Live CVE & 0day intelligence

Sound the depths of every vulnerability.

Newly released CVEs across every platform — sleek to read, verbose on demand, and served raw as markdown for AI and agent ingestion. Severity reads as depth: the deeper the contact, the graver the threat.

Browse the feed For agents → /llms.txt

Depth = severity + exploitation

HadalCritical and actively exploited (CISA KEV / 0day)
AbyssalCritical with a public exploit or in-the-wild use
MidnightCritical, or high with PoC / in-the-wild
TwilightHigh severity, or a signal on a lesser flaw
SunlitLow / medium · no exploitation signal

68750

Tracked CVEs

6385

Critical

701

Exploited in wild

5034

Last 7 days

Trending now

Bluesky + Hacker News mentions, last 7 days

1CVE-2026-109618Critical· 9.2RCE via OOM corruption4896
2CVE-2026-109619Critical· 9.2RCE via stale global state2196
3CVE-2026-111497Critical· 9.2Out-of-Bounds Write in Google Brotli Decoder1580
4CVE-2026-99999Critical· 9.3In the Linux kernel, the following vulnerability has been resolved: ipv4: validate checksum_start before completing checksum If a packet with bad checksum metadata gets into the ipv4 stack, skb_checksum_help can corrupt the network hea…863
5CVE-2026-110264Critical· 10.0Integer Overflow or Wraparound in GitLab267
6CVE-2026-108707Critical· 9.8Wukong_HRM through commit 186115e contains an authentication bypass vulnerability in ParamAspect that allows unauthenticated attackers to call every HRM API endpoint by omitting the AUTH-TOKEN header266

This week's digest →All digests

Feed

63 matches

CVE-2026-97689High· 7.5

4w ago

urllib3 is an HTTP client library for Python

urllib3 is an HTTP client library for Python. From 1.10.3 until 2.8.0, the HTTPResponse.read_chunked and HTTPResponse.stream methods can allocate unbounded memory because the streaming chunk parser buffers the chunk-size field until newl…

▾ Twilightpython · urllib3EPSS 0.34%via NVD

CVE-2026-97688Medium· 5.3

4w ago

urllib3 is an HTTP client library for Python

urllib3 is an HTTP client library for Python. From 2.6.2 until 2.8.0, HTTPResponse.stream and HTTPResponse.read_chunked can enter an infinite loop because the Deflate decoder retains trailing bytes as unconsumed input after reaching end-…

▾ Sunlitpython · urllib3EPSS 0.29%via NVD

CVE-2026-97687High· 8.1

4w ago

urllib3 is an HTTP client library for Python

urllib3 is an HTTP client library for Python. From 1.26.0 until 2.8.0, the proxy_ssl_context, proxy_assert_hostname, proxy_assert_fingerprint, ssl_context, cert_reqs, verify_mode, use_forwarding_for_https=True, and CERT_NONE configuratio…

▾ Twilightpython · urllib3EPSS 0.21%via NVD

CVE-2026-44432High· 7.5

5mo ago

urllib3 is an HTTP client library for Python

urllib3 is an HTTP client library for Python. From 2.6.0 to before 2.7.0, urllib3 could decompress the whole response instead of the requested portion (1) during the second HTTPResponse.read(amt=N) call when the response was decompressed…

▾ Twilightpython · urllib3EPSS 0.68%via NVD

CVE-2026-7210High· 7.5⚖ disputed

5mo ago

`xml.parsers.expat` and `xml.etree.ElementTree` use insufficient entropy for Expat hash-flooding protection, which allows a crafted XML document to trigger hash flooding.\r\n\r\nFully mitigating this vulnerability requires both updating …

`xml.parsers.expat` and `xml.etree.ElementTree` use insufficient entropy for Expat hash-flooding protection, which allows a crafted XML document to trigger hash flooding.\r\n\r\nFully mitigating this vulnerability requires both updating …

▾ Twilightpython · pythonEPSS 0.67%via NVD

CVE-2026-3087High· 7.5

6mo ago

If `shutil.unpack_archive()` is given a ZIP archive with an absolute Windows path containing a drive (`C:\\...`) then the archive will be extracted outside the target directory which is different than other operating systems

If `shutil.unpack_archive()` is given a ZIP archive with an absolute Windows path containing a drive (`C:\\...`) then the archive will be extracted outside the target directory which is different than other operating systems. Only Window…

▾ Twilightpython · pythonEPSS 0.55%via NVD

CVE-2026-6019Medium· 6.1

6mo ago

http.cookies.Morsel.js_output() returns an inline <script> snippet and only escapes " for JavaScript string context

http.cookies.Morsel.js_output() returns an inline <script> snippet and only escapes " for JavaScript string context. It does not neutralize the HTML parser-sensitive sequence </script> inside the generated script element. Mitigation base…

▾ Sunlitpython · pythonEPSS 0.21%via NVD

CVE-2026-40192High· 7.5

6mo ago

Pillow is a Python imaging library

Pillow is a Python imaging library. Versions 10.3.0 through 12.1.1 did not limit the amount of GZIP-compressed data read when decoding a FITS image, making them vulnerable to decompression bomb attacks. A specially crafted FITS file coul…

▾ Twilightpython · pillowEPSS 0.67%via NVD

CVE-2026-4519Low· 3.3

7mo ago

The webbrowser.open() API would accept leading dashes in the URL which could be handled as command line options for certain web browsers

The webbrowser.open() API would accept leading dashes in the URL which could be handled as command line options for certain web browsers. New behavior rejects leading dashes. Users are recommended to sanitize URLs prior to passing to …

▾ Sunlitpython · pythonEPSS 0.31%via NVD

CVE-2026-4224High· 7.5

7mo ago

When an Expat parser with a registered ElementDeclHandler parses an inline document type definition containing a deeply nested content model a C stack overflow occurs.

▾ Twilightpython · pythonEPSS 0.70%via NVD

CVE-2026-3644High· 7.5

7mo ago

The fix for CVE-2026-0672, which rejected control characters in http.cookies.Morsel, was incomplete

The fix for CVE-2026-0672, which rejected control characters in http.cookies.Morsel, was incomplete. The Morsel.update(), |= operator, and unpickling paths were not patched, allowing control characters to bypass input validation. Additio…

▾ Twilightpython · pythonEPSS 0.50%via NVD

CVE-2025-13462Low· 3.3

7mo ago

The "tarfile" module would still apply normalization of AREGTYPE (\x00) blocks to DIRTYPE, even while processing a multi-block member such as GNUTYPE_LONGNAME or GNUTYPE_LONGLINK

The "tarfile" module would still apply normalization of AREGTYPE (\x00) blocks to DIRTYPE, even while processing a multi-block member such as GNUTYPE_LONGNAME or GNUTYPE_LONGLINK. This could result in a crafted tar archive being misinter…

▾ Sunlitpython · pythonEPSS 0.17%via NVD

CVE-2026-25990High· 7.5

8mo ago

Pillow is a Python imaging library

Pillow is a Python imaging library. From 10.3.0 to before 12.1.1, an out-of-bounds write may be triggered when loading a specially crafted PSD image. This vulnerability is fixed in 12.1.1.

▾ Twilightpython · pillowEPSS 0.41%via NVD

CVE-2026-21441High· 7.5

9mo ago

urllib3 is an HTTP client library for Python

urllib3 is an HTTP client library for Python. urllib3's streaming API is designed for the efficient handling of large HTTP responses by reading the content in chunks, rather than loading the entire response body into memory at once. urll…

▾ Twilightpython · urllib3EPSS 2.9%via NVD

CVE-2025-66418High· 7.5

10mo ago

urllib3 is a user-friendly HTTP client library for Python

urllib3 is a user-friendly HTTP client library for Python. Starting in version 1.24 and prior to 2.6.0, the number of links in the decompression chain was unbounded allowing a malicious server to insert a virtually unlimited number of co…

▾ Twilightpython · urllib3EPSS 0.68%via NVD

CVE-2025-66471High· 7.5

10mo ago

urllib3 is a user-friendly HTTP client library for Python

urllib3 is a user-friendly HTTP client library for Python. Starting in version 1.0 and prior to 2.6.0, the Streaming API improperly handles highly compressed data. urllib3's streaming API is designed for the efficient handling of large H…

▾ Twilightpython · urllib3EPSS 0.68%via NVD

CVE-2025-13837Medium· 5.5

11mo ago

When loading a plist file, the plistlib module reads data in size specified by the file itself, meaning a malicious file can cause OOM and DoS issues

▾ Sunlitpython · pythonEPSS 0.22%via NVD

CVE-2025-13836High· 7.5

11mo ago

When reading an HTTP response from a server, if no read amount is specified, the default behavior will be to use Content-Length

When reading an HTTP response from a server, if no read amount is specified, the default behavior will be to use Content-Length. This allows a malicious server to cause the client to read large amounts of data into memory, potentially ca…

▾ Twilightpython · pythonEPSS 1.6%via NVD

CVE-2025-6075Medium· 5.5

12mo ago

If the value passed to os.path.expandvars() is user-controlled a performance degradation is possible when expanding environment variables.

▾ Sunlitpython · pythonEPSS 0.15%via NVD

CVE-2025-48379High· 7.1

1y ago

Pillow is a Python imaging library

Pillow is a Python imaging library. In versions 11.2.0 to before 11.3.0, there is a heap buffer overflow when writing a sufficiently large (>64k encoded with default settings) image in the DDS format due to writing into a buffer without …

▾ Twilightpython · pillowEPSS 0.32%via NVD

CVE-2023-6507Medium· 6.1

2y ago

An issue was found in CPython 3.12.0 `subprocess` module on POSIX platforms

An issue was found in CPython 3.12.0 `subprocess` module on POSIX platforms. The issue was fixed in CPython 3.12.1 and does not affect other stable releases. When using the `extra_groups=` parameter with an empty list as a value (ie `ex…

▾ Sunlitpython · pythonEPSS 1.3%via NVD

CVE-2022-48560High· 7.5

3y ago

A use-after-free exists in Python through 3.9 via heappushpop in heapq.

▾ Twilightpython · pythonEPSS 2.0%via NVD

CVE-2023-24329High· 7.5PoC

3y ago

An issue in the urllib.parse component of Python before 3.11.4 allows attackers to bypass blocklisting methods by supplying a URL that starts with blank characters.

▾ Midnightpython · pythonEPSS 20%via NVD

CVE-2022-45061High· 7.5PoC

3y ago

An issue was discovered in Python before 3.11.1

An issue was discovered in Python before 3.11.1. An unnecessary quadratic algorithm exists in one path when processing some inputs to the IDNA (RFC 3490) decoder, such that a crafted, unreasonably long name being presented to the decoder…

▾ Midnightpython · pythonEPSS 2.7%via NVD

CVE-2020-10735High· 7.5

4y ago

A flaw was found in python

A flaw was found in python. In algorithms with quadratic time complexity using non-binary bases, when using int("text"), a system could take 50ms to parse an int string with 100,000 digits and 5s for 1,000,000 digits (float, decimal, int…

▾ Twilightpython · pythonEPSS 4.5%via NVD

From the blog

All posts →

Oct 27, 2026

Sound the depths of every vulnerability.

Trending now

Feed

urllib3 is an HTTP client library for Python

urllib3 is an HTTP client library for Python

urllib3 is an HTTP client library for Python

urllib3 is an HTTP client library for Python

`xml.parsers.expat` and `xml.etree.ElementTree` use insufficient entropy for Expat hash-flooding protection, which allows a crafted XML document to trigger hash flooding.\r\n\r\nFully mitigating this vulnerability requires both updating …

If `shutil.unpack_archive()` is given a ZIP archive with an absolute Windows path containing a drive (`C:\\...`) then the archive will be extracted outside the target directory which is different than other operating systems

http.cookies.Morsel.js_output() returns an inline <script> snippet and only escapes " for JavaScript string context

Pillow is a Python imaging library

The webbrowser.open() API would accept leading dashes in the URL which could be handled as command line options for certain web browsers

When an Expat parser with a registered ElementDeclHandler parses an inline document type definition containing a deeply nested content model a C stack overflow occurs.

The fix for CVE-2026-0672, which rejected control characters in http.cookies.Morsel, was incomplete

The "tarfile" module would still apply normalization of AREGTYPE (\x00) blocks to DIRTYPE, even while processing a multi-block member such as GNUTYPE_LONGNAME or GNUTYPE_LONGLINK

Pillow is a Python imaging library

urllib3 is an HTTP client library for Python

urllib3 is a user-friendly HTTP client library for Python

urllib3 is a user-friendly HTTP client library for Python

When loading a plist file, the plistlib module reads data in size specified by the file itself, meaning a malicious file can cause OOM and DoS issues

When reading an HTTP response from a server, if no read amount is specified, the default behavior will be to use Content-Length

If the value passed to os.path.expandvars() is user-controlled a performance degradation is possible when expanding environment variables.

Pillow is a Python imaging library

An issue was found in CPython 3.12.0 `subprocess` module on POSIX platforms

A use-after-free exists in Python through 3.9 via heappushpop in heapq.

An issue in the urllib.parse component of Python before 3.11.4 allows attackers to bypass blocklisting methods by supplying a URL that starts with blank characters.

An issue was discovered in Python before 3.11.1

A flaw was found in python

From the blog

VulnSea has moved to vulnsea.com (and what changed since September)

What's new: open corpus, three new MCP tools, vendor advisories, package pages

Wiring VulnSea into an agent: a hands-on tutorial

Sound the depths of every vulnerability.

Trending now

Feed

urllib3 is an HTTP client library for Python

urllib3 is an HTTP client library for Python

urllib3 is an HTTP client library for Python

urllib3 is an HTTP client library for Python

`xml.parsers.expat` and `xml.etree.ElementTree` use insufficient entropy for Expat hash-flooding protection, which allows a crafted XML document to trigger hash flooding.\r\n\r\nFully mitigating this vulnerability requires both updating …

If `shutil.unpack_archive()` is given a ZIP archive with an absolute Windows path containing a drive (`C:\\...`) then the archive will be extracted outside the target directory which is different than other operating systems

http.cookies.Morsel.js_output() returns an inline <script> snippet and only escapes " for JavaScript string context

Pillow is a Python imaging library

The webbrowser.open() API would accept leading dashes in the URL which could be handled as command line options for certain web browsers

When an Expat parser with a registered ElementDeclHandler parses an inline document type definition containing a deeply nested content model a C stack overflow occurs.

The fix for CVE-2026-0672, which rejected control characters in http.cookies.Morsel, was incomplete

The "tarfile" module would still apply normalization of AREGTYPE (\x00) blocks to DIRTYPE, even while processing a multi-block member such as GNUTYPE_LONGNAME or GNUTYPE_LONGLINK

Pillow is a Python imaging library

urllib3 is an HTTP client library for Python

urllib3 is a user-friendly HTTP client library for Python

urllib3 is a user-friendly HTTP client library for Python

When loading a plist file, the plistlib module reads data in size specified by the file itself, meaning a malicious file can cause OOM and DoS issues

When reading an HTTP response from a server, if no read amount is specified, the default behavior will be to use Content-Length

If the value passed to os.path.expandvars() is user-controlled a performance degradation is possible when expanding environment variables.

Pillow is a Python imaging library

An issue was found in CPython 3.12.0 `subprocess` module on POSIX platforms

A use-after-free exists in Python through 3.9 via heappushpop in heapq.

An issue in the urllib.parse component of Python before 3.11.4 allows attackers to bypass blocklisting methods by supplying a URL that starts with blank characters.

An issue was discovered in Python before 3.11.1

A flaw was found in python

From the blog

VulnSea has moved to vulnsea.com (and what changed since September)

What's new: open corpus, three new MCP tools, vendor advisories, package pages

Wiring VulnSea into an agent: a hands-on tutorial