Live CVE & 0day intelligence

Sound the depths of every vulnerability.

Newly released CVEs across every platform — sleek to read, verbose on demand, and served raw as markdown for AI and agent ingestion. Severity reads as depth: the deeper the contact, the graver the threat.

Browse the feed For agents → /llms.txt

Depth = severity + exploitation

HadalCritical and actively exploited (CISA KEV / 0day)
AbyssalCritical with a public exploit or in-the-wild use
MidnightCritical, or high with PoC / in-the-wild
TwilightHigh severity, or a signal on a lesser flaw
SunlitLow / medium · no exploitation signal

70332

Tracked CVEs

6560

Critical

748

Exploited in wild

1207

Last 7 days

Trending now

Bluesky + Hacker News mentions, last 7 days

1CVE-2026-109618Critical· 9.2RCE via OOM corruption4896
2CVE-2026-109619Critical· 9.2RCE via stale global state2196
3CVE-2026-111497Critical· 9.8Brotli: Out-of-bounds write in the Brotli decoder ("Node2Shell") also affects the PyPI Brotli package1895
4CVE-2026-99999Critical· 9.3In the Linux kernel, the following vulnerability has been resolved: ipv4: validate checksum_start before completing checksum If a packet with bad checksum metadata gets into the ipv4 stack, skb_checksum_help can corrupt the network hea…963
5CVE-2026-110264Critical· 10.0Integer Overflow or Wraparound in GitLab367
6CVE-2026-91403Critical· 9.1Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JSSE)262

This week's digest →All digests

Feed

18 matches

CVE-2026-79658High· 7.5

2mo ago

Ech0 before 5.0.1 does not impose any size or shape limit on the Accept-Language header processed by its i18n middleware, which runs on every HTTP request

Ech0 before 5.0.1 does not impose any size or shape limit on the Accept-Language header processed by its i18n middleware, which runs on every HTTP request. The header is passed unfiltered to go-i18n's NewLocalizer, which internally calls…

▾ Twilightlin-snow · Ech0EPSS 0.51%via NVD

CVE-2026-79669Medium· 4.3

2mo ago

Ech0 before 4.4.3 lacks authorization checks on system log endpoints allowing any authenticated non-admin user to read and stream all server logs

Ech0 before 4.4.3 lacks authorization checks on system log endpoints allowing any authenticated non-admin user to read and stream all server logs. Attackers can access historical logs and real-time log streams via GET /api/system/logs, G…

▾ Sunlitlin-snow · github.com/lin-snow/ech0EPSS 0.28%via NVD

CVE-2026-79664High· 7.4PoC

2mo ago

Ech0 before 4.7.3 fails to properly revoke access tokens created with never-expire option, allowing attackers to maintain perpetual authenticated access after token theft

Ech0 before 4.7.3 fails to properly revoke access tokens created with never-expire option, allowing attackers to maintain perpetual authenticated access after token theft. Three independent revocation mechanisms fail: logout panics on ni…

▾ Midnightlin-snow · github.com/lin-snow/ech0EPSS 0.36%via NVD

CVE-2026-79659High· 7.7PoC

2mo ago

Ech0 before 4.7.3 contains a server-side request forgery vulnerability in the fetchPeerConnectInfo function that uses unvalidated HTTP requests instead of safe request methods with URL validation

Ech0 before 4.7.3 contains a server-side request forgery vulnerability in the fetchPeerConnectInfo function that uses unvalidated HTTP requests instead of safe request methods with URL validation. Authenticated attackers can supply arbit…

▾ Midnightlin-snow · Ech0EPSS 0.35%via NVD

GO-2026-5981None

3mo ago

Ech0: ParseAcceptLanguage `_` separator bypass enables ~70x CPU amplification via Accept-Language header in i18n.Middleware in github.com…

Ech0: ParseAcceptLanguage `_` separator bypass enables ~70x CPU amplification via Accept-Language header in i18n.Middleware in github.com/lin-snow/ech0

▾ Sunlitlin-snow · github.com/lin-snow/ech0via OSV

GHSA-mqxv-9rm6-w8qcHigh

3mo ago

Ech0: ParseAcceptLanguage `_` separator bypass enables ~70x CPU amplification via Accept-Language header in i18n.Middleware

▾ Twilightlin-snow · github.com/lin-snow/ech0via GHSA

CVE-2026-79660Medium· 5.3

6mo ago

Ech0 comment model's Email field returned on public /api/comments endpoints

▾ Sunlitlin-snow · github.com/lin-snow/Ech0EPSS 0.41%via OSV

CVE-2026-79668Medium· 5.3

6mo ago

Ech0's Unauthenticated Like Endpoint Enables Arbitrary Engagement Metric Inflation

▾ Sunlitlin-snow · github.com/lin-snow/ech0EPSS 0.43%via OSV

CVE-2026-79661Medium· 6.5

6mo ago

Ech0 allows PUT /api/echo/like/:id unauthenticated: anonymous callers to modify any echo's fav_count

▾ Sunlitlin-snow · github.com/lin-snow/Ech0EPSS 0.43%via OSV

CVE-2026-79662High· 8.0

6mo ago

Ech0's OAuth redirect URI validation ignores path component, enables exchange-code theft

▾ Twilightlin-snow · github.com/lin-snow/Ech0EPSS 0.32%via OSV

CVE-2026-79663Medium· 4.8

6mo ago

Ech0's RSS feed renders unescaped tag names and raw-HTML markdown, stored XSS against subscribers

▾ Sunlitlin-snow · github.com/lin-snow/Ech0EPSS 0.25%via OSV

GHSA-fpw6-hrg5-q5x5High· 7.4

6mo ago

ech0's acess tokens with expiry=never cannot be revoked: logout panics, delete does not blacklist JTI

▾ Twilightlin-snow · github.com/lin-snow/ech0via OSV

CVE-2026-79671Medium· 5.5

6mo ago

Ech0 has SSRF via DNS Resolution Bypass in Webhook URL Validation

▾ Sunlitlin-snow · github.com/lin-snow/ech0EPSS 0.31%via OSV

CVE-2026-79673Medium· 6.5

6mo ago

Ech0 Scope Bypass: profile:read Access Token Can Change Admin Password and Escalate to Unrestricted Session

▾ Sunlitlin-snow · github.com/lin-snow/ech0EPSS 0.43%via OSV

CVE-2026-79672Medium· 5.5

6mo ago

Ech0 Comment Panel Endpoints Missing RequireScopes Middleware — Scoped Access Token Bypass

▾ Sunlitlin-snow · github.com/lin-snow/ech0EPSS 0.32%via OSV

CVE-2026-79666Medium· 6.5

6mo ago

Ech0: Missing authorization on dashboard log endpoints allows low-privilege users to access sensitive system logs

▾ Sunlitlin-snow · github.com/lin-snow/ech0EPSS 0.39%via OSV

CVE-2026-79670Medium· 4.8

6mo ago

Ech0 has Stored XSS via SVG Upload and Content-Type Validation Bypass in File Upload

▾ Sunlitlin-snow · github.com/lin-snow/ech0EPSS 0.25%via OSV

CVE-2026-79667High· 7.6

6mo ago

Ech0: Scoped admin access tokens can bypass least-privilege controls on privileged endpoints, including backup export

▾ Twilightlin-snow · github.com/lin-snow/ech0EPSS 0.32%via OSV

From the blog

All posts →

Oct 27, 2026

Sound the depths of every vulnerability.

Trending now

Feed

Ech0 before 5.0.1 does not impose any size or shape limit on the Accept-Language header processed by its i18n middleware, which runs on every HTTP request

Ech0 before 4.4.3 lacks authorization checks on system log endpoints allowing any authenticated non-admin user to read and stream all server logs

Ech0 before 4.7.3 fails to properly revoke access tokens created with never-expire option, allowing attackers to maintain perpetual authenticated access after token theft

Ech0 before 4.7.3 contains a server-side request forgery vulnerability in the fetchPeerConnectInfo function that uses unvalidated HTTP requests instead of safe request methods with URL validation

Ech0: ParseAcceptLanguage `_` separator bypass enables ~70x CPU amplification via Accept-Language header in i18n.Middleware in github.com…

Ech0: ParseAcceptLanguage `_` separator bypass enables ~70x CPU amplification via Accept-Language header in i18n.Middleware

Ech0 comment model's Email field returned on public /api/comments endpoints

Ech0's Unauthenticated Like Endpoint Enables Arbitrary Engagement Metric Inflation

Ech0 allows PUT /api/echo/like/:id unauthenticated: anonymous callers to modify any echo's fav_count

Ech0's OAuth redirect URI validation ignores path component, enables exchange-code theft

Ech0's RSS feed renders unescaped tag names and raw-HTML markdown, stored XSS against subscribers

ech0's acess tokens with expiry=never cannot be revoked: logout panics, delete does not blacklist JTI

Ech0 has SSRF via DNS Resolution Bypass in Webhook URL Validation

Ech0 Scope Bypass: profile:read Access Token Can Change Admin Password and Escalate to Unrestricted Session

Ech0 Comment Panel Endpoints Missing RequireScopes Middleware — Scoped Access Token Bypass

Ech0: Missing authorization on dashboard log endpoints allows low-privilege users to access sensitive system logs

Ech0 has Stored XSS via SVG Upload and Content-Type Validation Bypass in File Upload

Ech0: Scoped admin access tokens can bypass least-privilege controls on privileged endpoints, including backup export

From the blog

VulnSea has moved to vulnsea.com (and what changed since September)

What's new: open corpus, three new MCP tools, vendor advisories, package pages

Wiring VulnSea into an agent: a hands-on tutorial

Sound the depths of every vulnerability.

Trending now

Feed

Ech0 before 5.0.1 does not impose any size or shape limit on the Accept-Language header processed by its i18n middleware, which runs on every HTTP request

Ech0 before 4.4.3 lacks authorization checks on system log endpoints allowing any authenticated non-admin user to read and stream all server logs

Ech0 before 4.7.3 fails to properly revoke access tokens created with never-expire option, allowing attackers to maintain perpetual authenticated access after token theft

Ech0 before 4.7.3 contains a server-side request forgery vulnerability in the fetchPeerConnectInfo function that uses unvalidated HTTP requests instead of safe request methods with URL validation

Ech0: ParseAcceptLanguage `_` separator bypass enables ~70x CPU amplification via Accept-Language header in i18n.Middleware in github.com…

Ech0: ParseAcceptLanguage `_` separator bypass enables ~70x CPU amplification via Accept-Language header in i18n.Middleware

Ech0 comment model's Email field returned on public /api/comments endpoints

Ech0's Unauthenticated Like Endpoint Enables Arbitrary Engagement Metric Inflation

Ech0 allows PUT /api/echo/like/:id unauthenticated: anonymous callers to modify any echo's fav_count

Ech0's OAuth redirect URI validation ignores path component, enables exchange-code theft

Ech0's RSS feed renders unescaped tag names and raw-HTML markdown, stored XSS against subscribers

ech0's acess tokens with expiry=never cannot be revoked: logout panics, delete does not blacklist JTI

Ech0 has SSRF via DNS Resolution Bypass in Webhook URL Validation

Ech0 Scope Bypass: profile:read Access Token Can Change Admin Password and Escalate to Unrestricted Session

Ech0 Comment Panel Endpoints Missing RequireScopes Middleware — Scoped Access Token Bypass

Ech0: Missing authorization on dashboard log endpoints allows low-privilege users to access sensitive system logs

Ech0 has Stored XSS via SVG Upload and Content-Type Validation Bypass in File Upload

Ech0: Scoped admin access tokens can bypass least-privilege controls on privileged endpoints, including backup export

From the blog

VulnSea has moved to vulnsea.com (and what changed since September)

What's new: open corpus, three new MCP tools, vendor advisories, package pages

Wiring VulnSea into an agent: a hands-on tutorial