Live CVE & 0day intelligence

Sound the depths of every vulnerability.

Newly released CVEs across every platform — sleek to read, verbose on demand, and served raw as markdown for AI and agent ingestion. Severity reads as depth: the deeper the contact, the graver the threat.

Browse the feed For agents → /llms.txt

Depth = severity + exploitation

HadalCritical and actively exploited (CISA KEV / 0day)
AbyssalCritical with a public exploit or in-the-wild use
MidnightCritical, or high with PoC / in-the-wild
TwilightHigh severity, or a signal on a lesser flaw
SunlitLow / medium · no exploitation signal

6291

Tracked CVEs

599

Critical

Exploited in wild

3868

Last 7 days

Feed

latest 100 free · sign in for the full corpus

100 matches

CVE-2026-54174High· 8.3

yesterday

melange: Incomplete package integrity verification allows data section substitution

▾ Twilightapko · chainguard.dev/apkovia GHSA

From the blog

All posts →

Jul 1, 2026

Wiring VulnSea into an agent: a hands-on tutorial

A step-by-step guide to plugging VulnSea into automated and agentic workflows — poll the delta, triage without burning tokens, match an SBOM, and let an MCP-native model do the reasoning.

Jun 29, 2026

VulnSea is live

CVE and 0day intelligence that reads like an instrument — built for analysts and AI agents alike. Here's what it does and where it's going.

Sound the depths of every vulnerability.

Feed

melange: Incomplete package integrity verification allows data section substitution

From the blog

Wiring VulnSea into an agent: a hands-on tutorial

VulnSea is live

TSDProxy: Internal proxy auth token forwarded to backend services enables management API escalation

prestashop/ps_facetedsearch: PHP Object Injection in faceted search cache allows unauthenticated RCE

SiYuan: Stored XSS to RCE via Unsanitized Attribute View Asset Cell Content

Secure Headers: CSP directive injection via sandbox, plugin_types, and report_to when given untrusted input

Clauster: Non-loopback deployments can serve the dashboard unauthenticated when auth.enabled is unset

Excon does not redact additional sensitive/risky headers when following redirects

SiYuan: Path Traversal via Double URL Encoding in /assets/*path (publish mode arbitrary file─read), Incomplete fix of CVE-2026-41894

SiYuan: Stored XSS to RCE via CSS-snippet <style> breakout in renderSnippet()

Authorizer: Unvalidated redirect_uri in /authorize leaks OAuth2 tokens to attacker-controlled URL

Excelize: Unbounded Row Index Allocation in Worksheet Parser (checkSheet OOM/Panic DoS)

CredSweeper: Recursive archive size-limit bypass in deep scanner allows crafted compressed inputs to exhaust resources

SiYuan: Unauthenticated SQLite Data Exfiltration via Template Injection in /api/icon/getDynamicIcon

SiYuan: Unauthenticated Admin API Access via Blanket chrome-extension:// Origin Allowlist

File Browser: Authentication Bypass via Proxy Auth Header Forgery

SiYuan: Stored XSS in Bazaar marketplace via package README event handlers

Windmill: Resource-scoped API tokens can read script contents outside their allowed path via scripts/list_search

`exploration` was removed from crates.io for malicious code

File Browser: Command Injection via Authentication Hook Shell Substitution (Pre-Authentication RCE)

BabelDOC: Arbitrary Code Execution via CMap Pickle Deserialization in babeldoc/pdfminer/cmapdb.py

NotrinosERP: Authenticated arbitrary file upload leads to remote code execution via HRM employee "Documents" (doc_file)

SafeInstall agent guard shell parsing can miss raw package execution

mcp-atlassian: Arbitrary server-side file read via attachment upload

mcp-atlassian: Arbitrary file read via missing path validation in confluence_upload_attachment

SiYuan: Stored XSS to RCE via attribute-view cell rendering in genAVValueHTML()