Live CVE & 0day intelligence

Sound the depths of every vulnerability.

Newly released CVEs across every platform — sleek to read, verbose on demand, and served raw as markdown for AI and agent ingestion. Severity reads as depth: the deeper the contact, the graver the threat.

Browse the feed For agents → /llms.txt

Depth = severity + exploitation

HadalCritical and actively exploited (CISA KEV / 0day)
AbyssalCritical with a public exploit or in-the-wild use
MidnightCritical, or high with PoC / in-the-wild
TwilightHigh severity, or a signal on a lesser flaw
SunlitLow / medium · no exploitation signal

71906

Tracked CVEs

6754

Critical

763

Exploited in wild

2527

Last 7 days

Trending now

Bluesky + Hacker News mentions, last 7 days

1CVE-2026-109618Critical· 9.2RCE via OOM corruption4896
2CVE-2026-109619Critical· 9.2RCE via stale global state2196
3CVE-2026-111497Critical· 9.8Brotli: Out-of-bounds write in the Brotli decoder ("Node2Shell") also affects the PyPI Brotli package1895
4CVE-2026-99999Critical· 9.3In the Linux kernel, the following vulnerability has been resolved: ipv4: validate checksum_start before completing checksum If a packet with bad checksum metadata gets into the ipv4 stack, skb_checksum_help can corrupt the network hea…963
5CVE-2026-110264Critical· 10.0Integer Overflow or Wraparound in GitLab367
6CVE-2026-112816Critical· 10.0Improper certificate validation in the HTTPS listener in LXD367
7CVE-2026-116366Critical· 9.5Unauthenticated RCE vulnerability against ClickHouse Server364
8CVE-2026-97631Critical· 9.5Pre-boot RCE in EDK II PXE driver264

This week's digest →All digests

Feed

21 matches

CVE-2026-117533Medium· 4.4

1w ago

REDAXO 5.18.0 before 5.21.4 Stored XSS via Unsanitized Mediapool SVG Uploads

REDAXO from 5.18.0 before 5.21.4 contains a stored cross-site scripting vulnerability because rex_media_service moves uploaded SVG files into the public media folder before sanitizing them. Authenticated users with mediapool upload right…

▾ Sunlitredaxo · coreEPSS 0.13%via CVEORG

CVE-2026-116894Medium· 4.2

1w ago

REDAXO before 5.21.5 Insufficient Session Expiration on Password Change

REDAXO before 5.21.5 contains an insufficient session expiration vulnerability that allows attackers to retain account access by keeping the current session and stay-logged-in key valid after a password change. Attackers who obtained a u…

▾ Sunlitredaxo · coreEPSS 0.16%via CVEORG

CVE-2026-117537Medium· 4.1

1w ago

REDAXO before 5.21.0 Reflected XSS via Metainfo API type Parameter

REDAXO before 5.21.0 contains a reflected cross-site scripting vulnerability that allows authenticated attackers to inject scripts via the type parameter of the metainfo_default_fields_create API. Attackers can craft a link with a valid …

▾ Sunlitredaxo · coreEPSS 0.18%via CVEORG

CVE-2026-116898High· 7.1

1w ago

REDAXO before 5.21.4 Missing Authorization in Media Pool Bulk Move

REDAXO before 5.21.4 contains a missing authorization vulnerability in the media pool bulk move that checks only target category permission, ignoring the source category. Authenticated backend users with permission for one media category…

▾ Twilightredaxo · coreEPSS 0.17%via CVEORG

CVE-2026-117538Medium· 4.1

1w ago

REDAXO before 5.21.0 Reflected XSS via Packages API function Parameter

REDAXO before 5.21.0 contains a reflected cross-site scripting vulnerability in the backend packages API, where the function parameter is concatenated into an error message rendered without HTML escaping. Attackers can lure an authentica…

▾ Sunlitredaxo · coreEPSS 0.18%via CVEORG

CVE-2026-117536High· 8.8

1w ago

REDAXO before 5.21.3 CSRF Token Bypass via users/users Privilege Escalation

REDAXO before 5.21.3 contains a cross-site request forgery vulnerability in the backend user administration page (users/users) because the CSRF token check only runs when the save parameter is set, while the update path triggered by FUNC…

▾ Twilightredaxo · coreEPSS 0.14%via CVEORG

CVE-2026-117535Medium· 6.1

1w ago

REDAXO before 5.21.3 Reflected XSS via opener_link in Media Pool

REDAXO before 5.21.3 contains a reflected cross-site scripting vulnerability in the backend media pool detail page, where the opener_link parameter is rendered without HTML escaping. Unauthenticated attackers can lure logged-in backend u…

▾ Sunlitredaxo · coreEPSS 0.20%via CVEORG

CVE-2026-116900Medium· 5.4

1w ago

REDAXO before 5.21.4 Stored XSS via Media and Link Input Widgets

REDAXO before 5.21.4 contains a stored cross-site scripting vulnerability that allows content editors to inject HTML by storing unescaped values rendered by media, medialist, link and linklist widgets. Attackers can submit crafted REX_IN…

▾ Sunlitredaxo · coreEPSS 0.14%via CVEORG

CVE-2026-117534Medium· 5.4

1w ago

REDAXO before 5.21.3 CSRF in Article History Plugin

REDAXO before 5.21.3 contains a cross-site request forgery vulnerability in the structure/history plugin that allows attackers to delete history or roll back content via unvalidated GET requests. Attackers can lure logged-in backend user…

▾ Sunlitredaxo · coreEPSS 0.10%via CVEORG

CVE-2026-117532Critical· 9.8PoC

1w ago

REDAXO Core 5.3.0 before 5.21.4 Authentication Bypass via History Plugin

REDAXO core from 5.3.0 before 5.21.4 contains an authentication bypass vulnerability in the structure/history plugin that allows unauthenticated attackers to forge temporary login tokens. Attackers can force the session-tied secret into …

▾ Abyssalredaxo · coreEPSS 0.68%via CVEORG

CVE-2026-116899Medium· 6.5

1w ago

REDAXO before 5.21.4 Broken Access Control in Slice Operations

REDAXO before 5.21.4 contains a broken access control vulnerability that allows authenticated editors to modify slices in unauthorized categories by pairing a permitted article with a foreign slice id. Attackers can abuse content/edit de…

▾ Sunlitredaxo · coreEPSS 0.18%via CVEORG

CVE-2026-116893Medium· 6.8

1w ago

REDAXO core before 5.21.5 Missing Authorization in rex_api_package API

REDAXO core before 5.21.5 contains a missing authorization vulnerability in the rex_api_package API function that lets non-admin backend users manage packages with only a valid CSRF token. Attackers holding a token, such as demoted admin…

▾ Sunlitredaxo · coreEPSS 0.25%via CVEORG

CVE-2026-116897Medium· 6.5

1w ago

REDAXO before 5.21.4 Missing Authorization in Version and History Previews

REDAXO core before 5.21.4 contains a missing authorization vulnerability in the structure/version and structure/history frontend preview modes, which do not check category or clang permissions for the previewed article. Any backend user,…

▾ Sunlitredaxo · coreEPSS 0.21%via CVEORG

CVE-2026-116896High· 7.5

1w ago

REDAXO before 5.21.5 Privilege Escalation via Backup Export of Authentication Tables

REDAXO before 5.21.5 contains a missing authorization vulnerability in the backup addon export that accepts any database table, allowing non-admin users with the backup[export] permission to export rex_user, rex_user_session, and other a…

▾ Twilightredaxo · coreEPSS 0.22%via CVEORG

CVE-2026-116895Medium· 5.4

1w ago

REDAXO before 5.21.5 CSRF via Safe Mode Toggle Parameter

REDAXO before 5.21.5 contains a cross-site request forgery vulnerability because the backend processes the safemode GET parameter in index.php without validating a CSRF token. Attackers can lure a logged-in administrator into opening a c…

▾ Sunlitredaxo · coreEPSS 0.10%via CVEORG

CVE-2026-62998Medium· 4.3PoC

1mo ago

REDAXO is a PHP-based content management system

REDAXO is a PHP-based content management system. Prior to 5.21.2, rex_list::getSortColumn() in redaxo/src/core/lib/list.php accepts the sort request parameter without checking whether setColumnSortable() registered the requested column. …

▾ Twilightredaxo · coreEPSS 0.39%via NVD

CVE-2026-63001Medium· 4.8

1mo ago

REDAXO is a PHP-based content management system

REDAXO is a PHP-based content management system. Prior to 5.21.2, the mediaIsInUse() handler in redaxo/src/addons/media_manager/lib/media_manager.php inserts a Media Manager type name into raw backend warning HTML without escaping it whe…

▾ Sunlitredaxo · coreEPSS 0.20%via NVD

CVE-2026-63002Medium· 4.8PoC

1mo ago

REDAXO is a PHP-based content management system

REDAXO is a PHP-based content management system. Prior to 5.21.2, redaxo/src/addons/mediapool/pages/sync.php inserts filenames held in $diffFiles from the media filesystem into the Mediapool Sync page without rex_escape(). An attacker wh…

▾ Twilightredaxo · coreEPSS 0.20%via NVD

CVE-2026-63000Medium· 6.4PoC

1mo ago

REDAXO is a PHP-based content management system

REDAXO is a PHP-based content management system. Prior to 5.21.2, rex_api_install_package_update in redaxo/src/addons/install/lib/api/api_package_update.php inherits the false default from rex_api_function::requiresCsrfProtection() inste…

▾ Twilightredaxo · coreEPSS 0.15%via NVD

CVE-2026-53599High· 7.5

3mo ago

REDAXO is a PHP-based content management system

REDAXO is a PHP-based content management system. From 5.18.2 until 5.21.1, rex_mediapool::isAllowedExtension in redaxo/src/addons/mediapool/lib/mediapool.php lets an authenticated backend user with media[upload] permission upload a JPEG/…

▾ Twilightredaxo · redaxo/sourceEPSS 0.51%via NVD

CVE-2016-20053Medium· 5.3

7mo ago

Redaxo CMS 5.2 contains a cross-site request forgery vulnerability that allows unauthenticated attackers to create administrative user accounts by tricking authenticated administrators into visiting malicious pages

Redaxo CMS 5.2 contains a cross-site request forgery vulnerability that allows unauthenticated attackers to create administrative user accounts by tricking authenticated administrators into visiting malicious pages. Attackers can craft H…

▾ Sunlitredaxo · redaxoEPSS 0.15%via NVD

From the blog

All posts →

Oct 27, 2026

Sound the depths of every vulnerability.

Trending now

Feed

REDAXO 5.18.0 before 5.21.4 Stored XSS via Unsanitized Mediapool SVG Uploads

REDAXO before 5.21.5 Insufficient Session Expiration on Password Change

REDAXO before 5.21.0 Reflected XSS via Metainfo API type Parameter

REDAXO before 5.21.4 Missing Authorization in Media Pool Bulk Move

REDAXO before 5.21.0 Reflected XSS via Packages API function Parameter

REDAXO before 5.21.3 CSRF Token Bypass via users/users Privilege Escalation

REDAXO before 5.21.3 Reflected XSS via opener_link in Media Pool

REDAXO before 5.21.4 Stored XSS via Media and Link Input Widgets

REDAXO before 5.21.3 CSRF in Article History Plugin

REDAXO Core 5.3.0 before 5.21.4 Authentication Bypass via History Plugin

REDAXO before 5.21.4 Broken Access Control in Slice Operations

REDAXO core before 5.21.5 Missing Authorization in rex_api_package API

REDAXO before 5.21.4 Missing Authorization in Version and History Previews

REDAXO before 5.21.5 Privilege Escalation via Backup Export of Authentication Tables

REDAXO before 5.21.5 CSRF via Safe Mode Toggle Parameter

REDAXO is a PHP-based content management system

REDAXO is a PHP-based content management system

REDAXO is a PHP-based content management system

REDAXO is a PHP-based content management system

REDAXO is a PHP-based content management system

Redaxo CMS 5.2 contains a cross-site request forgery vulnerability that allows unauthenticated attackers to create administrative user accounts by tricking authenticated administrators into visiting malicious pages

From the blog

VulnSea has moved to vulnsea.com (and what changed since September)

What's new: open corpus, three new MCP tools, vendor advisories, package pages

Wiring VulnSea into an agent: a hands-on tutorial

Sound the depths of every vulnerability.

Trending now

Feed

REDAXO 5.18.0 before 5.21.4 Stored XSS via Unsanitized Mediapool SVG Uploads

REDAXO before 5.21.5 Insufficient Session Expiration on Password Change

REDAXO before 5.21.0 Reflected XSS via Metainfo API type Parameter

REDAXO before 5.21.4 Missing Authorization in Media Pool Bulk Move

REDAXO before 5.21.0 Reflected XSS via Packages API function Parameter

REDAXO before 5.21.3 CSRF Token Bypass via users/users Privilege Escalation

REDAXO before 5.21.3 Reflected XSS via opener_link in Media Pool

REDAXO before 5.21.4 Stored XSS via Media and Link Input Widgets

REDAXO before 5.21.3 CSRF in Article History Plugin

REDAXO Core 5.3.0 before 5.21.4 Authentication Bypass via History Plugin

REDAXO before 5.21.4 Broken Access Control in Slice Operations

REDAXO core before 5.21.5 Missing Authorization in rex_api_package API

REDAXO before 5.21.4 Missing Authorization in Version and History Previews

REDAXO before 5.21.5 Privilege Escalation via Backup Export of Authentication Tables

REDAXO before 5.21.5 CSRF via Safe Mode Toggle Parameter

REDAXO is a PHP-based content management system

REDAXO is a PHP-based content management system

REDAXO is a PHP-based content management system

REDAXO is a PHP-based content management system

REDAXO is a PHP-based content management system

Redaxo CMS 5.2 contains a cross-site request forgery vulnerability that allows unauthenticated attackers to create administrative user accounts by tricking authenticated administrators into visiting malicious pages

From the blog

VulnSea has moved to vulnsea.com (and what changed since September)

What's new: open corpus, three new MCP tools, vendor advisories, package pages

Wiring VulnSea into an agent: a hands-on tutorial