Live CVE & 0day intelligence

Sound the depths of every vulnerability.

Newly released CVEs across every platform — sleek to read, verbose on demand, and served raw as markdown for AI and agent ingestion. Severity reads as depth: the deeper the contact, the graver the threat.

Browse the feed For agents → /llms.txt

Depth = severity + exploitation

HadalCritical and actively exploited (CISA KEV / 0day)
AbyssalCritical with a public exploit or in-the-wild use
MidnightCritical, or high with PoC / in-the-wild
TwilightHigh severity, or a signal on a lesser flaw
SunlitLow / medium · no exploitation signal

74795

Tracked CVEs

6993

Critical

765

Exploited in wild

5417

Last 7 days

Trending now

Bluesky + Hacker News mentions, last 7 days

1CVE-2026-109618Critical· 9.2RCE via OOM corruption4896
2CVE-2026-109619Critical· 9.2RCE via stale global state2196
3CVE-2026-111497Critical· 9.2Out-of-Bounds Write in Google Brotli Decoder1892
4CVE-2026-99999Critical· 9.3In the Linux kernel, the following vulnerability has been resolved: ipv4: validate checksum_start before completing checksum If a packet with bad checksum metadata gets into the ipv4 stack, skb_checksum_help can corrupt the network hea…963
5CVE-2026-110264Critical· 10.0Integer Overflow or Wraparound in GitLab367
6CVE-2026-112816Critical· 10.0Improper certificate validation in the HTTPS listener in LXD367
7CVE-2026-116366Critical· 9.5Unauthenticated RCE vulnerability against ClickHouse Server364
8CVE-2026-97631Critical· 9.5Pre-boot RCE in EDK II PXE driver264

This week's digest →All digests

Feed

20 matches

CVE-2026-102832Medium· 4.2

3w ago

JupyterLab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Architecture

JupyterLab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Architecture. From 4.5.7 until 4.5.11 and 4.6.4, the markdownviewer:trust and notebook:trust command-link handlers use trac…

▾ Sunlitjupyterlab · jupyterlabEPSS 0.14%via NVD

CVE-2026-102904Medium· 5.4

1mo ago

JupyterLab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Architecture

JupyterLab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Architecture. From JupyterLab 4.0.0 until 4.5.11 and 4.6.4, the PyPI Extension Manager uninstall request reaches ExtensionH…

▾ Sunlitjupyterlab · jupyterlabEPSS 0.21%via NVD

CVE-2026-102831High· 8.1

1mo ago

JupyterLab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Architecture

JupyterLab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Architecture. From JupyterLab 4.5.0 until 4.5.11 and 4.6.4, from Notebook 7.5.0 until 7.6.3, and from JupyterLite Core 0.7.…

▾ Twilightjupyterlab · jupyterlabEPSS 0.24%via NVD

CVE-2026-102830Medium· 6.8

1mo ago

JupyterLab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Architecture

JupyterLab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Architecture. From JupyterLab 3.0.0 until 4.5.11 and 4.6.4, and in JupyterLite Core 0.8.3 and earlier, the Plural-Forms hea…

▾ Sunlitjupyterlab · jupyterlabEPSS 0.26%via NVD

CVE-2026-73626High· 7.5⚖ disputed

2mo ago

JupyterLab versions >=4.6.0,<=4.6.1 and <=4.5.9 contain an allowlist/blocklist enforcement gap in PyPIExtensionManager.install()

JupyterLab versions >=4.6.0,<=4.6.1 and <=4.5.9 contain an allowlist/blocklist enforcement gap in PyPIExtensionManager.install(). A missing 'await' caused the is_install_allowed coroutine to never execute, so the extension allowlist/bloc…

▾ Twilightjupyterlab · jupyterlabEPSS 0.36%via NVD

CVE-2026-73417High· 8.3

2mo ago

jupyterlab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Architecture

jupyterlab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Architecture. From 3.3.0 until 4.5.10 and 4.6.2, JupyterLab allows notebook settings to be shared and applied through an ov…

▾ Twilightjupyterlab · jupyterlabEPSS 0.75%via NVD

CVE-2026-73416Medium

2mo ago

jupyterlab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Architecture

jupyterlab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Architecture. From 4.5.0 until 4.5.10 and 4.6.2, in jupyterlab/extensions/manager.py and jupyterlab/extensions/pypi.py, Jup…

▾ Sunlitjupyterlab · jupyterlabEPSS 0.66%via NVD

CVE-2026-67338Medium· 6.1

3mo ago

JupyterLab before 4.5.9 contains a stored cross-site scripting vulnerability in the Extension Manager that fails to validate URI protocols in package metadata URLs

JupyterLab before 4.5.9 contains a stored cross-site scripting vulnerability in the Extension Manager that fails to validate URI protocols in package metadata URLs. Attackers can publish malicious PyPI packages with javascript: URLs in p…

▾ Sunlitjupyterlab · jupyterlabEPSS 0.30%via NVD

GHSA-whvh-wf3x-g77jLow

3mo ago

JupyterLab: Allowlist/blocklist check in `PyPIExtensionManager.install()` not enforced for direct callers (missing `await`)

▾ Sunlitjupyterlab · jupyterlabvia GHSA

GHSA-h5v5-8746-g7mmMedium

3mo ago

JupyterLab PluginManager lock-rule enforcement bypass

▾ Sunlitjupyterlab · jupyterlabvia OSV

GHSA-89vp-jrxv-24w8Medium

3mo ago

JupyterLab: PyPI extension blocklist package-name canonicalization bypass

▾ Sunlitjupyterlab · jupyterlabvia GHSA

GHSA-gx64-gj6p-pc4cHigh

3mo ago

JupyterLab: Image viewer allows XSS when opening malicious image in new browser tab

▾ Twilightjupyterlab · jupyterlabvia GHSA

GHSA-pppj-hq3g-57pjHigh

3mo ago

JupyterLab: Cross-site scripting (XSS) via crafted settings file (`overrides.json`)

▾ Twilightjupyterlab · jupyterlabvia GHSA

GHSA-vmhf-c436-hxj4Medium

4mo ago

JupyterLab: Stored XSS in extension manager through package metadata unsanitized URI protocol

▾ Sunlitjupyterlab · jupyterlabvia GHSA

CVE-2026-42557Critical· 9.6

6mo ago

JupyterLab's command linker attributes in HTML enable one-click command execution from untrusted content

▾ Midnightjupyterlab · jupyterlabEPSS 0.49%via OSV

CVE-2025-59842Low

1y ago

JupyterLab: XSS due to lack of sanitization of the action attribute of an html <form>

▾ Twilightjupyterlab · jupyterlabEPSS 2.7%via OSV

From the blog

All posts →

Oct 27, 2026

Sound the depths of every vulnerability.

Trending now

Feed

JupyterLab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Architecture

JupyterLab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Architecture

JupyterLab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Architecture

JupyterLab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Architecture

JupyterLab versions >=4.6.0,<=4.6.1 and <=4.5.9 contain an allowlist/blocklist enforcement gap in PyPIExtensionManager.install()

jupyterlab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Architecture

jupyterlab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Architecture

JupyterLab before 4.5.9 contains a stored cross-site scripting vulnerability in the Extension Manager that fails to validate URI protocols in package metadata URLs

JupyterLab: Allowlist/blocklist check in `PyPIExtensionManager.install()` not enforced for direct callers (missing `await`)

JupyterLab PluginManager lock-rule enforcement bypass

JupyterLab: PyPI extension blocklist package-name canonicalization bypass

JupyterLab: Image viewer allows XSS when opening malicious image in new browser tab

JupyterLab: Cross-site scripting (XSS) via crafted settings file (`overrides.json`)

JupyterLab: Stored XSS in extension manager through package metadata unsanitized URI protocol

JupyterLab's command linker attributes in HTML enable one-click command execution from untrusted content

JupyterLab LaTeX typesetter links did not enforce `noopener` attribute

HTML injection in Jupyter Notebook and JupyterLab leading to DOM Clobbering

JupyterLab vulnerable to SXSS in Markdown Preview

JupyterLab vulnerable to potential authentication and CSRF tokens leak

JupyterLab: XSS due to lack of sanitization of the action attribute of an html <form>

From the blog

VulnSea has moved to vulnsea.com (and what changed since September)

What's new: open corpus, three new MCP tools, vendor advisories, package pages

Wiring VulnSea into an agent: a hands-on tutorial

Sound the depths of every vulnerability.

Trending now

Feed

JupyterLab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Architecture

JupyterLab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Architecture

JupyterLab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Architecture

JupyterLab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Architecture

JupyterLab versions >=4.6.0,<=4.6.1 and <=4.5.9 contain an allowlist/blocklist enforcement gap in PyPIExtensionManager.install()

jupyterlab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Architecture

jupyterlab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Architecture

JupyterLab before 4.5.9 contains a stored cross-site scripting vulnerability in the Extension Manager that fails to validate URI protocols in package metadata URLs

JupyterLab: Allowlist/blocklist check in `PyPIExtensionManager.install()` not enforced for direct callers (missing `await`)

JupyterLab PluginManager lock-rule enforcement bypass

JupyterLab: PyPI extension blocklist package-name canonicalization bypass

JupyterLab: Image viewer allows XSS when opening malicious image in new browser tab

JupyterLab: Cross-site scripting (XSS) via crafted settings file (`overrides.json`)

JupyterLab: Stored XSS in extension manager through package metadata unsanitized URI protocol

JupyterLab's command linker attributes in HTML enable one-click command execution from untrusted content

JupyterLab LaTeX typesetter links did not enforce `noopener` attribute

HTML injection in Jupyter Notebook and JupyterLab leading to DOM Clobbering

JupyterLab vulnerable to SXSS in Markdown Preview

JupyterLab vulnerable to potential authentication and CSRF tokens leak

JupyterLab: XSS due to lack of sanitization of the action attribute of an html <form>

From the blog

VulnSea has moved to vulnsea.com (and what changed since September)

What's new: open corpus, three new MCP tools, vendor advisories, package pages

Wiring VulnSea into an agent: a hands-on tutorial