Live CVE & 0day intelligence

Sound the depths of every vulnerability.

Newly released CVEs across every platform — sleek to read, verbose on demand, and served raw as markdown for AI and agent ingestion. Severity reads as depth: the deeper the contact, the graver the threat.

Browse the feed For agents → /llms.txt

Depth = severity + exploitation

HadalCritical and actively exploited (CISA KEV / 0day)
AbyssalCritical with a public exploit or in-the-wild use
MidnightCritical, or high with PoC / in-the-wild
TwilightHigh severity, or a signal on a lesser flaw
SunlitLow / medium · no exploitation signal

68750

Tracked CVEs

6385

Critical

701

Exploited in wild

4934

Last 7 days

Trending now

Bluesky + Hacker News mentions, last 7 days

1CVE-2026-109618Critical· 9.2RCE via OOM corruption4896
2CVE-2026-109619Critical· 9.2RCE via stale global state2196
3CVE-2026-111497Critical· 9.2Out-of-Bounds Write in Google Brotli Decoder1580
4CVE-2026-99999Critical· 9.3In the Linux kernel, the following vulnerability has been resolved: ipv4: validate checksum_start before completing checksum If a packet with bad checksum metadata gets into the ipv4 stack, skb_checksum_help can corrupt the network hea…863
5CVE-2026-110264Critical· 10.0Integer Overflow or Wraparound in GitLab267
6CVE-2026-108707Critical· 9.8Wukong_HRM through commit 186115e contains an authentication bypass vulnerability in ParamAspect that allows unauthenticated attackers to call every HRM API endpoint by omitting the AUTH-TOKEN header266

This week's digest →All digests

Feed

14 matches

CVE-2026-114437Medium· 4.8PoC

5d ago

chi: Client IP spoofing in ClientIPFromXFF via X-Forwarded-For

▾ Twilightgo-chi · github.com/go-chi/chi/v5EPSS 0.13%via OSV

GHSA-7cgw-qmxx-7fc2Medium· 4.8

1w ago

Duplicate Advisory: chi: Client IP spoofing in ClientIPFromXFF via X-Forwarded-For

▾ Sunlitgo-chi · github.com/go-chi/chi/v5via GHSA

GHSA-xcvf-46f4-xwxfMedium

2mo ago

Duplicate Advisory: chi Allows Host Header Injection which Leads to Open Redirect in RedirectSlashes

▾ Sunlitgo-chi · github.com/go-chi/chivia GHSA

CVE-2025-71405Medium· 5.1PoC

2mo ago

chi versions before v5.2.2 contain an open redirect vulnerability in the RedirectSlashes middleware function that uses the Host header to construct redirect URLs

chi versions before v5.2.2 contain an open redirect vulnerability in the RedirectSlashes middleware function that uses the Host header to construct redirect URLs. Attackers can manipulate the Host header to redirect users to arbitrary ho…

▾ Twilightgo-chi · chiEPSS 0.39%via NVD

CVE-2026-72816Medium· 6.5PoC

2mo ago

go-chi/chi through 5.2.1 contains an IP spoofing vulnerability in the RealIP middleware (middleware/realip.go)

go-chi/chi through 5.2.1 contains an IP spoofing vulnerability in the RealIP middleware (middleware/realip.go). The realIP() function reads client-controlled headers (True-Client-IP, X-Real-IP, and X-Forwarded-For) and overwrites r.Remot…

▾ Twilightgo-chi · chiEPSS 0.30%via NVD

CVE-2026-72817Medium· 6.5

2mo ago

go-chi/chi versions 0.9.0 before 5.3.0 contains an IP spoofing vulnerability in the RealIP middleware, which resolves the request source IP (Request.RemoteAddr) using the first IP in the X-Forwarded-For header without validating trusted …

go-chi/chi versions 0.9.0 before 5.3.0 contains an IP spoofing vulnerability in the RealIP middleware, which resolves the request source IP (Request.RemoteAddr) using the first IP in the X-Forwarded-For header without validating trusted …

▾ Sunlitgo-chi · chiEPSS 0.24%via NVD

CVE-2026-72815Medium· 6.9PoC

2mo ago

go-chi chi versions >= 5.2.1 and before 5.3.0 contain an IP spoofing vulnerability in the RealIP middleware, which blindly trusts the first (leftmost) value of the X-Forwarded-For HTTP header

go-chi chi versions >= 5.2.1 and before 5.3.0 contain an IP spoofing vulnerability in the RealIP middleware, which blindly trusts the first (leftmost) value of the X-Forwarded-For HTTP header. A remote attacker can bypass IP-based access…

▾ Twilightgo-chi · chiEPSS 0.50%via NVD

GO-2026-5777None

3mo ago

Chi's RealIP Middleware allows IP spoofing via unvalidated X-Forwarded-For header in github.com/go-chi/chi

▾ Sunlitgo-chi · github.com/go-chi/chi/v5via OSV

GO-2026-5775None

3mo ago

Chi Middleware vulnerable to IP spoofing via X-Forwarded-For header in github.com/go-chi/chi

▾ Sunlitgo-chi · github.com/go-chi/chi/v5via OSV

GO-2026-5774None

3mo ago

Chi has an IP spoofing vulnerability in middleware.RealIP in github.com/go-chi/chi

▾ Sunlitgo-chi · github.com/go-chi/chi/v5via OSV

GHSA-rjr7-jggh-pgcpHigh

4mo ago

chi's RealIP Middleware allows IP spoofing via unvalidated X-Forwarded-For header

▾ Twilightgo-chi · github.com/go-chi/chi/middlewarevia GHSA

GHSA-9g5q-2w5x-hmxfHigh

4mo ago

chi Middleware Vulnerable to Potential IP Spoofing via `X-Forwarded-For` Header in `Request.RemoteAddr` Resolution

▾ Twilightgo-chi · github.com/go-chi/chi/middlewarevia GHSA

GHSA-3fxj-6jh8-hvhxMedium

4mo ago

chi Has an IP Spoofing Vulnerability in `middleware.RealIP`

▾ Sunlitgo-chi · github.com/go-chi/chi/v5/middlewarevia GHSA

CVE-2025-69725Medium· 4.7

9mo ago

chi has an open redirect vulnerability in the RedirectSlashes middleware

▾ Sunlitgo-chi · github.com/go-chi/chi/v5EPSS 0.26%via OSV

From the blog

All posts →

Oct 27, 2026

Sound the depths of every vulnerability.

Trending now

Feed

chi: Client IP spoofing in ClientIPFromXFF via X-Forwarded-For

Duplicate Advisory: chi: Client IP spoofing in ClientIPFromXFF via X-Forwarded-For

Duplicate Advisory: chi Allows Host Header Injection which Leads to Open Redirect in RedirectSlashes

chi versions before v5.2.2 contain an open redirect vulnerability in the RedirectSlashes middleware function that uses the Host header to construct redirect URLs

go-chi/chi through 5.2.1 contains an IP spoofing vulnerability in the RealIP middleware (middleware/realip.go)

go-chi/chi versions 0.9.0 before 5.3.0 contains an IP spoofing vulnerability in the RealIP middleware, which resolves the request source IP (Request.RemoteAddr) using the first IP in the X-Forwarded-For header without validating trusted …

go-chi chi versions >= 5.2.1 and before 5.3.0 contain an IP spoofing vulnerability in the RealIP middleware, which blindly trusts the first (leftmost) value of the X-Forwarded-For HTTP header

Chi's RealIP Middleware allows IP spoofing via unvalidated X-Forwarded-For header in github.com/go-chi/chi

Chi Middleware vulnerable to IP spoofing via X-Forwarded-For header in github.com/go-chi/chi

Chi has an IP spoofing vulnerability in middleware.RealIP in github.com/go-chi/chi

chi's RealIP Middleware allows IP spoofing via unvalidated X-Forwarded-For header

chi Middleware Vulnerable to Potential IP Spoofing via `X-Forwarded-For` Header in `Request.RemoteAddr` Resolution

chi Has an IP Spoofing Vulnerability in `middleware.RealIP`

chi has an open redirect vulnerability in the RedirectSlashes middleware

From the blog

VulnSea has moved to vulnsea.com (and what changed since September)

What's new: open corpus, three new MCP tools, vendor advisories, package pages

Wiring VulnSea into an agent: a hands-on tutorial

Sound the depths of every vulnerability.

Trending now

Feed

chi: Client IP spoofing in ClientIPFromXFF via X-Forwarded-For

Duplicate Advisory: chi: Client IP spoofing in ClientIPFromXFF via X-Forwarded-For

Duplicate Advisory: chi Allows Host Header Injection which Leads to Open Redirect in RedirectSlashes

chi versions before v5.2.2 contain an open redirect vulnerability in the RedirectSlashes middleware function that uses the Host header to construct redirect URLs

go-chi/chi through 5.2.1 contains an IP spoofing vulnerability in the RealIP middleware (middleware/realip.go)

go-chi/chi versions 0.9.0 before 5.3.0 contains an IP spoofing vulnerability in the RealIP middleware, which resolves the request source IP (Request.RemoteAddr) using the first IP in the X-Forwarded-For header without validating trusted …

go-chi chi versions >= 5.2.1 and before 5.3.0 contain an IP spoofing vulnerability in the RealIP middleware, which blindly trusts the first (leftmost) value of the X-Forwarded-For HTTP header

Chi's RealIP Middleware allows IP spoofing via unvalidated X-Forwarded-For header in github.com/go-chi/chi

Chi Middleware vulnerable to IP spoofing via X-Forwarded-For header in github.com/go-chi/chi

Chi has an IP spoofing vulnerability in middleware.RealIP in github.com/go-chi/chi

chi's RealIP Middleware allows IP spoofing via unvalidated X-Forwarded-For header

chi Middleware Vulnerable to Potential IP Spoofing via `X-Forwarded-For` Header in `Request.RemoteAddr` Resolution

chi Has an IP Spoofing Vulnerability in `middleware.RealIP`

chi has an open redirect vulnerability in the RedirectSlashes middleware

From the blog

VulnSea has moved to vulnsea.com (and what changed since September)

What's new: open corpus, three new MCP tools, vendor advisories, package pages

Wiring VulnSea into an agent: a hands-on tutorial