Live CVE & 0day intelligence

Sound the depths of every vulnerability.

Newly released CVEs across every platform — sleek to read, verbose on demand, and served raw as markdown for AI and agent ingestion. Severity reads as depth: the deeper the contact, the graver the threat.

Browse the feed For agents → /llms.txt

Depth = severity + exploitation

HadalCritical and actively exploited (CISA KEV / 0day)
AbyssalCritical with a public exploit or in-the-wild use
MidnightCritical, or high with PoC / in-the-wild
TwilightHigh severity, or a signal on a lesser flaw
SunlitLow / medium · no exploitation signal

74874

Tracked CVEs

6997

Critical

765

Exploited in wild

5496

Last 7 days

Trending now

Bluesky + Hacker News mentions, last 7 days

1CVE-2026-109618Critical· 9.2RCE via OOM corruption4896
2CVE-2026-109619Critical· 9.2RCE via stale global state2196
3CVE-2026-111497Critical· 9.2Out-of-Bounds Write in Google Brotli Decoder1892
4CVE-2026-99999Critical· 9.3In the Linux kernel, the following vulnerability has been resolved: ipv4: validate checksum_start before completing checksum If a packet with bad checksum metadata gets into the ipv4 stack, skb_checksum_help can corrupt the network hea…963
5CVE-2026-110264Critical· 10.0Integer Overflow or Wraparound in GitLab367
6CVE-2026-112816Critical· 10.0Improper certificate validation in the HTTPS listener in LXD367
7CVE-2026-116366Critical· 9.5Unauthenticated RCE vulnerability against ClickHouse Server364
8CVE-2026-97631Critical· 9.5Pre-boot RCE in EDK II PXE driver264

This week's digest →All digests

Feed

14 matches

CVE-2026-116078High· 8.7PoC

1w ago

HTTP/2 request bodies made of 1-byte DATA frames amplify memory use in Bandit

Allocation of Resources Without Limits or Throttling vulnerability in the HTTP/2 request body reader of mtrudel bandit allows an unauthenticated remote attacker to exhaust server memory via a request body sent as many 1-byte DATA frames.…

▾ Midnightmtrudel · banditEPSS 0.49%via CVEORG

CVE-2026-114216Medium· 6.3

1w ago

Chunk extensions accept bare LF and CR, enabling request smuggling in Bandit

Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') vulnerability in the HTTP/1.1 chunked body reader of mtrudel bandit allows an unauthenticated remote attacker to smuggle a second request past a front-end p…

▾ Sunlitmtrudel · banditEPSS 0.60%via CVEORG

CVE-2026-115269High· 8.7

1w ago

HTTP/2 WINDOW_UPDATE and SETTINGS frames reset the request body read timeout in Bandit

Allocation of Resources Without Limits or Throttling vulnerability in the HTTP/2 request body reader of mtrudel bandit allows an unauthenticated remote attacker to hold stream processes open indefinitely via WINDOW_UPDATE or empty SETTIN…

▾ Twilightmtrudel · banditEPSS 0.60%via CVEORG

CVE-2026-110314Medium· 6.3PoC

1w ago

WebSocket frames keep reaching the WebSock after a server-initiated close in Bandit

Client-Side Enforcement of Server-Side Security vulnerability in the WebSocket connection handling of mtrudel bandit allows a remote client to keep running WebSock handler code after the server has stopped its connection, via data frames…

▾ Twilightmtrudel · banditEPSS 0.38%via CVEORG

CVE-2026-114213High· 8.7

1w ago

WebSocket 1-byte continuation frames bypass `max_fragmented_message_size` in Bandit

Allocation of Resources Without Limits or Throttling vulnerability in the WebSocket fragment reassembly of mtrudel bandit allows an unauthenticated remote attacker to exhaust server memory via a fragmented message made of many 1-byte con…

▾ Twilightmtrudel · banditEPSS 0.60%via CVEORG

CVE-2026-109584High· 8.7

1w ago

HTTP/2 cookie crumb join expands a small HPACK header block into an unbounded allocation in Bandit

Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in the HTTP/2 implementation of mtrudel bandit allows an unauthenticated remote attacker to exhaust server memory via a small HPACK-compressed HEADERS block. …

▾ Twilightmtrudel · banditEPSS 0.60%via CVEORG

CVE-2026-108525High· 8.7

1w ago

HTTP/2 inbound flow control is not enforced, letting a client queue unbounded DATA in stream processes in Bandit

Allocation of Resources Without Limits or Throttling vulnerability in the HTTP/2 implementation of mtrudel bandit allows an unauthenticated remote attacker to exhaust server memory via DATA frames sent past the advertised receive window.…

▾ Twilightmtrudel · banditEPSS 0.60%via CVEORG

CVE-2026-113436High· 8.7

1w ago

Quadratic bignum parsing of Content-Length and Host port values in Bandit

Inefficient Algorithmic Complexity vulnerability in the header integer parser of mtrudel bandit allows an unauthenticated remote attacker to consume server CPU via a content-length value or a Host or :authority port made of thousands of …

▾ Twilightmtrudel · banditEPSS 0.60%via CVEORG

CVE-2026-110499High· 8.7

1w ago

Client-chosen HPACK encoder table size is applied uncapped, growing per-connection state with every response in Bandit

Allocation of Resources Without Limits or Throttling vulnerability in the HTTP/2 implementation of mtrudel bandit allows an unauthenticated remote attacker to grow per-connection memory and CPU cost without bound via a large SETTINGS_HEA…

▾ Twilightmtrudel · banditEPSS 0.60%via CVEORG

CVE-2026-111103High· 8.2

1w ago

HTTP/2 StreamError recovery rolls back connection state and bypasses per-connection limits in Bandit

Improper Cleanup on Thrown Exception vulnerability in the HTTP/2 handler of mtrudel bandit allows an unauthenticated remote attacker to bypass per-connection resource limits via a single TCP write that carries several frames, one of whic…

▾ Twilightmtrudel · banditEPSS 0.63%via CVEORG

CVE-2026-108529High· 8.7

1w ago

SETTINGS and stream-0 WINDOW_UPDATE frames trigger quadratic work over blocked streams in Bandit

Inefficient Algorithmic Complexity vulnerability in the HTTP/2 implementation of mtrudel bandit allows an unauthenticated remote attacker to exhaust server CPU via small SETTINGS or connection-level WINDOW_UPDATE frames. The attacker ope…

▾ Twilightmtrudel · banditEPSS 0.60%via CVEORG

CVE-2026-111101High· 8.7

1w ago

HTTP/1.1 chunked request bodies made of 1-byte chunks amplify memory use in Bandit

Allocation of Resources Without Limits or Throttling vulnerability in the HTTP/1.1 chunked body reader of mtrudel bandit allows an unauthenticated remote attacker to exhaust server memory and CPU via a request body made of many 1-byte ch…

▾ Twilightmtrudel · banditEPSS 0.60%via CVEORG

CVE-2026-105660Medium· 6.9PoC

3w ago

Improper Validation of Syntactic Correctness of Input vulnerability in mtrudel bandit allows an unauthenticated remote attacker to set conn.host and conn.port to values outside the RFC 3986 host grammar via the authority of an HTTP/1 abs…

Improper Validation of Syntactic Correctness of Input vulnerability in mtrudel bandit allows an unauthenticated remote attacker to set conn.host and conn.port to values outside the RFC 3986 host grammar via the authority of an HTTP/1 abs…

▾ Twilightmtrudel · banditEPSS 0.62%via NVD

CVE-2026-105659High· 8.7PoC

3w ago

Uncontrolled Resource Consumption vulnerability in mtrudel bandit allows an unauthenticated remote attacker to pin HTTP/2 stream processes indefinitely via a trickle of small WINDOW_UPDATE frames

Uncontrolled Resource Consumption vulnerability in mtrudel bandit allows an unauthenticated remote attacker to pin HTTP/2 stream processes indefinitely via a trickle of small WINDOW_UPDATE frames. A stream whose response outruns the conn…

▾ Midnightmtrudel · banditEPSS 0.62%via NVD

From the blog

All posts →

Oct 27, 2026

Sound the depths of every vulnerability.

Trending now

Feed

HTTP/2 request bodies made of 1-byte DATA frames amplify memory use in Bandit

Chunk extensions accept bare LF and CR, enabling request smuggling in Bandit

HTTP/2 WINDOW_UPDATE and SETTINGS frames reset the request body read timeout in Bandit

WebSocket frames keep reaching the WebSock after a server-initiated close in Bandit

WebSocket 1-byte continuation frames bypass `max_fragmented_message_size` in Bandit

HTTP/2 cookie crumb join expands a small HPACK header block into an unbounded allocation in Bandit

HTTP/2 inbound flow control is not enforced, letting a client queue unbounded DATA in stream processes in Bandit

Quadratic bignum parsing of Content-Length and Host port values in Bandit

Client-chosen HPACK encoder table size is applied uncapped, growing per-connection state with every response in Bandit

HTTP/2 StreamError recovery rolls back connection state and bypasses per-connection limits in Bandit

SETTINGS and stream-0 WINDOW_UPDATE frames trigger quadratic work over blocked streams in Bandit

HTTP/1.1 chunked request bodies made of 1-byte chunks amplify memory use in Bandit

Improper Validation of Syntactic Correctness of Input vulnerability in mtrudel bandit allows an unauthenticated remote attacker to set conn.host and conn.port to values outside the RFC 3986 host grammar via the authority of an HTTP/1 abs…

Uncontrolled Resource Consumption vulnerability in mtrudel bandit allows an unauthenticated remote attacker to pin HTTP/2 stream processes indefinitely via a trickle of small WINDOW_UPDATE frames

From the blog

VulnSea has moved to vulnsea.com (and what changed since September)

What's new: open corpus, three new MCP tools, vendor advisories, package pages

Wiring VulnSea into an agent: a hands-on tutorial

Sound the depths of every vulnerability.

Trending now

Feed

HTTP/2 request bodies made of 1-byte DATA frames amplify memory use in Bandit

Chunk extensions accept bare LF and CR, enabling request smuggling in Bandit

HTTP/2 WINDOW_UPDATE and SETTINGS frames reset the request body read timeout in Bandit

WebSocket frames keep reaching the WebSock after a server-initiated close in Bandit

WebSocket 1-byte continuation frames bypass `max_fragmented_message_size` in Bandit

HTTP/2 cookie crumb join expands a small HPACK header block into an unbounded allocation in Bandit

HTTP/2 inbound flow control is not enforced, letting a client queue unbounded DATA in stream processes in Bandit

Quadratic bignum parsing of Content-Length and Host port values in Bandit

Client-chosen HPACK encoder table size is applied uncapped, growing per-connection state with every response in Bandit

HTTP/2 StreamError recovery rolls back connection state and bypasses per-connection limits in Bandit

SETTINGS and stream-0 WINDOW_UPDATE frames trigger quadratic work over blocked streams in Bandit

HTTP/1.1 chunked request bodies made of 1-byte chunks amplify memory use in Bandit

Improper Validation of Syntactic Correctness of Input vulnerability in mtrudel bandit allows an unauthenticated remote attacker to set conn.host and conn.port to values outside the RFC 3986 host grammar via the authority of an HTTP/1 abs…

Uncontrolled Resource Consumption vulnerability in mtrudel bandit allows an unauthenticated remote attacker to pin HTTP/2 stream processes indefinitely via a trickle of small WINDOW_UPDATE frames

From the blog

VulnSea has moved to vulnsea.com (and what changed since September)

What's new: open corpus, three new MCP tools, vendor advisories, package pages

Wiring VulnSea into an agent: a hands-on tutorial