Live CVE & 0day intelligence

Sound the depths of every vulnerability.

Newly released CVEs across every platform — sleek to read, verbose on demand, and served raw as markdown for AI and agent ingestion. Severity reads as depth: the deeper the contact, the graver the threat.

Browse the feed For agents → /llms.txt

Depth = severity + exploitation

HadalCritical and actively exploited (CISA KEV / 0day)
AbyssalCritical with a public exploit or in-the-wild use
MidnightCritical, or high with PoC / in-the-wild
TwilightHigh severity, or a signal on a lesser flaw
SunlitLow / medium · no exploitation signal

69367

Tracked CVEs

6434

Critical

702

Exploited in wild

4412

Last 7 days

Trending now

Bluesky + Hacker News mentions, last 7 days

1CVE-2026-109618Critical· 9.2RCE via OOM corruption4896
2CVE-2026-109619Critical· 9.2RCE via stale global state2196
3CVE-2026-111497Critical· 9.2Brotli: Out-of-bounds write in the Brotli decoder ("Node2Shell") also affects the PyPI Brotli package1592
4CVE-2026-99999Critical· 9.3In the Linux kernel, the following vulnerability has been resolved: ipv4: validate checksum_start before completing checksum If a packet with bad checksum metadata gets into the ipv4 stack, skb_checksum_help can corrupt the network hea…963
5CVE-2026-110264Critical· 10.0Integer Overflow or Wraparound in GitLab267
6CVE-2026-108707Critical· 9.8Wukong_HRM through commit 186115e contains an authentication bypass vulnerability in ParamAspect that allows unauthenticated attackers to call every HRM API endpoint by omitting the AUTH-TOKEN header266
7CVE-2026-91403Critical· 9.1Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JSSE)262

This week's digest →All digests

Feed

58 matches

CVE-2026-76290High· 7.5

1w ago

Denial of Service (DoS) through Unauthenticated Package Downloads over the REST API in Splunk Enterprise

In Splunk Enterprise versions below 10.4.4, 10.2.8, and 10.0.11, an unauthenticated user could send repeated requests to the Edge Processor package download endpoint in the Splunk Pipeline Builders app. The requests could cause the Splun…

▾ TwilightSplunk · Splunk EnterpriseEPSS 0.50%via CVEORG

CVE-2026-76287Medium· 5.4

1w ago

Authorization Bypass in the Data Management REST API in Splunk Enterprise

In Splunk Enterprise versions below 10.4.4, a user that holds a role with the preview_data_management_pipeline capability or edit_data_management_pipeline_job capability could read or delete Data Management SPL2 preview jobs and results …

▾ SunlitSplunk · Splunk EnterpriseEPSS 0.21%via CVEORG

CVE-2026-76292Medium· 6.5

1w ago

Missing Authorization through REST API Endpoints in Splunk Secure Gateway

In Splunk Enterprise versions below 10.4.4, 10.2.8, 10.0.11, and 9.4.16, and Splunk Secure Gateway versions below 3.10.12, 3.9.26, and 3.8.73, a low-privileged user that does not hold the "admin" Splunk role or the "sc_admin" Splunk Secu…

▾ SunlitSplunk · Splunk EnterpriseEPSS 0.34%via CVEORG

CVE-2026-76291High· 8.8

1w ago

Improper Access Control through Scheduled Search Safeguards in Splunk Enterprise

In Splunk Enterprise versions below 10.4.4, 10.2.8, 10.0.11, and 9.4.16, a user that holds a role with the schedule_search capability could bypass the expected safeguards in the scheduled search workflow. The user could then run risky Se…

▾ TwilightSplunk · Splunk EnterpriseEPSS 0.41%via CVEORG

CVE-2026-76289Medium· 6.5

1w ago

Denial of Service (DoS) through the REST API in Splunk Enterprise

In Splunk Enterprise versions below 10.4.4, 10.2.8, 10.0.11, and 9.4.16, a user who does not hold the "admin" or "power" Splunk roles could make the Splunk Enterprise instance unavailable to other users by sending a request to the Repres…

▾ SunlitSplunk · Splunk EnterpriseEPSS 0.37%via CVEORG

CVE-2026-76288High· 7.5

1w ago

Denial of Service (DoS) through Splunk Web Content-Type Header Parsing in Splunk Enterprise

In Splunk Enterprise versions below 10.4.4, 10.2.8, 10.0.11, and 9.4.16, an unauthenticated user could send a single crafted request to the Splunk Web JavaScript logger endpoint and cause Splunk Web to stop responding to requests. Splunk…

▾ TwilightSplunk · Splunk EnterpriseEPSS 0.47%via CVEORG

CVE-2026-76297Medium· 4.2

1w ago

Federated Search Provider State Change through Cross-Site Request Forgery (CSRF) in Splunk Web for Splunk Enterprise

In Splunk Enterprise versions below 10.4.4, 10.2.8, 10.0.11, and 9.4.16, an unauthenticated user could trick a user that holds a role with the edit_federated_providers capability into turning off all federated search providers. Successfu…

▾ SunlitSplunk · Splunk EnterpriseEPSS 0.11%via CVEORG

CVE-2026-76295Medium· 4.3

1w ago

SPL Injection through the REST API in Splunk Secure Gateway

In Splunk Enterprise versions below 10.4.4, 10.2.8, 10.0.11, and 9.4.16, and Splunk Secure Gateway versions below 3.10.12, 3.9.26, and 3.8.73, a user who does not hold the "admin" or "power" Splunk roles could view dashboard and report l…

▾ SunlitSplunk · Splunk EnterpriseEPSS 0.27%via CVEORG

CVE-2026-76294Medium· 4.3

1w ago

Improper Access Control in Field Extraction Management in Splunk Enterprise

In Splunk Enterprise versions below 10.4.4, 10.2.8, 10.0.11, and 9.4.16, a user who does not hold the "admin" or "power" Splunk roles could move field extractions or field transformations to apps for which the user does not have read acc…

▾ SunlitSplunk · Splunk EnterpriseEPSS 0.27%via CVEORG

CVE-2026-76298High· 8.8

1w ago

Use of Hard-coded Cryptographic Key in the PostgreSQL Sidecar Service in Splunk Enterprise

In Splunk Enterprise versions below 10.4.4 and 10.2.8, a user who does not hold the "admin" or "power" Splunk roles could derive the PostgreSQL sidecar database superuser password and run arbitrary operating system commands as the user a…

▾ TwilightSplunk · Splunk EnterpriseEPSS 0.35%via CVEORG

CVE-2026-76296Medium· 4.3

1w ago

Missing Authorization through Sourcetype Renaming in Splunk Web for Splunk Enterprise

In Splunk Enterprise versions below 10.4.4, 10.2.8, 10.0.11, and 9.4.16, a user who does not hold the "admin" or "power" Splunk roles could create, move, edit, or delete sourcetype renaming configurations that they own in apps that they …

▾ SunlitSplunk · Splunk EnterpriseEPSS 0.21%via CVEORG

CVE-2026-76293High· 7.2

1w ago

Remote Code Execution (RCE) through Splunk Web Manager Extensible Markup Language (XML) in Splunk Enterprise

In Splunk Enterprise versions below 10.4.3, 10.2.8, 10.0.11, and 9.4.16, a user that holds a role with the edit_manager_xml capability could execute arbitrary operating-system commands using the permissions of the user account running Sp…

▾ TwilightSplunk · Splunk EnterpriseEPSS 0.47%via CVEORG

CVE-2026-76301Critical· 9.8

1w ago

Security Hardening in Splunk Enterprise - October 2026

As part of Cisco's ongoing commitment to proactive security and product quality, Cisco has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally discov…

▾ MidnightSplunk · Splunk EnterpriseEPSS 0.17%via CVEORG

CVE-2026-76300High· 8.8

1w ago

Security Hardening in Splunk Enterprise - October 2026

▾ TwilightSplunk · Splunk EnterpriseEPSS 0.35%via CVEORG

CVE-2026-76299Critical· 9.9

1w ago

Security Hardening in Splunk Enterprise - October 2026

▾ MidnightSplunk · Splunk EnterpriseEPSS 0.33%via CVEORG

CVE-2026-76303Medium· 5.7

1w ago

Stored Cross-Site Scripting (XSS) through App Documentation in Splunk SOAR

In Splunk SOAR versions below 8.7.0, a user that holds a role with the install_apps capability could store attacker-controlled content that Splunk SOAR displays in app documentation by installing an app. If another user who holds a role …

▾ SunlitSplunk · Splunk SOAREPSS 0.23%via CVEORG

CVE-2026-76302Critical· 9.9

1w ago

Security Hardening in Splunk Enterprise - October 2026

▾ MidnightSplunk · Splunk EnterpriseEPSS 0.40%via CVEORG

CVE-2026-76306High· 7.5

1w ago

Information Disclosure through REST API Query Filters in Splunk SOAR

In Splunk SOAR versions below 8.7.0, a user that has the "Observer" role could use query filters in the Representational State Transfer (REST) API to infer password hashes and authorization tokens for other users. The information disclos…

▾ TwilightSplunk · Splunk SOAREPSS 0.22%via CVEORG

CVE-2026-76305Medium· 6.5

1w ago

Improper Access Control during App Downloads in Splunk SOAR

In Splunk SOAR versions below 8.7.0, an authenticated user who does not hold a role with permission to view apps could download an archive of an installed app. This could expose all data in the app archive, including proprietary source c…

▾ SunlitSplunk · Splunk SOAREPSS 0.27%via CVEORG

CVE-2026-76304Medium· 4.3

1w ago

Sensitive Information Disclosure through Automation Broker Configuration in Splunk SOAR

In Splunk SOAR versions below 8.7.0, an authenticated user who does not hold a role with permission to edit Automation Brokers could download the Splunk SOAR Automation Broker Docker Compose configuration file. The file contains the Unif…

▾ SunlitSplunk · Splunk SOAREPSS 0.16%via CVEORG

CVE-2026-76406Medium· 5.9

1w ago

Information Disclosure through REST API Authentication in Splunk SOAR

In Splunk SOAR versions below 8.7.0, an unauthenticated user with access to encrypted credential data from an affected Splunk SOAR instance could submit Basic authentication data to the Representational State Transfer (REST) API to expos…

▾ SunlitSplunk · Splunk SOAREPSS 0.32%via CVEORG

CVE-2026-76308Medium· 6.5

1w ago

Missing Authorization through the REST API in Splunk SOAR

In Splunk SOAR versions below 8.7.0, an authenticated user could change the Enterprise Security edition through the Representational State Transfer (REST) API and cause Splunk SOAR to apply the license change. The vulnerability is possib…

▾ SunlitSplunk · Splunk SOAREPSS 0.17%via CVEORG

CVE-2026-76307High· 7.2

1w ago

Sensitive Information Disclosure through REST API Query Filters in Splunk SOAR

In Splunk SOAR versions below 8.7.0, a user that holds a role with the Users and Roles view permission could use the Representational State Transfer (REST) API to infer authentication token values for other users. If the inferred token g…

▾ TwilightSplunk · Splunk SOAREPSS 0.40%via CVEORG

CVE-2026-76530High· 8.8

1w ago

Use of Non-Canonical URL Paths for Authorization Decisions in Splunk SOAR

▾ TwilightSplunk · Splunk SOAREPSS 0.29%via CVEORG

CVE-2026-76526High· 8.8

1w ago

Improper Neutralization in Splunk SOAR

▾ TwilightSplunk · Splunk SOAREPSS 0.36%via CVEORG

From the blog

All posts →

Oct 27, 2026

Sound the depths of every vulnerability.

Trending now

Feed

Denial of Service (DoS) through Unauthenticated Package Downloads over the REST API in Splunk Enterprise

Authorization Bypass in the Data Management REST API in Splunk Enterprise

Missing Authorization through REST API Endpoints in Splunk Secure Gateway

Improper Access Control through Scheduled Search Safeguards in Splunk Enterprise

Denial of Service (DoS) through the REST API in Splunk Enterprise

Denial of Service (DoS) through Splunk Web Content-Type Header Parsing in Splunk Enterprise

Federated Search Provider State Change through Cross-Site Request Forgery (CSRF) in Splunk Web for Splunk Enterprise

SPL Injection through the REST API in Splunk Secure Gateway

Improper Access Control in Field Extraction Management in Splunk Enterprise

Use of Hard-coded Cryptographic Key in the PostgreSQL Sidecar Service in Splunk Enterprise

Missing Authorization through Sourcetype Renaming in Splunk Web for Splunk Enterprise

Remote Code Execution (RCE) through Splunk Web Manager Extensible Markup Language (XML) in Splunk Enterprise

Security Hardening in Splunk Enterprise - October 2026

Security Hardening in Splunk Enterprise - October 2026

Security Hardening in Splunk Enterprise - October 2026

Stored Cross-Site Scripting (XSS) through App Documentation in Splunk SOAR

Security Hardening in Splunk Enterprise - October 2026

Information Disclosure through REST API Query Filters in Splunk SOAR

Improper Access Control during App Downloads in Splunk SOAR

Sensitive Information Disclosure through Automation Broker Configuration in Splunk SOAR

Information Disclosure through REST API Authentication in Splunk SOAR

Missing Authorization through the REST API in Splunk SOAR

Sensitive Information Disclosure through REST API Query Filters in Splunk SOAR

Use of Non-Canonical URL Paths for Authorization Decisions in Splunk SOAR

Improper Neutralization in Splunk SOAR

From the blog

VulnSea has moved to vulnsea.com (and what changed since September)

What's new: open corpus, three new MCP tools, vendor advisories, package pages

Wiring VulnSea into an agent: a hands-on tutorial

Sound the depths of every vulnerability.

Trending now

Feed

Denial of Service (DoS) through Unauthenticated Package Downloads over the REST API in Splunk Enterprise

Authorization Bypass in the Data Management REST API in Splunk Enterprise

Missing Authorization through REST API Endpoints in Splunk Secure Gateway

Improper Access Control through Scheduled Search Safeguards in Splunk Enterprise

Denial of Service (DoS) through the REST API in Splunk Enterprise

Denial of Service (DoS) through Splunk Web Content-Type Header Parsing in Splunk Enterprise

Federated Search Provider State Change through Cross-Site Request Forgery (CSRF) in Splunk Web for Splunk Enterprise

SPL Injection through the REST API in Splunk Secure Gateway

Improper Access Control in Field Extraction Management in Splunk Enterprise

Use of Hard-coded Cryptographic Key in the PostgreSQL Sidecar Service in Splunk Enterprise

Missing Authorization through Sourcetype Renaming in Splunk Web for Splunk Enterprise

Remote Code Execution (RCE) through Splunk Web Manager Extensible Markup Language (XML) in Splunk Enterprise

Security Hardening in Splunk Enterprise - October 2026

Security Hardening in Splunk Enterprise - October 2026

Security Hardening in Splunk Enterprise - October 2026

Stored Cross-Site Scripting (XSS) through App Documentation in Splunk SOAR

Security Hardening in Splunk Enterprise - October 2026

Information Disclosure through REST API Query Filters in Splunk SOAR

Improper Access Control during App Downloads in Splunk SOAR

Sensitive Information Disclosure through Automation Broker Configuration in Splunk SOAR

Information Disclosure through REST API Authentication in Splunk SOAR

Missing Authorization through the REST API in Splunk SOAR

Sensitive Information Disclosure through REST API Query Filters in Splunk SOAR

Use of Non-Canonical URL Paths for Authorization Decisions in Splunk SOAR

Improper Neutralization in Splunk SOAR

From the blog

VulnSea has moved to vulnsea.com (and what changed since September)

What's new: open corpus, three new MCP tools, vendor advisories, package pages

Wiring VulnSea into an agent: a hands-on tutorial