SIZE_MAX tensor sizes. Attackers can supply a crafted GGUF file whose tensor …

▾ Sunlitggml-org · llama.cppEPSS 0.13%via CVEORG

CVE-2026-116829Medium· 6.6

1w ago

llama.cpp b10398 before b11301 Integer Overflow in gguf_init_from_reader

llama.cpp b10398 before b11301 contains an integer overflow vulnerability in gguf_init_from_reader that allows attackers to bypass tensor element-count validation by supplying shapes whose product wraps to zero. Attackers can craft GGUF …

▾ Sunlitggml-org · llama.cppEPSS 0.13%via CVEORG

CVE-2024-58399Medium· 6.1

1w ago

llama.cpp before b2731 Out-of-Bounds Read via GGUF Tensor Offsets

llama.cpp before b2731 contains an out-of-bounds read vulnerability in llama_model_loader that allows attackers to read memory outside the mapped model file via crafted GGUF tensor offsets. Attackers can supply a crafted or truncated GGU…

▾ Sunlitggml-org · llama.cppEPSS 0.12%via CVEORG

CVE-2026-116816High· 7.8

1w ago

llama.cpp b5899 before b10261 Heap Out-of-Bounds Write via plamo2 Tokenizer

llama.cpp b5899 before b10261 contains a heap out-of-bounds write vulnerability in llm_tokenizer_plamo2::build that allows attackers to corrupt heap memory via crafted GGUF models. Attackers can supply BYTE-typed token text like <0x-1> w…

▾ Twilightggml-org · llama.cppEPSS 0.14%via CVEORG

CVE-2025-71439Medium· 5.5

1w ago

llama.cpp before b5649 Heap Out-of-Bounds Read via llama_vocab::impl::print_info

llama.cpp before b5649 contains a heap out-of-bounds read vulnerability in llama_vocab::impl::print_info() that allows attackers to crash model loading via oversized special token IDs. Attackers can supply a crafted GGUF model with a sho…

▾ Sunlitggml-org · llama.cppEPSS 0.12%via CVEORG

CVE-2026-116467Medium· 5.3

1w ago

ggml-org llama.cpp Mirostat Sampler llama-sampler.cpp assertion

A security flaw has been discovered in ggml-org llama.cpp up to 0.7.0. Affected by this vulnerability is an unknown functionality of the file src/llama-sampler.cpp of the component Mirostat Sampler. The manipulation results in reachable …

▾ Sunlitggml-org · llama.cppEPSS 0.64%via CVEORG

CVE-2026-116096Medium· 5.3PoC

1w ago

ggml-org llama.cpp Pocket-TTS pockettts-gen.cpp list_pockettts_state_slots out-of-bounds write

A weakness has been identified in ggml-org llama.cpp. Affected by this issue is the function list_pockettts_state_slots of the file tools/mtmd/models/pockettts-gen.cpp of the component Pocket-TTS. This manipulation of the argument mmproj…

▾ Twilightggml-org · llama.cppEPSS 0.12%via CVEORG

CVE-2026-110810Low· 2.8PoC

2w ago

A vulnerability was detected in ggml-org whisper.cpp up to 1.9.4

A vulnerability was detected in ggml-org whisper.cpp up to 1.9.4. This affects the function whisper_model_load of the file src/whisper.cpp of the component Model Loader. Performing a manipulation of the argument ttype results in out-of-b…

▾ Twilightggml-org · whisper.cppEPSS 0.12%via NVD

CVE-2026-107183High· 8.1

4w ago

llama.cpp before b11393 contains a use-after-free and double free vulnerability in common_chat_peg_mapper::map that allows unauthenticated remote attackers to corrupt heap memory via a dangling current_tool pointer

llama.cpp before b11393 contains a use-after-free and double free vulnerability in common_chat_peg_mapper::map that allows unauthenticated remote attackers to corrupt heap memory via a dangling current_tool pointer. Attackers can submit …

▾ Twilightggml-org · llama.cppEPSS 0.42%via NVD

CVE-2026-86317Medium· 5.3

1mo ago

A vulnerability was detected in ggml-org llama.cpp up to 0.4.0

A vulnerability was detected in ggml-org llama.cpp up to 0.4.0. This impacts the function rpc_server::deserialize_tensor of the file ggml/src/ggml-rpc/ggml-rpc.cpp of the component RPC Server. Performing a manipulation of the argument ne…

▾ Sunlitggml-org · llama.cppEPSS 0.70%via NVD

From the blog

All posts →

Oct 27, 2026

Sound the depths of every vulnerability.

Trending now

Feed

llama.cpp b2877 before b11935 ggml-rpc Server DoS via Oversized recv_msg Length

llama.cpp b8841 before b11865 Stack-based Buffer Overflow via ggml-rpc RDMA rdma_recv()

llama.cpp before b3701 Out-of-Bounds Read in llama_decode via Token IDs

llama.cpp b5854 before b11275 Integer Overflow in gguf_init_from_reader

llama.cpp b10398 before b11301 Integer Overflow in gguf_init_from_reader

llama.cpp before b2731 Out-of-Bounds Read via GGUF Tensor Offsets

llama.cpp b5899 before b10261 Heap Out-of-Bounds Write via plamo2 Tokenizer

llama.cpp before b5649 Heap Out-of-Bounds Read via llama_vocab::impl::print_info

ggml-org llama.cpp Mirostat Sampler llama-sampler.cpp assertion

ggml-org llama.cpp Pocket-TTS pockettts-gen.cpp list_pockettts_state_slots out-of-bounds write

A vulnerability was detected in ggml-org whisper.cpp up to 1.9.4

llama.cpp before b11393 contains a use-after-free and double free vulnerability in common_chat_peg_mapper::map that allows unauthenticated remote attackers to corrupt heap memory via a dangling current_tool pointer

A vulnerability was detected in ggml-org llama.cpp up to 0.4.0

From the blog

VulnSea has moved to vulnsea.com (and what changed since September)

What's new: open corpus, three new MCP tools, vendor advisories, package pages

Wiring VulnSea into an agent: a hands-on tutorial

Sound the depths of every vulnerability.

Trending now

Feed

llama.cpp b2877 before b11935 ggml-rpc Server DoS via Oversized recv_msg Length

llama.cpp b8841 before b11865 Stack-based Buffer Overflow via ggml-rpc RDMA rdma_recv()

llama.cpp before b3701 Out-of-Bounds Read in llama_decode via Token IDs

llama.cpp b5854 before b11275 Integer Overflow in gguf_init_from_reader

llama.cpp b10398 before b11301 Integer Overflow in gguf_init_from_reader

llama.cpp before b2731 Out-of-Bounds Read via GGUF Tensor Offsets

llama.cpp b5899 before b10261 Heap Out-of-Bounds Write via plamo2 Tokenizer

llama.cpp before b5649 Heap Out-of-Bounds Read via llama_vocab::impl::print_info

ggml-org llama.cpp Mirostat Sampler llama-sampler.cpp assertion

ggml-org llama.cpp Pocket-TTS pockettts-gen.cpp list_pockettts_state_slots out-of-bounds write

A vulnerability was detected in ggml-org whisper.cpp up to 1.9.4

llama.cpp before b11393 contains a use-after-free and double free vulnerability in common_chat_peg_mapper::map that allows unauthenticated remote attackers to corrupt heap memory via a dangling current_tool pointer

A vulnerability was detected in ggml-org llama.cpp up to 0.4.0

From the blog

VulnSea has moved to vulnsea.com (and what changed since September)

What's new: open corpus, three new MCP tools, vendor advisories, package pages

Wiring VulnSea into an agent: a hands-on tutorial