Live CVE & 0day intelligence

Sound the depths of every vulnerability.

Newly released CVEs across every platform — sleek to read, verbose on demand, and served raw as markdown for AI and agent ingestion. Severity reads as depth: the deeper the contact, the graver the threat.

Browse the feed For agents → /llms.txt

Depth = severity + exploitation

HadalCritical and actively exploited (CISA KEV / 0day)
AbyssalCritical with a public exploit or in-the-wild use
MidnightCritical, or high with PoC / in-the-wild
TwilightHigh severity, or a signal on a lesser flaw
SunlitLow / medium · no exploitation signal

69320

Tracked CVEs

6431

Critical

702

Exploited in wild

4415

Last 7 days

Trending now

Bluesky + Hacker News mentions, last 7 days

1CVE-2026-109618Critical· 9.2RCE via OOM corruption4896
2CVE-2026-109619Critical· 9.2RCE via stale global state2196
3CVE-2026-111497Critical· 9.2Out-of-Bounds Write in Google Brotli Decoder1587
4CVE-2026-99999Critical· 9.3In the Linux kernel, the following vulnerability has been resolved: ipv4: validate checksum_start before completing checksum If a packet with bad checksum metadata gets into the ipv4 stack, skb_checksum_help can corrupt the network hea…963
5CVE-2026-110264Critical· 10.0Integer Overflow or Wraparound in GitLab267
6CVE-2026-108707Critical· 9.8Wukong_HRM through commit 186115e contains an authentication bypass vulnerability in ParamAspect that allows unauthenticated attackers to call every HRM API endpoint by omitting the AUTH-TOKEN header266
7CVE-2026-91403Critical· 9.1Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JSSE)262

This week's digest →All digests

Feed

8 matches

CVE-2025-55059Medium· 4.8

11mo ago

CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')

▾ Sunlitmaxum · rumpusEPSS 0.19%via NVD

CVE-2025-55057Medium· 4.5

11mo ago

Multiple CWE-352 Cross-Site Request Forgery (CSRF)

▾ Sunlitmaxum · rumpusEPSS 0.16%via NVD

CVE-2025-55056Medium· 4.8

11mo ago

Multiple CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')

▾ Sunlitmaxum · rumpusEPSS 0.19%via NVD

CVE-2025-55055Medium· 6.8

11mo ago

CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

▾ Sunlitmaxum · rumpusEPSS 0.82%via NVD

CVE-2025-55058Medium· 4.5

11mo ago

CWE-20 Improper Input Validation

▾ Sunlitmaxum · rumpusEPSS 0.28%via NVD

CVE-2020-27575High· 8.8

5y ago

Maxum Rumpus 8.2.13 and 8.2.14 is affected by a command injection vulnerability

Maxum Rumpus 8.2.13 and 8.2.14 is affected by a command injection vulnerability. The web administration contains functionality in which administrators are able to manage users. The edit users form contains a parameter vulnerable to comma…

▾ Twilightmaxum · rumpusEPSS 3.1%via NVD

CVE-2020-27576Medium· 5.4

5y ago

Maxum Rumpus 8.2.13 and 8.2.14 is affected by cross-site scripting (XSS)

Maxum Rumpus 8.2.13 and 8.2.14 is affected by cross-site scripting (XSS). Users are able to create folders in the web application. The folder name is insufficiently validated resulting in a stored cross-site scripting vulnerability.

▾ Sunlitmaxum · rumpusEPSS 0.56%via NVD

CVE-2020-27574High· 8.8

5y ago

Maxum Rumpus 8.2.13 and 8.2.14 is affected by cross-site request forgery (CSRF)

Maxum Rumpus 8.2.13 and 8.2.14 is affected by cross-site request forgery (CSRF). If an authenticated user visits a malicious page, unintended actions could be performed in the web application as the authenticated user.

▾ Twilightmaxum · rumpusEPSS 0.76%via NVD

From the blog

All posts →

Oct 27, 2026

Sound the depths of every vulnerability.

Trending now

Feed

CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')

Multiple CWE-352 Cross-Site Request Forgery (CSRF)

Multiple CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')

CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

CWE-20 Improper Input Validation

Maxum Rumpus 8.2.13 and 8.2.14 is affected by a command injection vulnerability

Maxum Rumpus 8.2.13 and 8.2.14 is affected by cross-site scripting (XSS)

Maxum Rumpus 8.2.13 and 8.2.14 is affected by cross-site request forgery (CSRF)

From the blog

VulnSea has moved to vulnsea.com (and what changed since September)

What's new: open corpus, three new MCP tools, vendor advisories, package pages

Wiring VulnSea into an agent: a hands-on tutorial

Sound the depths of every vulnerability.

Trending now

Feed

CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')

Multiple CWE-352 Cross-Site Request Forgery (CSRF)

Multiple CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')

CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

CWE-20 Improper Input Validation

Maxum Rumpus 8.2.13 and 8.2.14 is affected by a command injection vulnerability

Maxum Rumpus 8.2.13 and 8.2.14 is affected by cross-site scripting (XSS)

Maxum Rumpus 8.2.13 and 8.2.14 is affected by cross-site request forgery (CSRF)

From the blog

VulnSea has moved to vulnsea.com (and what changed since September)

What's new: open corpus, three new MCP tools, vendor advisories, package pages

Wiring VulnSea into an agent: a hands-on tutorial