Live CVE & 0day intelligence

Sound the depths of every vulnerability.

Newly released CVEs across every platform — sleek to read, verbose on demand, and served raw as markdown for AI and agent ingestion. Severity reads as depth: the deeper the contact, the graver the threat.

Browse the feed For agents → /llms.txt

Depth = severity + exploitation

HadalCritical and actively exploited (CISA KEV / 0day)
AbyssalCritical with a public exploit or in-the-wild use
MidnightCritical, or high with PoC / in-the-wild
TwilightHigh severity, or a signal on a lesser flaw
SunlitLow / medium · no exploitation signal

69227

Tracked CVEs

6415

Critical

701

Exploited in wild

4737

Last 7 days

Trending now

Bluesky + Hacker News mentions, last 7 days

1CVE-2026-109618Critical· 9.2RCE via OOM corruption4896
2CVE-2026-109619Critical· 9.2RCE via stale global state2196
3CVE-2026-111497Critical· 9.2Out-of-Bounds Write in Google Brotli Decoder1587
4CVE-2026-99999Critical· 9.3In the Linux kernel, the following vulnerability has been resolved: ipv4: validate checksum_start before completing checksum If a packet with bad checksum metadata gets into the ipv4 stack, skb_checksum_help can corrupt the network hea…963
5CVE-2026-110264Critical· 10.0Integer Overflow or Wraparound in GitLab267
6CVE-2026-108707Critical· 9.8Wukong_HRM through commit 186115e contains an authentication bypass vulnerability in ParamAspect that allows unauthenticated attackers to call every HRM API endpoint by omitting the AUTH-TOKEN header266

This week's digest →All digests

Feed

10 matches

CVE-2026-96637High· 7.1

1w ago

Pillow: Decompression bomb check bypass in SpiderImagePlugin.seek() leads to unbounded allocation DoS

Pillow is a Python imaging library. Prior to 13.0.0, SpiderImageFile.seek() in src/PIL/SpiderImagePlugin.py reparses a later SPIDER stack frame and replaces self._size without rerunning Image._decompression_bomb_check(). A tiny file can …

▾ Twilightpython-pillow · PillowEPSS 0.43%via CVEORG

CVE-2026-96640High· 8.2PoC

1w ago

Pillow PDF append accepts malformed shared page-tree DAG causing resource exhaustion

Pillow is a Python imaging library. From 5.1.0 until 13.0.0, PdfParser.linearize_page_tree() in src/PIL/PdfParser.py treats a PDF /Pages graph as a tree without tracking duplicate indirect references. When Image.save(..., format="PDF", a…

▾ Midnightpython-pillow · PillowEPSS 0.52%via CVEORG

CVE-2026-96641Medium· 6.5PoC

1w ago

Pillow: Reachable undefined behavior in native integer operations, potentially leading to denial of service or logic integrity compromise

Pillow is a Python imaging library. Prior to 13.0.0, PILfont text-width accumulation in src/_imaging.c checks positive glyph advances against INT_MAX but does not check negative advances against INT_MIN. Repeating a signed 16-bit advance…

▾ Twilightpython-pillow · PillowEPSS 0.35%via CVEORG

CVE-2026-96643High· 7.1

1w ago

Pillow: PNG eXIf chunk makes EXIF parsing run in quadratic time

Pillow is a Python imaging library. From 11.0.0 until 13.0.0, Exif.load() in src/PIL/Image.py repeatedly slices the remaining EXIF data while it begins with the six-byte Exif header. src/PIL/PngImagePlugin.py accepts an uncapped PNG eXIf…

▾ Twilightpython-pillow · PillowEPSS 0.43%via CVEORG

CVE-2026-96778High· 7.7

1w ago

Pillow: Heap buffer overflow writing JPEG comment after ICC profile fills buffer

Pillow is a Python imaging library. From 9.4.0 until 13.0.0, ImagingJpegEncode() in src/libImaging/JpegEncode.c can call jpeg_write_marker() for a JPEG COM comment when an ICC profile has exactly filled the 65536-byte encoder buffer. lib…

▾ Twilightpython-pillow · PillowEPSS 0.50%via CVEORG

CVE-2026-112893High· 8.2PoC

1w ago

Pillow: Invalid free in FreeType glyph rendering when a stroker is active

Pillow is a Python imaging library. From 10.0.0 until 13.0.0, Pillow can free an invalid glyph pointer during FreeType rendering with an active stroker. If FT_Load_Glyph fails, cleanup may call FT_Done_Glyph on an uninitialized or stale …

▾ Midnightpython-pillow · PillowEPSS 0.55%via CVEORG

CVE-2026-112898Medium· 6.9PoC

1w ago

Pillow: Image.quantize() with empty palette leaks uninitialized stack memory

Pillow is a Python imaging library. From 9.1.0 until 13.0.0, Pillow can disclose uninitialized stack memory when Image.quantize() uses an empty palette. ImagingPaletteCacheUpdate() leaves a local cache array uninitialized when the palett…

▾ Twilightpython-pillow · PillowEPSS 0.34%via CVEORG

CVE-2026-112395Medium· 6.5PoC

1w ago

Pillow tiled-TIFF decoder reads past tile buffer in copy4 (Unpack.c:1290)

Pillow is a Python imaging library. From 8.2.0 until 13.0.0, Pillow's tiled-TIFF decoder can read past the tile buffer while copying four-byte pixels. In _decodeTile, libtiff can return a tile allocation smaller than the required row str…

▾ Twilightpython-pillow · PillowEPSS 0.51%via CVEORG

CVE-2026-112399High· 8.7PoC

1w ago

Pillow: APNG background disposal allocates full canvas before decompression bomb check

Pillow is a Python imaging library. From 8.1.0 until 13.0.0, Pillow can allocate an APNG disposal background at the full canvas size before applying the decompression-bomb check. A crafted APNG with a small first frame, a very large decl…

▾ Midnightpython-pillow · PillowEPSS 0.53%via CVEORG

CVE-2026-112404High· 8.8PoC

1w ago

Pillow: OOB read in TiffDecode.c tile and RGBA paths leaks heap memory into pixels

Pillow is a Python imaging library. From 8.1.0 until 13.0.0, Pillow's TIFF tile and RGBA decode paths can read beyond row data produced by libtiff. In _decodeTile and the RGBA unpacker path, when Pillow and libtiff interpret duplicated P…

▾ Midnightpython-pillow · PillowEPSS 0.44%via CVEORG

From the blog

All posts →

Oct 27, 2026

Sound the depths of every vulnerability.

Trending now

Feed

Pillow: Decompression bomb check bypass in SpiderImagePlugin.seek() leads to unbounded allocation DoS

Pillow PDF append accepts malformed shared page-tree DAG causing resource exhaustion

Pillow: Reachable undefined behavior in native integer operations, potentially leading to denial of service or logic integrity compromise

Pillow: PNG eXIf chunk makes EXIF parsing run in quadratic time

Pillow: Heap buffer overflow writing JPEG comment after ICC profile fills buffer

Pillow: Invalid free in FreeType glyph rendering when a stroker is active

Pillow: Image.quantize() with empty palette leaks uninitialized stack memory

Pillow tiled-TIFF decoder reads past tile buffer in copy4 (Unpack.c:1290)

Pillow: APNG background disposal allocates full canvas before decompression bomb check

Pillow: OOB read in TiffDecode.c tile and RGBA paths leaks heap memory into pixels

From the blog

VulnSea has moved to vulnsea.com (and what changed since September)

What's new: open corpus, three new MCP tools, vendor advisories, package pages

Wiring VulnSea into an agent: a hands-on tutorial

Sound the depths of every vulnerability.

Trending now

Feed

Pillow: Decompression bomb check bypass in SpiderImagePlugin.seek() leads to unbounded allocation DoS

Pillow PDF append accepts malformed shared page-tree DAG causing resource exhaustion

Pillow: Reachable undefined behavior in native integer operations, potentially leading to denial of service or logic integrity compromise

Pillow: PNG eXIf chunk makes EXIF parsing run in quadratic time

Pillow: Heap buffer overflow writing JPEG comment after ICC profile fills buffer

Pillow: Invalid free in FreeType glyph rendering when a stroker is active

Pillow: Image.quantize() with empty palette leaks uninitialized stack memory

Pillow tiled-TIFF decoder reads past tile buffer in copy4 (Unpack.c:1290)

Pillow: APNG background disposal allocates full canvas before decompression bomb check

Pillow: OOB read in TiffDecode.c tile and RGBA paths leaks heap memory into pixels

From the blog

VulnSea has moved to vulnsea.com (and what changed since September)

What's new: open corpus, three new MCP tools, vendor advisories, package pages

Wiring VulnSea into an agent: a hands-on tutorial