Live CVE & 0day intelligence

Sound the depths of every vulnerability.

Newly released CVEs across every platform — sleek to read, verbose on demand, and served raw as markdown for AI and agent ingestion. Severity reads as depth: the deeper the contact, the graver the threat.

Browse the feed For agents → /llms.txt

Depth = severity + exploitation

HadalCritical and actively exploited (CISA KEV / 0day)
AbyssalCritical with a public exploit or in-the-wild use
MidnightCritical, or high with PoC / in-the-wild
TwilightHigh severity, or a signal on a lesser flaw
SunlitLow / medium · no exploitation signal

76270

Tracked CVEs

7114

Critical

767

Exploited in wild

6692

Last 7 days

Trending now

Bluesky + Hacker News mentions, last 7 days

1CVE-2026-109618Critical· 9.2RCE via OOM corruption4896
2CVE-2026-109619Critical· 9.2RCE via stale global state2196
3CVE-2026-111497Critical· 9.2Out-of-Bounds Write in Google Brotli Decoder1892
4CVE-2026-110264Critical· 10.0Integer Overflow or Wraparound in GitLab367
5CVE-2026-112816Critical· 10.0Improper certificate validation in the HTTPS listener in LXD367
6CVE-2026-116366Critical· 9.5Unauthenticated RCE vulnerability against ClickHouse Server364
7CVE-2026-97631Critical· 9.5Pre-boot RCE in EDK II PXE driver264
8CVE-2026-91403Critical· 9.1Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JSSE)262

This week's digest →All digests

Feed

22 matches

CVE-2026-55468Medium· 4.3

2mo ago

Wagtail is an open source content management system built on Django

Wagtail is an open source content management system built on Django. Prior to versions 7.0.9, 7.3.4, 7.4.3, and 8.0rc2 on their respective release lines, the internal Pages admin API returns page fields declared in api_fields without suf…

▾ Sunlitwagtail · wagtailEPSS 0.34%via NVD

CVE-2026-54259Medium· 4.3

2mo ago

Wagtail: Pages translations can be created without page permissions when using simple_translation

▾ Sunlitwagtail · wagtailEPSS 0.27%via GHSA

CVE-2026-54263High· 7.3

2mo ago

Wagtail: Reflected XSS in dynamic image URL generator view

▾ Twilightwagtail · wagtailEPSS 0.36%via GHSA

GHSA-92hv-j533-69wcLow· 3.7

2mo ago

Wagtail: Identification of documents by SHA1 hash

▾ Sunlitwagtail · wagtailvia GHSA

GHSA-c2xx-cjmh-9q8fMedium· 5.3

2mo ago

Wagtail: Improper restriction handling on descendant collections in Documents and Images API

▾ Sunlitwagtail · wagtailvia GHSA

GHSA-x5cx-w6p2-mxf2Medium· 6.5

2mo ago

Wagtail: Improper permission handling when copying snippets

▾ Sunlitwagtail · wagtailvia GHSA

GHSA-jm5p-837g-rv8gMedium· 6.5

2mo ago

Wagtail: Improper restriction handling on Page translation API endpoint

▾ Sunlitwagtail · wagtailvia OSV

CVE-2026-28222Medium· 6.1

8mo ago

Wagtail Vulnerable to Cross-site Scripting in TableBlock class attributes

▾ Sunlitwagtail · wagtailEPSS 0.50%via OSV

CVE-2026-28223Medium· 6.1

8mo ago

Wagtail Vulnerable to Cross-site Scripting in simple_translation admin interface

▾ Sunlitwagtail · wagtailEPSS 0.53%via OSV

CVE-2026-25517Medium

9mo ago

Wagtail has improper permission handling on admin preview endpoints

▾ Sunlitwagtail · wagtailEPSS 0.38%via OSV

CVE-2024-35228Medium· 5.5

2y ago

Improper Handling of Insufficient Permissions in `wagtail.contrib.settings`

▾ Sunlitwagtail · wagtailEPSS 0.33%via OSV

CVE-2024-32882Low· 2.7

2y ago

Wagtail has permission check bypass when editing a model with per-field restrictions through `wagtail.contrib.settings` or `ModelViewSet`

▾ Sunlitwagtail · wagtailEPSS 0.48%via OSV

CVE-2023-28836Medium· 6.4

3y ago

Wagtail vulnerable to stored Cross-site Scripting attack via ModelAdmin views

▾ Sunlitwagtail · wagtailEPSS 0.77%via OSV

CVE-2023-28837Medium· 4.4

3y ago

Wagtail vulnerable to denial-of-service via memory exhaustion when uploading large files

▾ Sunlitwagtail · wagtailEPSS 1.1%via OSV

CVE-2021-32681Medium· 5.4

5y ago

Cross-site Scripting in wagtail

▾ Sunlitwagtail · wagtailEPSS 1.1%via OSV

CVE-2021-29434Medium· 6.1

5y ago

Improper validation of URLs ('Cross-site Scripting') in Wagtail rich text fields

▾ Sunlitwagtail · wagtailEPSS 0.63%via OSV

CVE-2020-15118Medium· 5.7

6y ago

Cross-Site Scripting in Wagtail

▾ Sunlitwagtail · wagtailEPSS 1.1%via OSV

CVE-2020-11037Medium· 6.1

6y ago

Potential Observable Timing Discrepancy in Wagtail

▾ Sunlitwagtail · wagtailEPSS 0.25%via OSV

CVE-2020-11001Medium· 5.8

6y ago

Possible XSS attack in Wagtail

▾ Sunlitwagtail · wagtailEPSS 1.3%via OSV

From the blog

All posts →

Oct 27, 2026

VulnSea has moved to vulnsea.com (and what changed since September)

The beta is over. VulnSea now runs at vulnsea.com, every old beta link redirects to the same page, and your account, API keys and watchlists came with it. Plus a round of hardening, faster pages, and new request limits agents should know about.

Sep 8, 2026

What's new: open corpus, three new MCP tools, vendor advisories, package pages

A summary of everything that shipped over the last two weeks — the whole corpus is open, agents get change feeds, alias resolution and EPSS movers, and the data now includes CVE.org, vendor CSAF, aggregated exploits and per-source scores.

Jul 1, 2026

Wiring VulnSea into an agent: a hands-on tutorial

A step-by-step guide to plugging VulnSea into automated and agentic workflows — poll the delta, triage without burning tokens, match an SBOM, and let an MCP-native model do the reasoning.

Sound the depths of every vulnerability.

Trending now

Feed

Wagtail is an open source content management system built on Django

Wagtail: Improper restriction handling on Documents and Images chosen endpoints

Wagtail: Denial of service via unbounded filter specs in the image preview

Wagtail: Improper permission handling in image preview

Wagtail: Pages translations can be created without page permissions when using simple_translation

Wagtail: Reflected XSS in dynamic image URL generator view

Wagtail: Identification of documents by SHA1 hash

Wagtail: Improper restriction handling on descendant collections in Documents and Images API

Wagtail: Improper permission handling when copying snippets

Wagtail: Improper restriction handling on Page translation API endpoint

Wagtail Vulnerable to Cross-site Scripting in TableBlock class attributes

Wagtail Vulnerable to Cross-site Scripting in simple_translation admin interface

Wagtail has improper permission handling on admin preview endpoints

Improper Handling of Insufficient Permissions in `wagtail.contrib.settings`

Wagtail has permission check bypass when editing a model with per-field restrictions through `wagtail.contrib.settings` or `ModelViewSet`

Wagtail vulnerable to stored Cross-site Scripting attack via ModelAdmin views

Wagtail vulnerable to denial-of-service via memory exhaustion when uploading large files

Cross-site Scripting in wagtail

Improper validation of URLs ('Cross-site Scripting') in Wagtail rich text fields

Cross-Site Scripting in Wagtail

Potential Observable Timing Discrepancy in Wagtail

Possible XSS attack in Wagtail

From the blog

VulnSea has moved to vulnsea.com (and what changed since September)

What's new: open corpus, three new MCP tools, vendor advisories, package pages

Wiring VulnSea into an agent: a hands-on tutorial

Sound the depths of every vulnerability.

Trending now

Feed

Wagtail is an open source content management system built on Django

Wagtail: Improper restriction handling on Documents and Images chosen endpoints

Wagtail: Denial of service via unbounded filter specs in the image preview

Wagtail: Improper permission handling in image preview

Wagtail: Pages translations can be created without page permissions when using simple_translation

Wagtail: Reflected XSS in dynamic image URL generator view

Wagtail: Identification of documents by SHA1 hash

Wagtail: Improper restriction handling on descendant collections in Documents and Images API

Wagtail: Improper permission handling when copying snippets

Wagtail: Improper restriction handling on Page translation API endpoint

Wagtail Vulnerable to Cross-site Scripting in TableBlock class attributes

Wagtail Vulnerable to Cross-site Scripting in simple_translation admin interface

Wagtail has improper permission handling on admin preview endpoints

Improper Handling of Insufficient Permissions in `wagtail.contrib.settings`

Wagtail has permission check bypass when editing a model with per-field restrictions through `wagtail.contrib.settings` or `ModelViewSet`

Wagtail vulnerable to stored Cross-site Scripting attack via ModelAdmin views

Wagtail vulnerable to denial-of-service via memory exhaustion when uploading large files

Cross-site Scripting in wagtail

Improper validation of URLs ('Cross-site Scripting') in Wagtail rich text fields

Cross-Site Scripting in Wagtail

Potential Observable Timing Discrepancy in Wagtail

Possible XSS attack in Wagtail

From the blog

VulnSea has moved to vulnsea.com (and what changed since September)

What's new: open corpus, three new MCP tools, vendor advisories, package pages

Wiring VulnSea into an agent: a hands-on tutorial