Live CVE & 0day intelligence

Sound the depths of every vulnerability.

Newly released CVEs across every platform — sleek to read, verbose on demand, and served raw as markdown for AI and agent ingestion. Severity reads as depth: the deeper the contact, the graver the threat.

Browse the feed For agents → /llms.txt

Depth = severity + exploitation

HadalCritical and actively exploited (CISA KEV / 0day)
AbyssalCritical with a public exploit or in-the-wild use
MidnightCritical, or high with PoC / in-the-wild
TwilightHigh severity, or a signal on a lesser flaw
SunlitLow / medium · no exploitation signal

69119

Tracked CVEs

6407

Critical

701

Exploited in wild

4740

Last 7 days

Trending now

Bluesky + Hacker News mentions, last 7 days

1CVE-2026-109618Critical· 9.2RCE via OOM corruption4896
2CVE-2026-109619Critical· 9.2RCE via stale global state2196
3CVE-2026-111497Critical· 9.2Out-of-Bounds Write in Google Brotli Decoder1587
4CVE-2026-99999Critical· 9.3In the Linux kernel, the following vulnerability has been resolved: ipv4: validate checksum_start before completing checksum If a packet with bad checksum metadata gets into the ipv4 stack, skb_checksum_help can corrupt the network hea…863
5CVE-2026-110264Critical· 10.0Integer Overflow or Wraparound in GitLab267
6CVE-2026-108707Critical· 9.8Wukong_HRM through commit 186115e contains an authentication bypass vulnerability in ParamAspect that allows unauthenticated attackers to call every HRM API endpoint by omitting the AUTH-TOKEN header266

This week's digest →All digests

Feed

31 matches

CVE-2026-97032High· 7.5

2w ago

HTTP/2 servers could end up crashing due to inadvertently modifying its HPACK encoder concurrently

HTTP/2 servers could end up crashing due to inadvertently modifying its HPACK encoder concurrently. This happens because the server modifies the HPACK encoder from two goroutines without synchronization: one uses the encoder to encode a …

▾ Twilightstdlib · stdlibEPSS 0.49%via NVD

CVE-2026-97031High· 7.5

2w ago

Multiple ECH outer extension references are not permitted under RFC 9849; previously, a client could send a well-crafted packet that could trigger memory exhaustion in the server process by specifying multiple references

Multiple ECH outer extension references are not permitted under RFC 9849; previously, a client could send a well-crafted packet that could trigger memory exhaustion in the server process by specifying multiple references. We now reject t…

▾ Twilightstdlib · stdlibEPSS 0.52%via NVD

CVE-2026-97030Medium· 6.1

2w ago

A trusted template author may have previously written a valid template wherein the use of the 'yield' keyword would not be correctly escaped

A trusted template author may have previously written a valid template wherein the use of the 'yield' keyword would not be correctly escaped. We now ensure that valid keyword uses are escaped and non-keyword uses are not escaped.

▾ Sunlitstdlib · stdlibEPSS 0.29%via NVD

CVE-2026-94448Medium· 6.1

2w ago

When a JavaScript template literal contains consecutive expressions, the context tracking state was not properly reset upon entering a new expression

When a JavaScript template literal contains consecutive expressions, the context tracking state was not properly reset upon entering a new expression. We now ensure that template-literal expression entries correctly reset context variabl…

▾ Sunlitstdlib · stdlibEPSS 0.29%via NVD

CVE-2026-94440High· 7.5

2w ago

Parsing a multipart form can bypass memory limits and read an arbitrarily long line into memory when the remaining limit at the start of a part is less than 400 bytes.

▾ Twilightstdlib · stdlibEPSS 0.51%via NVD

CVE-2026-94439High· 7.5

2w ago

When an HTTP server handler sends a 2xx response to an HTTP/1 CONNECT request and returns without hijacking the connection, the server improperly continues to read and serve requests from the connection

When an HTTP server handler sends a 2xx response to an HTTP/1 CONNECT request and returns without hijacking the connection, the server improperly continues to read and serve requests from the connection. Since a 2xx response to an HTTP/1…

▾ Twilightstdlib · stdlibEPSS 0.41%via NVD

CVE-2026-78669High· 7.5

2w ago

A malicious HTTP/2 peer can cause excessive CPU consumption in the client or server by opening a large number of streams and then sending many small SETTINGS frames containing SETTINGS_INITIAL_WINDOW_SIZE values.

A malicious HTTP/2 peer can cause excessive CPU consumption in the client or server by opening a large number of streams and then sending many small SETTINGS frames containing SETTINGS_INITIAL_WINDOW_SIZE values.

▾ Twilightstdlib · stdlibEPSS 0.61%via NVD

CVE-2026-78667High· 7.5

2w ago

When parsing a Range header containing a large number of small ranges, FileServer(FS), ServeContent, and ServeFile(FS) can consume an excessive amount of CPU.

▾ Twilightstdlib · stdlibEPSS 0.48%via NVD

CVE-2026-78663Critical· 9.1⚖ disputed

2w ago

The HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a stream (refunding data for any sent-but-unread portion of the stream), and again when a request handler reads the buffered da…

The HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a stream (refunding data for any sent-but-unread portion of the stream), and again when a request handler reads the buffered da…

▾ Midnightstdlib · stdlibEPSS 0.62%via NVD

CVE-2026-78660High· 7.5

2w ago

Historically, we have been rather lax about malformed framing-related headers in our HTTP/2 implementation, as they cannot interfere with HTTP/2 framing

Historically, we have been rather lax about malformed framing-related headers in our HTTP/2 implementation, as they cannot interfere with HTTP/2 framing. However, this makes it possible for our HTTP/2 implementation to forward responses …

▾ Twilightstdlib · stdlibEPSS 0.43%via NVD

CVE-2026-78659High· 7.5

2w ago

When "Trailer" headers are sent by a client, the HTTP server internally uses the header values to populate the Request.Trailer map passed to the server handler

When "Trailer" headers are sent by a client, the HTTP server internally uses the header values to populate the Request.Trailer map passed to the server handler. Because Request.Trailer is a map, each entry incurs memory overhead. For HTT…

▾ Twilightstdlib · stdlibEPSS 0.63%via NVD

CVE-2026-56866High· 7.5

2w ago

When http.Transport sends an HTTP/1 CONNECT request with a non-empty Request.Body, it writes the body directly to the connection without framing after the request headers

When http.Transport sends an HTTP/1 CONNECT request with a non-empty Request.Body, it writes the body directly to the connection without framing after the request headers. If the server rejects the CONNECT request with a non-2xx keep-ali…

▾ Twilightstdlib · stdlibEPSS 0.47%via NVD

CVE-2026-56857Critical· 9.8⚖ disputed

2w ago

On Windows, when the target of Root.Mkdir or Root.MkdirAll is a junction pointing to an empty location, the operation can create a directory at the junction target even when that target is located outside the root

On Windows, when the target of Root.Mkdir or Root.MkdirAll is a junction pointing to an empty location, the operation can create a directory at the junction target even when that target is located outside the root. This only applies to o…

▾ Midnightstdlib · stdlibEPSS 0.55%via NVD

CVE-2026-56860High· 7.5

2mo ago

Excessive resource consumption when printing error string for host certificate validation in crypto/x509

▾ Sunlitstdlib · stdlibEPSS 0.46%via OSV

CVE-2025-58183Medium· 4.3

12mo ago

tar.Reader does not set a maximum size on the number of sparse region data blocks in GNU tar pax 1.0 sparse files

tar.Reader does not set a maximum size on the number of sparse region data blocks in GNU tar pax 1.0 sparse files. A maliciously-crafted archive containing a large number of sparse regions can cause a Reader to read an unbounded amount o…

▾ Sunlitstdlib · stdlibEPSS 0.44%via NVD

CVE-2025-47906Medium· 6.5

1y ago

Unexpected paths returned from LookPath in os/exec

▾ Sunlitstdlib · stdlibEPSS 0.55%via OSV

From the blog

All posts →

Oct 27, 2026

Sound the depths of every vulnerability.

Trending now

Feed

HTTP/2 servers could end up crashing due to inadvertently modifying its HPACK encoder concurrently

Multiple ECH outer extension references are not permitted under RFC 9849; previously, a client could send a well-crafted packet that could trigger memory exhaustion in the server process by specifying multiple references

A trusted template author may have previously written a valid template wherein the use of the 'yield' keyword would not be correctly escaped

When a JavaScript template literal contains consecutive expressions, the context tracking state was not properly reset upon entering a new expression

Parsing a multipart form can bypass memory limits and read an arbitrarily long line into memory when the remaining limit at the start of a part is less than 400 bytes.

When an HTTP server handler sends a 2xx response to an HTTP/1 CONNECT request and returns without hijacking the connection, the server improperly continues to read and serve requests from the connection

A malicious HTTP/2 peer can cause excessive CPU consumption in the client or server by opening a large number of streams and then sending many small SETTINGS frames containing SETTINGS_INITIAL_WINDOW_SIZE values.

When parsing a Range header containing a large number of small ranges, FileServer(FS), ServeContent, and ServeFile(FS) can consume an excessive amount of CPU.

The HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a stream (refunding data for any sent-but-unread portion of the stream), and again when a request handler reads the buffered da…

Historically, we have been rather lax about malformed framing-related headers in our HTTP/2 implementation, as they cannot interfere with HTTP/2 framing

When "Trailer" headers are sent by a client, the HTTP server internally uses the header values to populate the Request.Trailer map passed to the server handler

When http.Transport sends an HTTP/1 CONNECT request with a non-empty Request.Body, it writes the body directly to the connection without framing after the request headers

On Windows, when the target of Root.Mkdir or Root.MkdirAll is a junction pointing to an empty location, the operation can create a directory at the junction target even when that target is located outside the root

Avoid quadratic complexity in resolvePath in net/url

Fix Javascript regexp context tracking in html/template

Limit handshake messages we are willing to accept post-handshake in crypto/tls

Apply ReadHeaderTimeout when doing unencrypted HTTP/2 check in net/http

Add recursion depth guard during decode in encoding/xml

Arbitrary inputs are included in errors without any escaping in net/textproto

Inefficient policy validation in crypto/x509

Unexpected session resumption in crypto/tls

Excessive CPU consumption when building archive index in archive/zip

Excessive resource consumption when printing error string for host certificate validation in crypto/x509

tar.Reader does not set a maximum size on the number of sparse region data blocks in GNU tar pax 1.0 sparse files

Unexpected paths returned from LookPath in os/exec

From the blog

VulnSea has moved to vulnsea.com (and what changed since September)

What's new: open corpus, three new MCP tools, vendor advisories, package pages

Wiring VulnSea into an agent: a hands-on tutorial

Sound the depths of every vulnerability.

Trending now

Feed

HTTP/2 servers could end up crashing due to inadvertently modifying its HPACK encoder concurrently

Multiple ECH outer extension references are not permitted under RFC 9849; previously, a client could send a well-crafted packet that could trigger memory exhaustion in the server process by specifying multiple references

A trusted template author may have previously written a valid template wherein the use of the 'yield' keyword would not be correctly escaped

When a JavaScript template literal contains consecutive expressions, the context tracking state was not properly reset upon entering a new expression

Parsing a multipart form can bypass memory limits and read an arbitrarily long line into memory when the remaining limit at the start of a part is less than 400 bytes.

When an HTTP server handler sends a 2xx response to an HTTP/1 CONNECT request and returns without hijacking the connection, the server improperly continues to read and serve requests from the connection

A malicious HTTP/2 peer can cause excessive CPU consumption in the client or server by opening a large number of streams and then sending many small SETTINGS frames containing SETTINGS_INITIAL_WINDOW_SIZE values.

When parsing a Range header containing a large number of small ranges, FileServer(FS), ServeContent, and ServeFile(FS) can consume an excessive amount of CPU.

The HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a stream (refunding data for any sent-but-unread portion of the stream), and again when a request handler reads the buffered da…

Historically, we have been rather lax about malformed framing-related headers in our HTTP/2 implementation, as they cannot interfere with HTTP/2 framing

When "Trailer" headers are sent by a client, the HTTP server internally uses the header values to populate the Request.Trailer map passed to the server handler

When http.Transport sends an HTTP/1 CONNECT request with a non-empty Request.Body, it writes the body directly to the connection without framing after the request headers

On Windows, when the target of Root.Mkdir or Root.MkdirAll is a junction pointing to an empty location, the operation can create a directory at the junction target even when that target is located outside the root

Avoid quadratic complexity in resolvePath in net/url

Fix Javascript regexp context tracking in html/template

Limit handshake messages we are willing to accept post-handshake in crypto/tls

Apply ReadHeaderTimeout when doing unencrypted HTTP/2 check in net/http

Add recursion depth guard during decode in encoding/xml

Arbitrary inputs are included in errors without any escaping in net/textproto

Inefficient policy validation in crypto/x509

Unexpected session resumption in crypto/tls

Excessive CPU consumption when building archive index in archive/zip

Excessive resource consumption when printing error string for host certificate validation in crypto/x509

tar.Reader does not set a maximum size on the number of sparse region data blocks in GNU tar pax 1.0 sparse files

Unexpected paths returned from LookPath in os/exec

From the blog

VulnSea has moved to vulnsea.com (and what changed since September)

What's new: open corpus, three new MCP tools, vendor advisories, package pages

Wiring VulnSea into an agent: a hands-on tutorial