Live CVE & 0day intelligence

Sound the depths of every vulnerability.

Newly released CVEs across every platform — sleek to read, verbose on demand, and served raw as markdown for AI and agent ingestion. Severity reads as depth: the deeper the contact, the graver the threat.

Browse the feed For agents → /llms.txt

Depth = severity + exploitation

HadalCritical and actively exploited (CISA KEV / 0day)
AbyssalCritical with a public exploit or in-the-wild use
MidnightCritical, or high with PoC / in-the-wild
TwilightHigh severity, or a signal on a lesser flaw
SunlitLow / medium · no exploitation signal

70369

Tracked CVEs

6568

Critical

756

Exploited in wild

1072

Last 7 days

Trending now

Bluesky + Hacker News mentions, last 7 days

1CVE-2026-109618Critical· 9.2RCE via OOM corruption4896
2CVE-2026-109619Critical· 9.2RCE via stale global state2196
3CVE-2026-111497Critical· 9.8Brotli: Out-of-bounds write in the Brotli decoder ("Node2Shell") also affects the PyPI Brotli package1895
4CVE-2026-99999Critical· 9.3In the Linux kernel, the following vulnerability has been resolved: ipv4: validate checksum_start before completing checksum If a packet with bad checksum metadata gets into the ipv4 stack, skb_checksum_help can corrupt the network hea…963
5CVE-2026-110264Critical· 10.0Integer Overflow or Wraparound in GitLab367
6CVE-2026-91403Critical· 9.1Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JSSE)262

This week's digest →All digests

Feed

10 matches

CVE-2026-103663Medium· 6.9PoC

3w ago

Ollama is vulnerable to path traversal in the `/api/pull` endpoint due to insufficient validation of layer digests by the `digestToPath` function

Ollama is vulnerable to path traversal in the `/api/pull` endpoint due to insufficient validation of layer digests by the `digestToPath` function. An unauthenticated remote attacker can specify a path traversal sequence as a layer digest…

▾ TwilightOllama · OllamaEPSS 0.71%via NVD

CVE-2026-102697High· 7.8PoC

1mo ago

Ollama versions 0.14.0 before 0.31.2 contain an incorrect authorization vulnerability in the experimental agent mode Bash tool approval mechanism that fails to properly parse shell syntax

Ollama versions 0.14.0 before 0.31.2 contain an incorrect authorization vulnerability in the experimental agent mode Bash tool approval mechanism that fails to properly parse shell syntax. Attackers who can influence model output through…

▾ Midnightollama · ollamaEPSS 0.15%via NVD

CVE-2026-65315High· 7.5

3mo ago

Ollama Remote Denial of Service via Attacker-Controlled Allocation in GGUF Metadata Parser

Ollama (HEAD f0078ae) contains an uncontrolled memory allocation vulnerability in the GGUF metadata parser that allows remote attackers to crash the server by supplying a crafted GGUF file with attacker-controlled length and count fields…

▾ TwilightOllama · OllamaEPSS 0.81%via CVEORG

CVE-2026-15685High· 7.50day

3mo ago

Ollama downloadBlob Improper Validation of Array Index Denial-of-Service Vulnerability. This vulnerability allows remote attackers to cre…

Ollama downloadBlob Improper Validation of Array Index Denial-of-Service Vulnerability. This vulnerability allows remote attackers to create a denial-of-service condition on affected installations of Ollama. Authentication is not require…

▾ Abyssalollama · ollamaEPSS 0.71%via OSV

CVE-2026-7482Critical· 9.1PoC

6mo ago

Ollama contains a heap out-of-bounds read vulnerability in the GGUF model loader

▾ Abyssalollama · github.com/ollama/ollamaEPSS 2.2%via OSV

CVE-2026-7020Medium· 5.6PoC

6mo ago

Ollama is Vulnerable to Path Traversal

▾ Twilightollama · github.com/ollama/ollamaEPSS 0.91%via OSV

CVE-2025-15514High· 7.5PoC

9mo ago

Ollama 0.11.5-rc0 through current version 0.13.5 contain a null pointer dereference vulnerability in the multi-modal model image processing functionality

Ollama 0.11.5-rc0 through current version 0.13.5 contain a null pointer dereference vulnerability in the multi-modal model image processing functionality. When processing base64-encoded image data via the /api/chat endpoint, the applicat…

▾ Midnightollama · ollamaEPSS 0.77%via NVD

CVE-2025-63389Critical· 9.8

10mo ago

A critical authentication bypass vulnerability exists in Ollama platform's API endpoints in versions prior to and including v0.12.3

A critical authentication bypass vulnerability exists in Ollama platform's API endpoints in versions prior to and including v0.12.3. The platform exposes multiple API endpoints without requiring authentication, enabling remote attackers …

▾ Midnightollama · ollamaEPSS 0.71%via NVD

CVE-2024-8063High· 7.5

1y ago

Ollama Divide by Zero Vulnerability

▾ Twilightollama · github.com/ollama/ollamaEPSS 0.64%via OSV

CVE-2024-28224High· 8.8

2y ago

Ollama DNS rebinding vulnerability

▾ Twilightollama · github.com/ollama/ollamaEPSS 0.35%via OSV

From the blog

All posts →

Oct 27, 2026

Sound the depths of every vulnerability.

Trending now

Feed

Ollama is vulnerable to path traversal in the `/api/pull` endpoint due to insufficient validation of layer digests by the `digestToPath` function

Ollama versions 0.14.0 before 0.31.2 contain an incorrect authorization vulnerability in the experimental agent mode Bash tool approval mechanism that fails to properly parse shell syntax

Ollama Remote Denial of Service via Attacker-Controlled Allocation in GGUF Metadata Parser

Ollama downloadBlob Improper Validation of Array Index Denial-of-Service Vulnerability. This vulnerability allows remote attackers to cre…

Ollama contains a heap out-of-bounds read vulnerability in the GGUF model loader

Ollama is Vulnerable to Path Traversal

Ollama 0.11.5-rc0 through current version 0.13.5 contain a null pointer dereference vulnerability in the multi-modal model image processing functionality

A critical authentication bypass vulnerability exists in Ollama platform's API endpoints in versions prior to and including v0.12.3

Ollama Divide by Zero Vulnerability

Ollama DNS rebinding vulnerability

From the blog

VulnSea has moved to vulnsea.com (and what changed since September)

What's new: open corpus, three new MCP tools, vendor advisories, package pages

Wiring VulnSea into an agent: a hands-on tutorial

Sound the depths of every vulnerability.

Trending now

Feed

Ollama is vulnerable to path traversal in the `/api/pull` endpoint due to insufficient validation of layer digests by the `digestToPath` function

Ollama versions 0.14.0 before 0.31.2 contain an incorrect authorization vulnerability in the experimental agent mode Bash tool approval mechanism that fails to properly parse shell syntax

Ollama Remote Denial of Service via Attacker-Controlled Allocation in GGUF Metadata Parser

Ollama downloadBlob Improper Validation of Array Index Denial-of-Service Vulnerability. This vulnerability allows remote attackers to cre…

Ollama contains a heap out-of-bounds read vulnerability in the GGUF model loader

Ollama is Vulnerable to Path Traversal

Ollama 0.11.5-rc0 through current version 0.13.5 contain a null pointer dereference vulnerability in the multi-modal model image processing functionality

A critical authentication bypass vulnerability exists in Ollama platform's API endpoints in versions prior to and including v0.12.3

Ollama Divide by Zero Vulnerability

Ollama DNS rebinding vulnerability

From the blog

VulnSea has moved to vulnsea.com (and what changed since September)

What's new: open corpus, three new MCP tools, vendor advisories, package pages

Wiring VulnSea into an agent: a hands-on tutorial