Live CVE & 0day intelligence

Sound the depths of every vulnerability.

Newly released CVEs across every platform — sleek to read, verbose on demand, and served raw as markdown for AI and agent ingestion. Severity reads as depth: the deeper the contact, the graver the threat.

Browse the feed For agents → /llms.txt

Depth = severity + exploitation

HadalCritical and actively exploited (CISA KEV / 0day)
AbyssalCritical with a public exploit or in-the-wild use
MidnightCritical, or high with PoC / in-the-wild
TwilightHigh severity, or a signal on a lesser flaw
SunlitLow / medium · no exploitation signal

74895

Tracked CVEs

6999

Critical

765

Exploited in wild

5517

Last 7 days

Trending now

Bluesky + Hacker News mentions, last 7 days

1CVE-2026-109618Critical· 9.2RCE via OOM corruption4896
2CVE-2026-109619Critical· 9.2RCE via stale global state2196
3CVE-2026-111497Critical· 9.2Out-of-Bounds Write in Google Brotli Decoder1892
4CVE-2026-110264Critical· 10.0Integer Overflow or Wraparound in GitLab367
5CVE-2026-112816Critical· 10.0Improper certificate validation in the HTTPS listener in LXD367
6CVE-2026-116366Critical· 9.5Unauthenticated RCE vulnerability against ClickHouse Server364
7CVE-2026-97631Critical· 9.5Pre-boot RCE in EDK II PXE driver264
8CVE-2026-91403Critical· 9.1Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JSSE)262

This week's digest →All digests

Feed

15 matches

CVE-2026-116251Medium· 4.2

1w ago

pgAdmin 4: A user's other sessions survive a change of their password

pgAdmin 4 did not invalidate a user's existing sessions when their password changed, either through the user's own change password dialog or through an administrator resetting it in User Management. A session established before the chang…

▾ Sunlitpgadmin.org · pgAdmin 4EPSS 0.11%via CVEORG

CVE-2026-116252Medium· 6.5

1w ago

pgAdmin 4: Materialized view refresh redirects its connection through a crafted database name

pgAdmin 4's materialized view refresh passed the target database's name to psql's --dbname argument unchanged. libpq treats a --dbname value containing "=" (or a postgresql:// URI) as a full connection string, whose keywords override the…

▾ Sunlitpgadmin.org · pgAdmin 4EPSS 0.26%via CVEORG

CVE-2026-116249High· 8.4

1w ago

pgAdmin 4: Connection file paths and parameter keys escape the user's storage directory

In server mode pgAdmin 4 resolves a server's password file, SSL certificate, key, CRL and SSH tunnel identity file relative to the user's storage directory, but get_complete_file_path() only stripped leading slashes before joining the tw…

▾ Twilightpgadmin.org · pgAdmin 4EPSS 0.18%via CVEORG

CVE-2026-116250Medium· 6.5

1w ago

pgAdmin 4: Files opened in a storage directory follow a symbolic link, hard link or FIFO planted after the containment check

In server mode pgAdmin 4 validates a path a user gives for a file in their storage directory with check_access_permission() and then opened it by name. Several places opened it with a plain open() or handed the path to a utility that ope…

▾ Sunlitpgadmin.org · pgAdmin 4EPSS 0.10%via CVEORG

CVE-2026-116241Critical· 9.9

1w ago

pgAdmin 4: Import/Export Data query export runs a command through a backslash in a double-quoted identifier

pgAdmin 4's Import/Export Data tool wraps a user's query export in a psql \copy (...) TO command and checks that the query's parentheses are balanced so that nothing can escape the wrapper. The check rejected a backslash inside a single-…

▾ Midnightpgadmin.org · pgAdmin 4EPSS 0.32%via CVEORG

CVE-2026-116248Medium· 6.8

1w ago

pgAdmin 4: Non-administrators can share a server with every user

In pgAdmin 4 server mode only administrators are meant to share a server with all users; the server dialog shows the Shared switch only to them. The create and update endpoints of the server API, however, stored the "shared" flag and sha…

▾ Sunlitpgadmin.org · pgAdmin 4EPSS 0.23%via CVEORG

CVE-2026-116247High· 8.2

1w ago

pgAdmin 4: libpq uses the pgAdmin service account's own password file and client certificate

When a server in pgAdmin 4 had no password file, client certificate or client key configured, or the configured one could not be found, pgAdmin left the parameter out of the connection and libpq fell back to the defaults of the operating…

▾ Twilightpgadmin.org · pgAdmin 4EPSS 0.13%via CVEORG

CVE-2026-116246Medium· 6.5

1w ago

pgAdmin 4: Server passwords are left in pgAdmin's process environment

To pass a server's password to psql and to the utilities pgAdmin 4 runs as background processes, the server manager wrote it into pgAdmin's own process environment: as PGPASSWORD for the PSQL tool, and under a per-process variable for a …

▾ Sunlitpgadmin.org · pgAdmin 4EPSS 0.19%via CVEORG

CVE-2026-116243High· 7.5

1w ago

pgAdmin 4: Utility binary path can point at a shared storage directory

pgAdmin 4 runs pg_dump, pg_restore, pg_dumpall and psql from the binary path a user sets in their preferences. In server mode the binary path was refused only when it lay under the per-user storage directory (STORAGE_DIR), not under a SH…

▾ Twilightpgadmin.org · pgAdmin 4EPSS 0.32%via CVEORG

CVE-2026-116245High· 8.2

1w ago

pgAdmin 4: Connection services are not restricted in server mode

libpq looks a connection service up in the service file of the operating-system account running pgAdmin 4, and an entry there can hold a password or name a password file or client certificate. In server mode any user could set a server's…

▾ Twilightpgadmin.org · pgAdmin 4EPSS 0.16%via CVEORG

CVE-2026-116244High· 8.2PoC

1w ago

pgAdmin 4: libpq uses the pgAdmin service account's Kerberos credentials

When a pgAdmin 4 connection was not meant to use a Kerberos user's delegated credentials, pgAdmin removed KRB5CCNAME from its environment, so the Kerberos library fell back to the default credential cache, or a client keytab, of the oper…

▾ Midnightpgadmin.org · pgAdmin 4EPSS 0.28%via CVEORG

CVE-2026-116242High· 8.2

1w ago

pgAdmin 4: SSH tunnels use the pgAdmin service account's own SSH identity

pgAdmin 4 opens SSH tunnels with the sshtunnel library but gave it neither host_pkey_directories nor ssh_config_file, so it always loaded the unencrypted private keys in ~/.ssh of the operating-system account running pgAdmin, read that a…

▾ Twilightpgadmin.org · pgAdmin 4EPSS 0.23%via CVEORG

CVE-2026-116238High· 8.1

1w ago

pgAdmin 4: The failed login limit can be bypassed, and Flask-Security's own views skip pgAdmin's login and password checks

In server mode pgAdmin 4 locks an internal account after MAX_LOGIN_ATTEMPTS failed logins (3 by default). The limit could be bypassed, giving an unauthenticated attacker an unlimited number of password guesses against any internal accoun…

▾ Twilightpgadmin.org · pgAdmin 4EPSS 0.40%via CVEORG

CVE-2026-116240Medium· 6.5

1w ago

pgAdmin 4: File Manager and storage-path tools act on a different path from the one checked

In server mode pgAdmin 4 validates a path into the user's storage directory with check_access_permission(), which builds the absolute path with get_abs_path(). Several callers then acted on a path they built differently, so the path chec…

▾ Sunlitpgadmin.org · pgAdmin 4EPSS 0.26%via CVEORG

CVE-2026-116239High· 8.5

1w ago

pgAdmin 4: An LDAP or Kerberos login is logged in to another account with the same username

In server mode pgAdmin 4 keeps an account per authentication source, so the same username can exist as, for example, an internal account and an LDAP account. After LDAP or Kerberos authenticated a user, pgAdmin chose the account to log i…

▾ Twilightpgadmin.org · pgAdmin 4EPSS 0.39%via CVEORG

From the blog

All posts →

Oct 27, 2026

Sound the depths of every vulnerability.

Trending now

Feed

pgAdmin 4: A user's other sessions survive a change of their password

pgAdmin 4: Materialized view refresh redirects its connection through a crafted database name

pgAdmin 4: Connection file paths and parameter keys escape the user's storage directory

pgAdmin 4: Files opened in a storage directory follow a symbolic link, hard link or FIFO planted after the containment check

pgAdmin 4: Import/Export Data query export runs a command through a backslash in a double-quoted identifier

pgAdmin 4: Non-administrators can share a server with every user

pgAdmin 4: libpq uses the pgAdmin service account's own password file and client certificate

pgAdmin 4: Server passwords are left in pgAdmin's process environment

pgAdmin 4: Utility binary path can point at a shared storage directory

pgAdmin 4: Connection services are not restricted in server mode

pgAdmin 4: libpq uses the pgAdmin service account's Kerberos credentials

pgAdmin 4: SSH tunnels use the pgAdmin service account's own SSH identity

pgAdmin 4: The failed login limit can be bypassed, and Flask-Security's own views skip pgAdmin's login and password checks

pgAdmin 4: File Manager and storage-path tools act on a different path from the one checked

pgAdmin 4: An LDAP or Kerberos login is logged in to another account with the same username

From the blog

VulnSea has moved to vulnsea.com (and what changed since September)

What's new: open corpus, three new MCP tools, vendor advisories, package pages

Wiring VulnSea into an agent: a hands-on tutorial

Sound the depths of every vulnerability.

Trending now

Feed

pgAdmin 4: A user's other sessions survive a change of their password

pgAdmin 4: Materialized view refresh redirects its connection through a crafted database name

pgAdmin 4: Connection file paths and parameter keys escape the user's storage directory

pgAdmin 4: Files opened in a storage directory follow a symbolic link, hard link or FIFO planted after the containment check

pgAdmin 4: Import/Export Data query export runs a command through a backslash in a double-quoted identifier

pgAdmin 4: Non-administrators can share a server with every user

pgAdmin 4: libpq uses the pgAdmin service account's own password file and client certificate

pgAdmin 4: Server passwords are left in pgAdmin's process environment

pgAdmin 4: Utility binary path can point at a shared storage directory

pgAdmin 4: Connection services are not restricted in server mode

pgAdmin 4: libpq uses the pgAdmin service account's Kerberos credentials

pgAdmin 4: SSH tunnels use the pgAdmin service account's own SSH identity

pgAdmin 4: The failed login limit can be bypassed, and Flask-Security's own views skip pgAdmin's login and password checks

pgAdmin 4: File Manager and storage-path tools act on a different path from the one checked

pgAdmin 4: An LDAP or Kerberos login is logged in to another account with the same username

From the blog

VulnSea has moved to vulnsea.com (and what changed since September)

What's new: open corpus, three new MCP tools, vendor advisories, package pages

Wiring VulnSea into an agent: a hands-on tutorial