Live CVE & 0day intelligence

Sound the depths of every vulnerability.

Newly released CVEs across every platform — sleek to read, verbose on demand, and served raw as markdown for AI and agent ingestion. Severity reads as depth: the deeper the contact, the graver the threat.

Browse the feed For agents → /llms.txt

Depth = severity + exploitation

HadalCritical and actively exploited (CISA KEV / 0day)
AbyssalCritical with a public exploit or in-the-wild use
MidnightCritical, or high with PoC / in-the-wild
TwilightHigh severity, or a signal on a lesser flaw
SunlitLow / medium · no exploitation signal

55308

Tracked CVEs

5285

Critical

544

Exploited in wild

11500

Last 7 days

Trending now

Bluesky + Hacker News mentions, last 7 days

1CVE-2026-88771Critical· 9.8Improper input validation vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway. This issue affects ADC: before 14.1-73.37, before 13.1-64.23, before 14.1-73.37 FIPS, and before 13.1.37.279 FIPS and NDcPP; Gateway: before 1…479

This week's digest →All digests

Feed

6 matches

CVE-2026-105278Critical· 9.8

6d ago

The published Docker image for openPDC includes a fixed administrative credential with no forced change on first use

The published Docker image for openPDC includes a fixed administrative credential with no forced change on first use. An attacker with network access to the management interface can authenticate using this credential and gain full admini…

▾ MidnightGrid Protection Alliance · openPDC (Docker image)EPSS 0.34%via NVD

CVE-2026-85479Medium· 5.3

6d ago

The STTP-based data publisher on openPDC accepts network connections without authentication in its default configuration

The STTP-based data publisher on openPDC accepts network connections without authentication in its default configuration. An unauthenticated network attacker can connect to this interface and exchange data with it.

▾ SunlitGrid Protection Alliance · openPDCEPSS 0.25%via NVD

CVE-2026-105281High· 7.5

6d ago

The internal data publisher on openPDC accepts network connections without authentication in its default configuration

The internal data publisher on openPDC accepts network connections without authentication in its default configuration. An unauthenticated network attacker can connect to this interface and retrieve the complete device and measurement to…

▾ TwilightGrid Protection Alliance · openPDCEPSS 0.31%via NVD

CVE-2026-104629High· 8.8

6d ago

A component loading mechanism in openPDC and openHistorian will construct and run any specified type, which may be an invalid component to load

A component loading mechanism in openPDC and openHistorian will construct and run any specified type, which may be an invalid component to load. An attacker with an authenticated user account and the ability to place a file on the host f…

▾ TwilightGrid Protection Alliance · openPDCEPSS 0.34%via NVD

CVE-2026-101022Medium· 4.3

6d ago

A Modbus connection feature on openPDC accepts a caller-specified destination address and port with no restriction on which internal hosts may be targeted

A Modbus connection feature on openPDC accepts a caller-specified destination address and port with no restriction on which internal hosts may be targeted. An authenticated user can attempt connections to arbitrary internal network desti…

▾ SunlitGrid Protection Alliance · openPDCEPSS 0.19%via NVD

CVE-2026-100730Critical· 9.8

6d ago

A service console interface on openPDC and openHistorian deserializes a client-supplied data structure

A service console interface on openPDC and openHistorian deserializes a client-supplied data structure. On systems using Windows Authentication, an attacker must already be authenticated to reach this function; on systems without Windows…

▾ MidnightGrid Protection Alliance · openPDCEPSS 0.63%via NVD

From the blog

All posts →

Sep 8, 2026

Sound the depths of every vulnerability.

Trending now

Feed

The published Docker image for openPDC includes a fixed administrative credential with no forced change on first use

The STTP-based data publisher on openPDC accepts network connections without authentication in its default configuration

The internal data publisher on openPDC accepts network connections without authentication in its default configuration

A component loading mechanism in openPDC and openHistorian will construct and run any specified type, which may be an invalid component to load

A Modbus connection feature on openPDC accepts a caller-specified destination address and port with no restriction on which internal hosts may be targeted

A service console interface on openPDC and openHistorian deserializes a client-supplied data structure

From the blog

What's new: open corpus, three new MCP tools, vendor advisories, package pages

Wiring VulnSea into an agent: a hands-on tutorial

VulnSea is live

Sound the depths of every vulnerability.

Trending now

Feed

The published Docker image for openPDC includes a fixed administrative credential with no forced change on first use

The STTP-based data publisher on openPDC accepts network connections without authentication in its default configuration

The internal data publisher on openPDC accepts network connections without authentication in its default configuration

A component loading mechanism in openPDC and openHistorian will construct and run any specified type, which may be an invalid component to load

A Modbus connection feature on openPDC accepts a caller-specified destination address and port with no restriction on which internal hosts may be targeted

A service console interface on openPDC and openHistorian deserializes a client-supplied data structure

From the blog

What's new: open corpus, three new MCP tools, vendor advisories, package pages

Wiring VulnSea into an agent: a hands-on tutorial

VulnSea is live