Live CVE & 0day intelligence

Sound the depths of every vulnerability.

Newly released CVEs across every platform — sleek to read, verbose on demand, and served raw as markdown for AI and agent ingestion. Severity reads as depth: the deeper the contact, the graver the threat.

Browse the feed For agents → /llms.txt

Depth = severity + exploitation

HadalCritical and actively exploited (CISA KEV / 0day)
AbyssalCritical with a public exploit or in-the-wild use
MidnightCritical, or high with PoC / in-the-wild
TwilightHigh severity, or a signal on a lesser flaw
SunlitLow / medium · no exploitation signal

68790

Tracked CVEs

6389

Critical

701

Exploited in wild

4974

Last 7 days

Trending now

Bluesky + Hacker News mentions, last 7 days

1CVE-2026-109618Critical· 9.2RCE via OOM corruption4896
2CVE-2026-109619Critical· 9.2RCE via stale global state2196
3CVE-2026-111497Critical· 9.2Out-of-Bounds Write in Google Brotli Decoder1580
4CVE-2026-99999Critical· 9.3In the Linux kernel, the following vulnerability has been resolved: ipv4: validate checksum_start before completing checksum If a packet with bad checksum metadata gets into the ipv4 stack, skb_checksum_help can corrupt the network hea…863
5CVE-2026-110264Critical· 10.0Integer Overflow or Wraparound in GitLab267
6CVE-2026-108707Critical· 9.8Wukong_HRM through commit 186115e contains an authentication bypass vulnerability in ParamAspect that allows unauthenticated attackers to call every HRM API endpoint by omitting the AUTH-TOKEN header266

This week's digest →All digests

Feed

23 matches

CVE-2026-61441Medium· 6.5

3w ago

PraisonAI: Platform members can delete owner issue dependencies through member-owned related issues

▾ Sunlitpraisonai-platform · praisonai-platformEPSS 0.29%via OSV

CVE-2026-48169High· 8.8

2mo ago

PraisonAI is a multi-agent teams system

PraisonAI is a multi-agent teams system. Versions prior to 0.1.4 of the PraisonAI Platform API have two authorization failures that together break workspace isolation. The service layer for issues and projects performs global primary-key…

▾ Twilightpraisonai-platform · praisonai-platformEPSS 0.44%via NVD

GHSA-vp55-5c2v-3597High· 6.5

3mo ago

Duplicate Advisory: PraisonAI: Platform members can rewrite shared labels and owner issue labels without owner/admin authorization

▾ Twilightpraisonai-platform · praisonai-platformvia GHSA

CVE-2026-61440Medium· 6.5

3mo ago

PraisonAI Platform before 0.1.9 fails to properly authorize label and issue-label mutations, allowing workspace members to rename and recolor shared labels and add or remove labels on owner-created issues

PraisonAI Platform before 0.1.9 fails to properly authorize label and issue-label mutations, allowing workspace members to rename and recolor shared labels and add or remove labels on owner-created issues. Attackers with workspace member…

▾ Sunlitpraisonai-platform · praisonai-platformEPSS 0.26%via NVD

GHSA-f996-h3c6-gcwgHigh· 7.1

3mo ago

Duplicate Advisory: PraisonAI: Platform member PATCH routes allow owner resource rewrites and project lead reassignment delete bypass

▾ Twilightpraisonai-platform · praisonai-platformvia GHSA

CVE-2026-61442High· 7.1

3mo ago

PraisonAI Platform (praisonai-platform) before 0.1.9 fails to enforce owner/admin authorization on the PATCH routes for projects, issues, and agents, which only require workspace-member role

PraisonAI Platform (praisonai-platform) before 0.1.9 fails to enforce owner/admin authorization on the PATCH routes for projects, issues, and agents, which only require workspace-member role. A workspace member can modify owner-created r…

▾ Twilightpraisonai-platform · praisonai-platformEPSS 0.31%via NVD

CVE-2026-58653Medium· 4.3

4mo ago

praisonai-platform: Authorization Bypass Through User-Controlled Key

▾ Sunlitpraisonai-platform · praisonai-platformEPSS 0.26%via OSV

GHSA-rh39-9c67-59mhHigh· 8.1

4mo ago

PraisonAI: Missing ownership check on DELETE endpoints allows members to delete others' content in Platform API

▾ Twilightpraisonai-platform · praisonai-platformvia GHSA

GHSA-f38v-77qj-h4jqCritical· 9.8

4mo ago

praisonai-platform 0.1.4 still boots on the hardcoded JWT secret dev-secret-change-me (default-open production guard)

▾ Midnightpraisonai-platform · praisonai-platformvia GHSA

GHSA-cwj8-7gp2-ggcwCritical· 9.8

4mo ago

praisonai-platform: default JWT signing secret 'dev-secret-change-me' enables token forgery

▾ Midnightpraisonai-platform · praisonai-platformvia GHSA

GHSA-2fjj-qqg8-fg7xMedium· 4.3

4mo ago

praisonai-platform: Authorization Bypass Through User-Controlled Key

▾ Sunlitpraisonai-platform · praisonai-platformvia GHSA

CVE-2026-47419High· 8.3

4mo ago

praisonai-platform: Agent endpoints accept any agent_id without workspace ownership check, cross-workspace read/update/delete IDOR

▾ Twilightpraisonai-platform · praisonai-platformEPSS 0.34%via OSV

CVE-2026-47415High· 8.3

4mo ago

praisonai-platform: Issue endpoints accept any issue_id without workspace ownership check, cross-workspace read/update/delete IDOR

▾ Twilightpraisonai-platform · praisonai-platformEPSS 0.39%via OSV

CVE-2026-47411Medium· 6.5

4mo ago

praisonai-platform: Any workspace member can rewrite workspace name, description, and settings via PATCH /workspaces/{id}

▾ Sunlitpraisonai-platform · praisonai-platformEPSS 0.34%via OSV

CVE-2026-47412High· 8.1

4mo ago

praisonai-platform: Any workspace member can delete the entire workspace via DELETE /workspaces/{id}

▾ Twilightpraisonai-platform · praisonai-platformEPSS 0.53%via OSV

CVE-2026-47417High· 8.1

4mo ago

praisonai-platform: Comment endpoints accept any issue_id without workspace ownership check, cross-workspace comment read and post IDOR

▾ Twilightpraisonai-platform · praisonai-platformEPSS 0.36%via OSV

CVE-2026-47418High· 8.1

4mo ago

praisonai-platform: Project endpoints accept any project_id without workspace ownership check, cross-workspace read/update/delete IDOR

▾ Twilightpraisonai-platform · praisonai-platformEPSS 0.41%via OSV

CVE-2026-47409High· 8.1

5mo ago

praisonai-platform: Missing authorization on member removal enables full workspace takeover by any user regardless of role

▾ Twilightpraisonai-platform · praisonai-platformEPSS 0.34%via OSV

CVE-2026-47405High· 8.8

5mo ago

PraisonAI Platform: Missing role checks let any workspace member become owner and control workspace membership

▾ Twilightpraisonai-platform · praisonai-platformEPSS 0.36%via OSV

CVE-2026-47399High· 8.8

5mo ago

PraisonAI Platform workspace-scoped routes allow cross-workspace object access by global object ID

▾ Twilightpraisonai-platform · praisonai-platformEPSS 0.36%via OSV

CVE-2026-47414High· 7.6

5mo ago

praisonai-platform: Label endpoints' unchecked label_id/issue_id enable cross-workspace label IDOR (edit, delete, link)

▾ Twilightpraisonai-platform · praisonai-platformEPSS 0.38%via OSV

CVE-2026-47406High· 8.1

5mo ago

praisonai-platform: IDOR in dependency endpoints allows cross-workspace issue linking, reading, and deletion due to missing ownership checks

▾ Twilightpraisonai-platform · praisonai-platformEPSS 0.41%via OSV

CVE-2026-47408Medium· 6.5

5mo ago

praisonai-platform: list_issue_activity returns activity log for any issue regardless of workspace ownership

▾ Sunlitpraisonai-platform · praisonai-platformEPSS 0.29%via OSV

From the blog

All posts →

Oct 27, 2026

Sound the depths of every vulnerability.

Trending now

Feed

PraisonAI: Platform members can delete owner issue dependencies through member-owned related issues

PraisonAI is a multi-agent teams system

Duplicate Advisory: PraisonAI: Platform members can rewrite shared labels and owner issue labels without owner/admin authorization

PraisonAI Platform before 0.1.9 fails to properly authorize label and issue-label mutations, allowing workspace members to rename and recolor shared labels and add or remove labels on owner-created issues

Duplicate Advisory: PraisonAI: Platform member PATCH routes allow owner resource rewrites and project lead reassignment delete bypass

PraisonAI Platform (praisonai-platform) before 0.1.9 fails to enforce owner/admin authorization on the PATCH routes for projects, issues, and agents, which only require workspace-member role

praisonai-platform: Authorization Bypass Through User-Controlled Key

PraisonAI: Missing ownership check on DELETE endpoints allows members to delete others' content in Platform API

praisonai-platform 0.1.4 still boots on the hardcoded JWT secret dev-secret-change-me (default-open production guard)

praisonai-platform: default JWT signing secret 'dev-secret-change-me' enables token forgery

praisonai-platform: Authorization Bypass Through User-Controlled Key

praisonai-platform: Agent endpoints accept any agent_id without workspace ownership check, cross-workspace read/update/delete IDOR

praisonai-platform: Issue endpoints accept any issue_id without workspace ownership check, cross-workspace read/update/delete IDOR

praisonai-platform: Any workspace member can rewrite workspace name, description, and settings via PATCH /workspaces/{id}

praisonai-platform: Any workspace member can delete the entire workspace via DELETE /workspaces/{id}

praisonai-platform: Comment endpoints accept any issue_id without workspace ownership check, cross-workspace comment read and post IDOR

praisonai-platform: Project endpoints accept any project_id without workspace ownership check, cross-workspace read/update/delete IDOR

praisonai-platform: Missing authorization on member removal enables full workspace takeover by any user regardless of role

PraisonAI Platform: Missing role checks let any workspace member become owner and control workspace membership

PraisonAI Platform workspace-scoped routes allow cross-workspace object access by global object ID

praisonai-platform: Label endpoints' unchecked label_id/issue_id enable cross-workspace label IDOR (edit, delete, link)

praisonai-platform: IDOR in dependency endpoints allows cross-workspace issue linking, reading, and deletion due to missing ownership checks

praisonai-platform: list_issue_activity returns activity log for any issue regardless of workspace ownership

From the blog

VulnSea has moved to vulnsea.com (and what changed since September)

What's new: open corpus, three new MCP tools, vendor advisories, package pages

Wiring VulnSea into an agent: a hands-on tutorial

Sound the depths of every vulnerability.

Trending now

Feed

PraisonAI: Platform members can delete owner issue dependencies through member-owned related issues

PraisonAI is a multi-agent teams system

Duplicate Advisory: PraisonAI: Platform members can rewrite shared labels and owner issue labels without owner/admin authorization

PraisonAI Platform before 0.1.9 fails to properly authorize label and issue-label mutations, allowing workspace members to rename and recolor shared labels and add or remove labels on owner-created issues

Duplicate Advisory: PraisonAI: Platform member PATCH routes allow owner resource rewrites and project lead reassignment delete bypass

PraisonAI Platform (praisonai-platform) before 0.1.9 fails to enforce owner/admin authorization on the PATCH routes for projects, issues, and agents, which only require workspace-member role

praisonai-platform: Authorization Bypass Through User-Controlled Key

PraisonAI: Missing ownership check on DELETE endpoints allows members to delete others' content in Platform API

praisonai-platform 0.1.4 still boots on the hardcoded JWT secret dev-secret-change-me (default-open production guard)

praisonai-platform: default JWT signing secret 'dev-secret-change-me' enables token forgery

praisonai-platform: Authorization Bypass Through User-Controlled Key

praisonai-platform: Agent endpoints accept any agent_id without workspace ownership check, cross-workspace read/update/delete IDOR

praisonai-platform: Issue endpoints accept any issue_id without workspace ownership check, cross-workspace read/update/delete IDOR

praisonai-platform: Any workspace member can rewrite workspace name, description, and settings via PATCH /workspaces/{id}

praisonai-platform: Any workspace member can delete the entire workspace via DELETE /workspaces/{id}

praisonai-platform: Comment endpoints accept any issue_id without workspace ownership check, cross-workspace comment read and post IDOR

praisonai-platform: Project endpoints accept any project_id without workspace ownership check, cross-workspace read/update/delete IDOR

praisonai-platform: Missing authorization on member removal enables full workspace takeover by any user regardless of role

PraisonAI Platform: Missing role checks let any workspace member become owner and control workspace membership

PraisonAI Platform workspace-scoped routes allow cross-workspace object access by global object ID

praisonai-platform: Label endpoints' unchecked label_id/issue_id enable cross-workspace label IDOR (edit, delete, link)

praisonai-platform: IDOR in dependency endpoints allows cross-workspace issue linking, reading, and deletion due to missing ownership checks

praisonai-platform: list_issue_activity returns activity log for any issue regardless of workspace ownership

From the blog

VulnSea has moved to vulnsea.com (and what changed since September)

What's new: open corpus, three new MCP tools, vendor advisories, package pages

Wiring VulnSea into an agent: a hands-on tutorial