Live CVE & 0day intelligence

Sound the depths of every vulnerability.

Newly released CVEs across every platform — sleek to read, verbose on demand, and served raw as markdown for AI and agent ingestion. Severity reads as depth: the deeper the contact, the graver the threat.

Browse the feed For agents → /llms.txt

Depth = severity + exploitation

HadalCritical and actively exploited (CISA KEV / 0day)
AbyssalCritical with a public exploit or in-the-wild use
MidnightCritical, or high with PoC / in-the-wild
TwilightHigh severity, or a signal on a lesser flaw
SunlitLow / medium · no exploitation signal

69379

Tracked CVEs

6434

Critical

703

Exploited in wild

4038

Last 7 days

Trending now

Bluesky + Hacker News mentions, last 7 days

1CVE-2026-109618Critical· 9.2RCE via OOM corruption4896
2CVE-2026-109619Critical· 9.2RCE via stale global state2196
3CVE-2026-111497Critical· 9.2Brotli: Out-of-bounds write in the Brotli decoder ("Node2Shell") also affects the PyPI Brotli package1592
4CVE-2026-99999Critical· 9.3In the Linux kernel, the following vulnerability has been resolved: ipv4: validate checksum_start before completing checksum If a packet with bad checksum metadata gets into the ipv4 stack, skb_checksum_help can corrupt the network hea…963
5CVE-2026-110264Critical· 10.0Integer Overflow or Wraparound in GitLab267
6CVE-2026-108707Critical· 9.8Wukong_HRM through commit 186115e contains an authentication bypass vulnerability in ParamAspect that allows unauthenticated attackers to call every HRM API endpoint by omitting the AUTH-TOKEN header266
7CVE-2026-91403Critical· 9.1Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JSSE)262

This week's digest →All digests

Feed

17 matches

CVE-2026-109682Medium· 4.7

1w ago

Metasploit Framework HTTP Redirect Server-Side Request Forgery

Metasploit Framework versions before 6.5.7 allow HTTP requests made through send_request_cgi! to follow redirects to a different host without restricting the redirect destination. A malicious HTTP server can cause the system running Meta…

▾ SunlitRapid7 · Metasploit FrameworkEPSS 0.17%via CVEORG

CVE-2026-109681Medium· 4.7

1w ago

Metasploit Framework FTP PASV Response SSRF

The FTP client trusts the server's PASV response IP:port without validation against the control connection target. A rogue FTP server can specify any IP:port in the 227 Passive Mode response, causing the operator's machine to open a TCP …

▾ SunlitRapid7 · Metasploit FrameworkEPSS 0.20%via CVEORG

CVE-2026-87689Critical· 9.8

2w ago

The Metasploit Framework Web Service REST API (msf-ws) exposes the credential store through Msf::WebServices::CredentialServlet

The Metasploit Framework Web Service REST API (msf-ws) exposes the credential store through Msf::WebServices::CredentialServlet. Every mutating and read route in this servlet calls warden.authenticate! before processing a request, except…

▾ MidnightRapid7 · Metasploit FrameworkEPSS 0.37%via NVD

CVE-2026-87690High· 8.8PoC

2w ago

The Metasploit Framework post module post/apple_ios/gather/ios_image_gather is affected by a relative path traversal vulnerability (CWE-22)

The Metasploit Framework post module post/apple_ios/gather/ios_image_gather is affected by a relative path traversal vulnerability (CWE-22). The module interpolates file names taken from a Meterpreter directory listing — data fully contr…

▾ MidnightRapid7 · Metasploit FrameworkEPSS 0.41%via NVD

CVE-2026-78413Medium· 5.5

3w ago

Velociraptor allows collection of VQL queries packaged into Artifacts from endpoints

Velociraptor allows collection of VQL queries packaged into Artifacts from endpoints. These artifacts can be used to do anything and usually run with elevated permissions. To limit access to some dangerous artifact, Velociraptor allows f…

▾ SunlitRapid7 · VelociraptorEPSS 0.16%via NVD

CVE-2026-78411Medium· 6.5

3w ago

Velociraptor's SetClientMetadata used the wrong permission check to enforce setting metadata on the server

Velociraptor's SetClientMetadata used the wrong permission check to enforce setting metadata on the server. This allows a user with LABEL_CLIENTS permission to update the server metadata. Server metadata is often used to store site wide…

▾ SunlitRapid7 · VelociraptorEPSS 0.18%via NVD

CVE-2026-78412Medium· 4.9

3w ago

Velociraptor's WatchEvent gRPC API can specify the OrgId of the org from which events should be streamed

Velociraptor's WatchEvent gRPC API can specify the OrgId of the org from which events should be streamed. The server checks the API permissions against the caller's Org instead of the requested Org. This allows a user with API access in …

▾ SunlitRapid7 · VelociraptorEPSS 0.22%via NVD

CVE-2026-97228Low· 2.7

1mo ago

Rapid7 Bulk Export MCP versions 0.2.5 through 0.6.1 suffer from a GraphQL query injection issue in the export-status component (`get_export_status` in `src/export_manager.py`), whereby the `export_id` value — an unvalidated MCP tool argu…

Rapid7 Bulk Export MCP versions 0.2.5 through 0.6.1 suffer from a GraphQL query injection issue in the export-status component (`get_export_status` in `src/export_manager.py`), whereby the `export_id` value — an unvalidated MCP tool argu…

▾ SunlitRapid7 · PlatformEPSS 0.25%via NVD

CVE-2026-89325High· 7.8

1mo ago

An uncontrolled search path element in InsightVM assessment content in Rapid7 Insight Agent on Windows allows a local, low-privileged user to execute arbitrary code as SYSTEM via a planted executable resolved from the machine PATH. Asse…

An uncontrolled search path element in InsightVM assessment content in Rapid7 Insight Agent on Windows allows a local, low-privileged user to execute arbitrary code as SYSTEM via a planted executable resolved from the machine PATH. Asse…

▾ TwilightRapid7 · Insight AgentEPSS 0.13%via NVD

CVE-2026-77798Medium· 6.5

1mo ago

Velociraptor contains a deadlock condition that may be triggered by authenticated users

Velociraptor contains a deadlock condition that may be triggered by authenticated users. The issue stems from a lock management bug in the user management module.

▾ SunlitRapid7 · VelociraptorEPSS 0.20%via NVD

CVE-2026-77797Low· 3.6

1mo ago

Velociraptor's prefetch library contains an out of bound vulnerability which may cause a crash when parsing certain malformed prefetch files.

▾ SunlitRapid7 · VelociraptorEPSS 0.10%via NVD

CVE-2026-19072Critical· 9.9

1mo ago

Velociraptor stores the compiled VQL in the hunt object internally to avoid having to recompile the artifacts for each endpoint in the hunt

Velociraptor stores the compiled VQL in the hunt object internally to avoid having to recompile the artifacts for each endpoint in the hunt. Although the field "compiled_collector_args" is an internal field, Velociraptor allowed the fiel…

▾ MidnightRapid7 · VelociraptorEPSS 0.40%via NVD

CVE-2026-19584High· 7.7

1mo ago

Velociraptor allows for the creation of notebook backups in its default enabled daily backup feature

Velociraptor allows for the creation of notebook backups in its default enabled daily backup feature. When Velociraptor restores the backup, the notebook cell content is interpolated into a template with no ACL checks. This allows a mali…

▾ TwilightRapid7 · VelociraptorEPSS 0.31%via NVD

CVE-2026-19583Critical· 9.9

1mo ago

Velociraptor Required Permissions bypass by using client monitoring queries

Velociraptor allows some sensitive artifacts to be gated by additional permissions. For example, the Linux.Sys.BashShell artifact allows arbitrary command execution on endpoints, and so it requires the EXECVE permission to schedule. Howe…

▾ MidnightRapid7 · VelociraptorEPSS 0.60%via CVEORG

CVE-2025-14728Medium· 6.8

10mo ago

Rapid7 Velociraptor versions before 0.75.6 contain a directory traversal issue on Linux servers that allows a rogue client to upload a file which is written outside the datastore directory

Rapid7 Velociraptor versions before 0.75.6 contain a directory traversal issue on Linux servers that allows a rogue client to upload a file which is written outside the datastore directory. Velociraptor is normally only allowed to write …

▾ Sunlitrapid7 · velociraptorEPSS 0.56%via NVD

CVE-2025-36857Low· 3.3

1y ago

Rapid7 Appspider Pro versions below 7.5.021, suffer from a broken access control vulnerability in the application's configuration file loading mechanism, whereby an attacker can place files in directories belonging to other users or proj…

Rapid7 Appspider Pro versions below 7.5.021, suffer from a broken access control vulnerability in the application's configuration file loading mechanism, whereby an attacker can place files in directories belonging to other users or proj…

▾ Sunlitrapid7 · appspider_proEPSS 0.12%via NVD

CVE-2019-5645High· 7.5PoC

6y ago

Rapid7 Metasploit HTTP Handler Denial of Service

By sending a specially crafted HTTP GET request to a listening Rapid7 Metasploit HTTP handler, an attacker can register an arbitrary regular expression. When evaluated, this malicious handler can either prevent new HTTP handler sessions …

▾ MidnightRapid7 · Metasploit FrameworkEPSS 49%via CVEORG

From the blog

All posts →

Oct 27, 2026

Sound the depths of every vulnerability.

Trending now

Feed

Metasploit Framework HTTP Redirect Server-Side Request Forgery

Metasploit Framework FTP PASV Response SSRF

The Metasploit Framework Web Service REST API (msf-ws) exposes the credential store through Msf::WebServices::CredentialServlet

The Metasploit Framework post module post/apple_ios/gather/ios_image_gather is affected by a relative path traversal vulnerability (CWE-22)

Velociraptor allows collection of VQL queries packaged into Artifacts from endpoints

Velociraptor's SetClientMetadata used the wrong permission check to enforce setting metadata on the server

Velociraptor's WatchEvent gRPC API can specify the OrgId of the org from which events should be streamed

Rapid7 Bulk Export MCP versions 0.2.5 through 0.6.1 suffer from a GraphQL query injection issue in the export-status component (`get_export_status` in `src/export_manager.py`), whereby the `export_id` value — an unvalidated MCP tool argu…

An uncontrolled search path element in InsightVM assessment content in Rapid7 Insight Agent on Windows allows a local, low-privileged user to execute arbitrary code as SYSTEM via a planted executable resolved from the machine PATH. Asse…

Velociraptor contains a deadlock condition that may be triggered by authenticated users

Velociraptor's prefetch library contains an out of bound vulnerability which may cause a crash when parsing certain malformed prefetch files.

Velociraptor stores the compiled VQL in the hunt object internally to avoid having to recompile the artifacts for each endpoint in the hunt

Velociraptor allows for the creation of notebook backups in its default enabled daily backup feature

Velociraptor Required Permissions bypass by using client monitoring queries

Rapid7 Velociraptor versions before 0.75.6 contain a directory traversal issue on Linux servers that allows a rogue client to upload a file which is written outside the datastore directory

Rapid7 Appspider Pro versions below 7.5.021, suffer from a broken access control vulnerability in the application's configuration file loading mechanism, whereby an attacker can place files in directories belonging to other users or proj…

Rapid7 Metasploit HTTP Handler Denial of Service

From the blog

VulnSea has moved to vulnsea.com (and what changed since September)

What's new: open corpus, three new MCP tools, vendor advisories, package pages

Wiring VulnSea into an agent: a hands-on tutorial

Sound the depths of every vulnerability.

Trending now

Feed

Metasploit Framework HTTP Redirect Server-Side Request Forgery

Metasploit Framework FTP PASV Response SSRF

The Metasploit Framework Web Service REST API (msf-ws) exposes the credential store through Msf::WebServices::CredentialServlet

The Metasploit Framework post module post/apple_ios/gather/ios_image_gather is affected by a relative path traversal vulnerability (CWE-22)

Velociraptor allows collection of VQL queries packaged into Artifacts from endpoints

Velociraptor's SetClientMetadata used the wrong permission check to enforce setting metadata on the server

Velociraptor's WatchEvent gRPC API can specify the OrgId of the org from which events should be streamed

Rapid7 Bulk Export MCP versions 0.2.5 through 0.6.1 suffer from a GraphQL query injection issue in the export-status component (`get_export_status` in `src/export_manager.py`), whereby the `export_id` value — an unvalidated MCP tool argu…

An uncontrolled search path element in InsightVM assessment content in Rapid7 Insight Agent on Windows allows a local, low-privileged user to execute arbitrary code as SYSTEM via a planted executable resolved from the machine PATH. Asse…

Velociraptor contains a deadlock condition that may be triggered by authenticated users

Velociraptor's prefetch library contains an out of bound vulnerability which may cause a crash when parsing certain malformed prefetch files.

Velociraptor stores the compiled VQL in the hunt object internally to avoid having to recompile the artifacts for each endpoint in the hunt

Velociraptor allows for the creation of notebook backups in its default enabled daily backup feature

Velociraptor Required Permissions bypass by using client monitoring queries

Rapid7 Velociraptor versions before 0.75.6 contain a directory traversal issue on Linux servers that allows a rogue client to upload a file which is written outside the datastore directory

Rapid7 Appspider Pro versions below 7.5.021, suffer from a broken access control vulnerability in the application's configuration file loading mechanism, whereby an attacker can place files in directories belonging to other users or proj…

Rapid7 Metasploit HTTP Handler Denial of Service

From the blog

VulnSea has moved to vulnsea.com (and what changed since September)

What's new: open corpus, three new MCP tools, vendor advisories, package pages

Wiring VulnSea into an agent: a hands-on tutorial