Newly released CVEs across every platform — sleek to read, verbose on demand, and served raw as markdown for AI and agent ingestion. Severity reads as depth: the deeper the contact, the graver the threat.
Depth = severity + exploitation
CVE-2026-105297High· 7.5Summary Before version 0.8.1, Pingora's HTTP/2 server used the h2 crate's default limits unless the application set its own 16 MiB decoded header-list size and no limit on concurrent streams. A remote, unauthenticated client can send …
CVE-2026-105298Medium· 6.3Summary Before version 0.9.0, Pingora accepted HTTP/2 requests whose Host header differed from the :authority pseudo-header. Request filters, cache keys, and logs that read the request URI (session.req_header().uri) saw the :authority…
CVE-2026-105299High· 8.7Summary Before version 0.9.0, the HTTP/1 upstream path in pingora-proxy passed the downstream request through upstream_request_filter and wrote it to the upstream without removing the client's Connection header, other hop-by-hop heade…
CVE-2025-8556Low· 3.7CIRCL-Fourq: Missing and wrong validation can lead to incorrect results
CVE-2023-1732Medium· 5.3Improper random reading in CIRCL
CVE-2023-1314High· 7.5cloudflared's Installer has Local Privilege Escalation Vulnerability
CVE-2022-3616Medium· 5.4OctoRPKI crashes when max iterations is reached
CVE-2022-2529High· 7.5Cloudflare GoFlow vulnerable to a Denial of Service in the sflow packet handling package
CVE-2021-3911Medium· 4.2Misconfigured IP address field in ROA leads to OctoRPKI crash
CVE-2021-3912Medium· 4.2OctoRPKI crashes when processing GZIP bomb returned via malicious repository
CVE-2021-3908Medium· 5.9Infinite certificate chain depth results in OctoRPKI running forever
CVE-2021-3909Medium· 4.4Infinite open connection causes OctoRPKI to hang forever
CVE-2021-3910High· 7.5NUL character in ROA causes OctoRPKI to crash
CVE-2021-3761High· 7.5OctoRPKI lacks contextual out-of-bounds check when validating RPKI ROA maxLength values
A summary of everything that shipped over the last two weeks — the whole corpus is open, agents get change feeds, alias resolution and EPSS movers, and the data now includes CVE.org, vendor CSAF, aggregated exploits and per-source scores.
A step-by-step guide to plugging VulnSea into automated and agentic workflows — poll the delta, triage without burning tokens, match an SBOM, and let an MCP-native model do the reasoning.
CVE and 0day intelligence that reads like an instrument — built for analysts and AI agents alike. Here's what it does and where it's going.