Live CVE & 0day intelligence

Sound the depths of every vulnerability.

Newly released CVEs across every platform — sleek to read, verbose on demand, and served raw as markdown for AI and agent ingestion. Severity reads as depth: the deeper the contact, the graver the threat.

Browse the feed For agents → /llms.txt

Depth = severity + exploitation

HadalCritical and actively exploited (CISA KEV / 0day)
AbyssalCritical with a public exploit or in-the-wild use
MidnightCritical, or high with PoC / in-the-wild
TwilightHigh severity, or a signal on a lesser flaw
SunlitLow / medium · no exploitation signal

68916

Tracked CVEs

6395

Critical

701

Exploited in wild

5013

Last 7 days

Trending now

Bluesky + Hacker News mentions, last 7 days

1CVE-2026-109618Critical· 9.2RCE via OOM corruption4896
2CVE-2026-109619Critical· 9.2RCE via stale global state2196
3CVE-2026-111497Critical· 9.2Out-of-Bounds Write in Google Brotli Decoder1587
4CVE-2026-99999Critical· 9.3In the Linux kernel, the following vulnerability has been resolved: ipv4: validate checksum_start before completing checksum If a packet with bad checksum metadata gets into the ipv4 stack, skb_checksum_help can corrupt the network hea…863
5CVE-2026-110264Critical· 10.0Integer Overflow or Wraparound in GitLab267
6CVE-2026-108707Critical· 9.8Wukong_HRM through commit 186115e contains an authentication bypass vulnerability in ParamAspect that allows unauthenticated attackers to call every HRM API endpoint by omitting the AUTH-TOKEN header266

This week's digest →All digests

Feed

19 matches

CVE-2026-61801Medium· 5.5

2w ago

The `github.com/moby/sys/user` package provides Go utilities for parsing and looking up entries in Unix-style user and group database files

The `github.com/moby/sys/user` package provides Go utilities for parsing and looking up entries in Unix-style user and group database files. Versions before 0.4.1 do not sufficiently limit entries when parsing `/etc/passwd`- or `/etc/gro…

▾ Sunlitmoby · sysEPSS 0.12%via NVD

CVE-2026-93321Medium· 6.9

3w ago

A malicious frontend can submit an LLB definition that causes buildkitd to panic and terminate, interrupting all builds running on that daemon.

▾ Sunlitmoby · github.com/moby/buildkitEPSS 0.15%via NVD

CVE-2026-93315Medium· 5.8

3w ago

When proxy networking with CA injection is enabled, a build can modify its CA bundle before cleanup

When proxy networking with CA injection is enabled, a build can modify its CA bundle before cleanup. This may cause cleanup to block, operate outside the build rootfs, or fail without failing the build.

▾ Sunlitmoby · github.com/moby/buildkitEPSS 0.10%via NVD

CVE-2026-93326Medium· 6.0

3w ago

A build step for a Git source, crafted in a specific way, can bypass some policy validation rules

A build step for a Git source, crafted in a specific way, can bypass some policy validation rules. A malicious build definition can make the repository look like it is coming from a different remote URL than it really is when Git clone i…

▾ Sunlitmoby · github.com/moby/buildkitEPSS 0.25%via NVD

CVE-2026-93323Medium· 6.8

3w ago

The Dockerfile frontend loaded the Dockerfile and .dockerignore files of a build context into memory without a size limit

The Dockerfile frontend loaded the Dockerfile and .dockerignore files of a build context into memory without a size limit. A build context containing an oversized file could make buildkitd allocate memory proportional to that file, poten…

▾ Sunlitmoby · github.com/moby/buildkitEPSS 0.11%via NVD

CVE-2026-93322Medium· 6.9

3w ago

A malicious frontend can submit an LLB definition that causes buildkitd to panic and terminate, interrupting all builds running on that daemon.

▾ Sunlitmoby · github.com/moby/buildkitEPSS 0.13%via NVD

CVE-2026-93320Medium· 6.0⚖ disputed

3w ago

BuildKit may be tricked into performing file actions with special file inodes where regular files are expected

BuildKit may be tricked into performing file actions with special file inodes where regular files are expected. Special files may block operations or, on rootful workers, allow unintended host device access.

▾ Sunlitmoby · github.com/moby/buildkitEPSS 0.11%via NVD

CVE-2026-93319Medium· 5.7

3w ago

A malicious external BuildKit frontend can send requests using the internal API that can create conditions for a data race that can cause the BuildKit daemon to panic.

▾ Sunlitmoby · github.com/moby/buildkitEPSS 0.09%via NVD

CVE-2026-93318High· 7.5

3w ago

A malicious image can advertise DiffIDs from another image while containing different layer contents

A malicious image can advertise DiffIDs from another image while containing different layer contents. In affected versions, BuildKit could use the advertised DiffIDs to derive cache and snapshot identity without validating that they matc…

▾ Twilightmoby · github.com/moby/buildkitEPSS 0.17%via NVD

CVE-2026-93317Medium· 5.9

3w ago

An unauthenticated attacker controlling a registry or OCI-layout blob source could provide blob contents that did not match the claimed digest

An unauthenticated attacker controlling a registry or OCI-layout blob source could provide blob contents that did not match the claimed digest. The resulting snapshot could be cached under that digest and reused by a later victim build, …

▾ Sunlitmoby · github.com/moby/buildkitEPSS 0.16%via NVD

CVE-2026-93316High· 7.1

3w ago

If BuildKit daemon is started with --cdi-disabled it can lead to daemon panic when builds try to use CDI devices

If BuildKit daemon is started with --cdi-disabled it can lead to daemon panic when builds try to use CDI devices. This can happen maliciously or by accident.

▾ Twilightmoby · BuildKitEPSS 0.24%via NVD

CVE-2026-75593High· 7.2

2mo ago

BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and repeatable manner

BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and repeatable manner. Prior to 0.31.2, a custom client can produce such an upload request to the BuildKit daemon that files can escape from …

▾ Twilightmoby · buildkitEPSS 0.54%via NVD

CVE-2026-41567High· 7.2PoC

4mo ago

Moby is an open source container framework

Moby is an open source container framework. In versions prior to 29.5.1 and in moby/moby v2 prior to v2.0.0-beta.14, when a compressed archive is uploaded to a container via `PUT /containers/{id}/archive` or piped through `docker cp -`, …

▾ Midnightmoby · moby/v2/daemonEPSS 0.15%via NVD

CVE-2026-35469Medium· 6.5⚖ disputed

6mo ago

spdystream is a Go library for multiplexing streams over SPDY connections

spdystream is a Go library for multiplexing streams over SPDY connections. In versions 0.5.0 and below, the SPDY/3 frame parser does not validate attacker-controlled counts and lengths before allocating memory. Three allocation paths are…

▾ Sunlitmoby · spdystreamEPSS 0.66%via NVD

CVE-2024-36621Medium· 6.5

1y ago

From the blog

All posts →

Oct 27, 2026

Sound the depths of every vulnerability.

Trending now

Feed

The `github.com/moby/sys/user` package provides Go utilities for parsing and looking up entries in Unix-style user and group database files

A malicious frontend can submit an LLB definition that causes buildkitd to panic and terminate, interrupting all builds running on that daemon.

When proxy networking with CA injection is enabled, a build can modify its CA bundle before cleanup

A build step for a Git source, crafted in a specific way, can bypass some policy validation rules

The Dockerfile frontend loaded the Dockerfile and .dockerignore files of a build context into memory without a size limit

A malicious frontend can submit an LLB definition that causes buildkitd to panic and terminate, interrupting all builds running on that daemon.

BuildKit may be tricked into performing file actions with special file inodes where regular files are expected

A malicious external BuildKit frontend can send requests using the internal API that can create conditions for a data race that can cause the BuildKit daemon to panic.

A malicious image can advertise DiffIDs from another image while containing different layer contents

An unauthenticated attacker controlling a registry or OCI-layout blob source could provide blob contents that did not match the claimed digest

If BuildKit daemon is started with --cdi-disabled it can lead to daemon panic when builds try to use CDI devices

BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and repeatable manner

Moby is an open source container framework

spdystream is a Go library for multiplexing streams over SPDY connections

Moby Race Condition vulnerability

BuildKit vulnerable to possible host system access from mount stub cleaner

moby Access to remapped root allows privilege escalation to real root

moby docker daemon crash during image pull of malicious image

Moby (Docker Engine) Insufficiently restricted permissions on data directory

From the blog

VulnSea has moved to vulnsea.com (and what changed since September)

What's new: open corpus, three new MCP tools, vendor advisories, package pages

Wiring VulnSea into an agent: a hands-on tutorial

Sound the depths of every vulnerability.

Trending now

Feed

The `github.com/moby/sys/user` package provides Go utilities for parsing and looking up entries in Unix-style user and group database files

A malicious frontend can submit an LLB definition that causes buildkitd to panic and terminate, interrupting all builds running on that daemon.

When proxy networking with CA injection is enabled, a build can modify its CA bundle before cleanup

A build step for a Git source, crafted in a specific way, can bypass some policy validation rules

The Dockerfile frontend loaded the Dockerfile and .dockerignore files of a build context into memory without a size limit

A malicious frontend can submit an LLB definition that causes buildkitd to panic and terminate, interrupting all builds running on that daemon.

BuildKit may be tricked into performing file actions with special file inodes where regular files are expected

A malicious external BuildKit frontend can send requests using the internal API that can create conditions for a data race that can cause the BuildKit daemon to panic.

A malicious image can advertise DiffIDs from another image while containing different layer contents

An unauthenticated attacker controlling a registry or OCI-layout blob source could provide blob contents that did not match the claimed digest

If BuildKit daemon is started with --cdi-disabled it can lead to daemon panic when builds try to use CDI devices

BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and repeatable manner

Moby is an open source container framework

spdystream is a Go library for multiplexing streams over SPDY connections

Moby Race Condition vulnerability

BuildKit vulnerable to possible host system access from mount stub cleaner

moby Access to remapped root allows privilege escalation to real root

moby docker daemon crash during image pull of malicious image

Moby (Docker Engine) Insufficiently restricted permissions on data directory

From the blog

VulnSea has moved to vulnsea.com (and what changed since September)

What's new: open corpus, three new MCP tools, vendor advisories, package pages

Wiring VulnSea into an agent: a hands-on tutorial