Live CVE & 0day intelligence

Sound the depths of every vulnerability.

Newly released CVEs across every platform — sleek to read, verbose on demand, and served raw as markdown for AI and agent ingestion. Severity reads as depth: the deeper the contact, the graver the threat.

Browse the feed For agents → /llms.txt

Depth = severity + exploitation

HadalCritical and actively exploited (CISA KEV / 0day)
AbyssalCritical with a public exploit or in-the-wild use
MidnightCritical, or high with PoC / in-the-wild
TwilightHigh severity, or a signal on a lesser flaw
SunlitLow / medium · no exploitation signal

69378

Tracked CVEs

6434

Critical

702

Exploited in wild

4423

Last 7 days

Trending now

Bluesky + Hacker News mentions, last 7 days

1CVE-2026-109618Critical· 9.2RCE via OOM corruption4896
2CVE-2026-109619Critical· 9.2RCE via stale global state2196
3CVE-2026-111497Critical· 9.2Brotli: Out-of-bounds write in the Brotli decoder ("Node2Shell") also affects the PyPI Brotli package1592
4CVE-2026-99999Critical· 9.3In the Linux kernel, the following vulnerability has been resolved: ipv4: validate checksum_start before completing checksum If a packet with bad checksum metadata gets into the ipv4 stack, skb_checksum_help can corrupt the network hea…963
5CVE-2026-110264Critical· 10.0Integer Overflow or Wraparound in GitLab267
6CVE-2026-108707Critical· 9.8Wukong_HRM through commit 186115e contains an authentication bypass vulnerability in ParamAspect that allows unauthenticated attackers to call every HRM API endpoint by omitting the AUTH-TOKEN header266
7CVE-2026-91403Critical· 9.1Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JSSE)262

This week's digest →All digests

Feed

15 matches

CVE-2026-101916High· 7.4

1mo ago

@grpc/grpc-js implements the core functionality of gRPC purely in JavaScript, without a C++ addon

@grpc/grpc-js implements the core functionality of gRPC purely in JavaScript, without a C++ addon. Prior to 1.13.6 and 1.14.5, getAuthContext does not distinguish authorized from unauthorized peer certificates when server credentials set…

▾ Twilightgrpc · grpc-nodeEPSS 0.21%via NVD

CVE-2026-101915Low· 3.7

1mo ago

@grpc/grpc-js implements the core functionality of gRPC purely in JavaScript, without a C++ addon

@grpc/grpc-js implements the core functionality of gRPC purely in JavaScript, without a C++ addon. Prior to 1.13.6 and 1.14.5, when an application method handler throws an uncaught error, the server includes its error message in the stat…

▾ Sunlitgrpc · grpc-nodeEPSS 0.25%via NVD

CVE-2026-101914Medium· 6.5

1mo ago

@grpc/grpc-js implements the core functionality of gRPC purely in JavaScript, without a C++ addon

@grpc/grpc-js implements the core functionality of gRPC purely in JavaScript, without a C++ addon. Prior to 1.13.1 and 1.14.1, the exact path (method name) matcher used by RBAC performs a prefix comparison instead of an equality comparis…

▾ Sunlitgrpc · grpc-nodeEPSS 0.25%via NVD

CVE-2026-84445High· 8.7

1mo ago

gRPC-Go is the Go language implementation of gRPC

gRPC-Go is the Go language implementation of gRPC. Prior to 1.82.2 and 1.83.2, servers created with xds.NewGRPCServer() allow internal/transport/http2_server.go to accept an RPC containing neither the :authority header nor the Host heade…

▾ Twilightgrpc · grpc-goEPSS 0.64%via NVD

CVE-2026-84303Medium

1mo ago

gRPC-Go is the Go language implementation of gRPC

gRPC-Go is the Go language implementation of gRPC. Prior to 1.83.1, the xDS RBAC HTTP filter in internal/xds/httpfilter/rbac/rbac.go does not lowercase header matcher names in normalizeHeaderMatcher even though incoming metadata keys are…

▾ Sunlitgrpc · google.golang.org/grpcEPSS 0.31%via NVD

CVE-2026-84304High· 7.5

1mo ago

gRPC-Go is the Go language implementation of gRPC

gRPC-Go is the Go language implementation of gRPC. Prior to 1.83.1, internal/transport/transport.go stores each fragmented HTTP/2 DATA frame as a separate recvMsg in recvBuffer, so millions of one-byte frames can consume disproportionate…

▾ Twilightgrpc · google.golang.org/grpcEPSS 0.61%via NVD

CVE-2026-53430High

2mo ago

gRPC Erlang package has unbounded gzip decompression (decompression bomb)

▾ Twilightgrpc · grpcEPSS 0.43%via GHSA

GO-2026-6061None

3mo ago

Vulnerabilities in the xDS RBAC authorization engine and the HTTP/2 transport server implementation in google.golang.org/grpc

▾ Sunlitgrpc · google.golang.org/grpcvia OSV

GHSA-hrxh-6v49-42gfHigh

3mo ago

gRPC-Go: xDS RBAC and HTTP/2 Vulnerabilities

▾ Twilightgrpc · google.golang.org/grpcvia GHSA

CVE-2026-48069High· 7.5

4mo ago

@grpc/grpc-js: An incoming malformed compressed message can cause a client or server crash

▾ Twilightgrpc · @grpc/grpc-jsEPSS 0.88%via GHSA

CVE-2026-33186Critical· 9.1PoC

7mo ago

gRPC-Go is the Go language implementation of gRPC

gRPC-Go is the Go language implementation of gRPC. Versions prior to 1.79.3 have an authorization bypass resulting from improper input validation of the HTTP/2 `:path` pseudo-header. The gRPC-Go server was too lenient in its routing logi…

▾ Abyssalgrpc · grpcEPSS 1.6%via NVD

CVE-2023-4785High· 7.5

3y ago

From the blog

All posts →

Oct 27, 2026

Sound the depths of every vulnerability.

Trending now

Feed

@grpc/grpc-js implements the core functionality of gRPC purely in JavaScript, without a C++ addon

@grpc/grpc-js implements the core functionality of gRPC purely in JavaScript, without a C++ addon

@grpc/grpc-js implements the core functionality of gRPC purely in JavaScript, without a C++ addon

gRPC-Go is the Go language implementation of gRPC

gRPC-Go is the Go language implementation of gRPC

gRPC-Go is the Go language implementation of gRPC

gRPC Erlang package has unbounded gzip decompression (decompression bomb)

Vulnerabilities in the xDS RBAC authorization engine and the HTTP/2 transport server implementation in google.golang.org/grpc

gRPC-Go: xDS RBAC and HTTP/2 Vulnerabilities

@grpc/grpc-js: An incoming malformed compressed message can cause a client or server crash

gRPC-Go is the Go language implementation of gRPC

Denial of Service Vulnerability in gRPC TCP Server (Posix-compatible platforms)

gRPC connection termination issue

gRPC Reachable Assertion issue

Connection confusion in gRPC

From the blog

VulnSea has moved to vulnsea.com (and what changed since September)

What's new: open corpus, three new MCP tools, vendor advisories, package pages

Wiring VulnSea into an agent: a hands-on tutorial

Sound the depths of every vulnerability.

Trending now

Feed

@grpc/grpc-js implements the core functionality of gRPC purely in JavaScript, without a C++ addon

@grpc/grpc-js implements the core functionality of gRPC purely in JavaScript, without a C++ addon

@grpc/grpc-js implements the core functionality of gRPC purely in JavaScript, without a C++ addon

gRPC-Go is the Go language implementation of gRPC

gRPC-Go is the Go language implementation of gRPC

gRPC-Go is the Go language implementation of gRPC

gRPC Erlang package has unbounded gzip decompression (decompression bomb)

Vulnerabilities in the xDS RBAC authorization engine and the HTTP/2 transport server implementation in google.golang.org/grpc

gRPC-Go: xDS RBAC and HTTP/2 Vulnerabilities

@grpc/grpc-js: An incoming malformed compressed message can cause a client or server crash

gRPC-Go is the Go language implementation of gRPC

Denial of Service Vulnerability in gRPC TCP Server (Posix-compatible platforms)

gRPC connection termination issue

gRPC Reachable Assertion issue

Connection confusion in gRPC

From the blog

VulnSea has moved to vulnsea.com (and what changed since September)

What's new: open corpus, three new MCP tools, vendor advisories, package pages

Wiring VulnSea into an agent: a hands-on tutorial