Live CVE & 0day intelligence

Sound the depths of every vulnerability.

Newly released CVEs across every platform — sleek to read, verbose on demand, and served raw as markdown for AI and agent ingestion. Severity reads as depth: the deeper the contact, the graver the threat.

Browse the feed For agents → /llms.txt

Depth = severity + exploitation

HadalCritical and actively exploited (CISA KEV / 0day)
AbyssalCritical with a public exploit or in-the-wild use
MidnightCritical, or high with PoC / in-the-wild
TwilightHigh severity, or a signal on a lesser flaw
SunlitLow / medium · no exploitation signal

65287

Tracked CVEs

6117

Critical

657

Exploited in wild

6068

Last 7 days

Trending now

Bluesky + Hacker News mentions, last 7 days

1CVE-2026-109618Critical· 9.2RCE via OOM corruption4464
2CVE-2026-109619Critical· 9.2RCE via stale global state1964
3CVE-2026-99999Critical· 9.3In the Linux kernel, the following vulnerability has been resolved: ipv4: validate checksum_start before completing checksum If a packet with bad checksum metadata gets into the ipv4 stack, skb_checksum_help can corrupt the network hea…863
4CVE-2026-110264Critical· 10.0Integer Overflow or Wraparound in GitLab267
5CVE-2026-108707Critical· 9.8Wukong_HRM through commit 186115e contains an authentication bypass vulnerability in ParamAspect that allows unauthenticated attackers to call every HRM API endpoint by omitting the AUTH-TOKEN header266

This week's digest →All digests

Feed

10 matches

CVE-2026-115494Medium· 5.3

yesterday

CSRF protection could be tricked by forged X-Forwarded-Host header in KNIME Business Hub

A flaw in the cross-site request forgery (CSRF) prevention of KNIME Business Hub prior to version 1.19.0 allows an authenticated attacker to perform a CSRF attack with passive user interaction. This means the state of a resource could be…

▾ SunlitKNIME · KNIME Business Hubvia CVEORG

CVE-2026-115454Medium· 5.3

yesterday

Large tables in data apps can bring down execution services in KNIME Hub

An excessive resource allocation issue in the remote workflow editing capabilities of KNIME Business Hub prior to version 1.19.0 allows a authenticated attack to exhaust resources on the server side. This leads to intermittent unavailabi…

▾ SunlitKNIME · KNIME Business Hubvia CVEORG

CVE-2026-115502Medium· 6.3

yesterday

DataApp links without logging expose job information to other user in KNIME Business Hub

A missing authorization check allows anyone having access to a "link without login" for a DataApp to list and potentially access jobs of other users created by the same link in KNIME Business Hub prior to 1.19.0. As workaround remove all…

▾ SunlitKNIME · KNIME Business Hubvia CVEORG

CVE-2026-115496Medium· 6.9

yesterday

Workflow names may be leaked to unauthenticated users in KNIME Business Hub

Overly informative error messages in the catalog functionality of KNIME Business Hub prior to version 1.18.5 may allow an authenticated remote attacker to see workflow names if their ID is known. A workaround is not possible.

▾ SunlitKNIME · KNIME Business Hubvia CVEORG

CVE-2026-115519Low· 2.1

yesterday

Sensitive cookies without 'Secure' and 'HttpOnly' attributes in KNIME Business Hub

Missing security attributes on sensitive cookies in KNIME Business Hub before version 1.19.0 allow an unauthenticated remote attacker to compromise user sessions if other security issues such as a cross-site scripting vulnerability or a …

▾ SunlitKNIME · KNIME Business Hubvia CVEORG

CVE-2026-115517Medium· 6.4

yesterday

Unrestricted network access between execution contexts in KNIME Business Hub

Unrestricted network access between execution contexts in KNIME Business Hub before version 1.19.0 allows an authenticated remote user to access open network ports on executors in different execution contexts. This only poses a security …

▾ SunlitKNIME · KNIME Business Hubvia CVEORG

CVE-2026-115516Medium· 6.9

yesterday

Basic account information visible to unauthenticated user in Business Hub SaaS

An incorrect authorization issue exposes basic account information to unauthorized remote users in KNIME Business Hub SaaS before version 1.19.0. A workaround is not possible. The same behaviour is present in on-premise KNIME Business H…

▾ SunlitKNIME · KNIME Business Hub SaaSvia CVEORG

CVE-2025-14262Medium· 4.3

10mo ago

A wrong permission check in KNIME Business Hub before version 1.17.0 allowed an authenticated user to save jobs of other users as if there were saved by the job owner

A wrong permission check in KNIME Business Hub before version 1.17.0 allowed an authenticated user to save jobs of other users as if there were saved by the job owner. The attacker must have permissions to access the jobs but then they w…

▾ Sunlitknime · business_hubEPSS 0.18%via NVD

CVE-2025-11240High· 7.2

1y ago

An open redirect vulnerability existed in KNIME Business Hub prior to version 1.16.0

An open redirect vulnerability existed in KNIME Business Hub prior to version 1.16.0. An unauthenticated remote attacker could craft a link to a legitimate KNIME Business Hub installation which, when opened by the user, redirects the use…

▾ Twilightknime · business_hubEPSS 0.26%via NVD

CVE-2025-11239Medium· 4.3

1y ago

Potentially sensitive information in jobs on KNIME Business Hub prior to 1.16.0 were visible to all members of the user's team

Potentially sensitive information in jobs on KNIME Business Hub prior to 1.16.0 were visible to all members of the user's team. Starting with KNIME Business Hub 1.16.0 only metadata of jobs is shown to team members. Only the creator of a…

▾ Sunlitknime · business_hubEPSS 0.21%via NVD

From the blog

All posts →

Sep 8, 2026

Sound the depths of every vulnerability.

Trending now

Feed

CSRF protection could be tricked by forged X-Forwarded-Host header in KNIME Business Hub

Large tables in data apps can bring down execution services in KNIME Hub

DataApp links without logging expose job information to other user in KNIME Business Hub

Workflow names may be leaked to unauthenticated users in KNIME Business Hub

Sensitive cookies without 'Secure' and 'HttpOnly' attributes in KNIME Business Hub

Unrestricted network access between execution contexts in KNIME Business Hub

Basic account information visible to unauthenticated user in Business Hub SaaS

A wrong permission check in KNIME Business Hub before version 1.17.0 allowed an authenticated user to save jobs of other users as if there were saved by the job owner

An open redirect vulnerability existed in KNIME Business Hub prior to version 1.16.0

Potentially sensitive information in jobs on KNIME Business Hub prior to 1.16.0 were visible to all members of the user's team

From the blog

What's new: open corpus, three new MCP tools, vendor advisories, package pages

Wiring VulnSea into an agent: a hands-on tutorial

VulnSea is live

Sound the depths of every vulnerability.

Trending now

Feed

CSRF protection could be tricked by forged X-Forwarded-Host header in KNIME Business Hub

Large tables in data apps can bring down execution services in KNIME Hub

DataApp links without logging expose job information to other user in KNIME Business Hub

Workflow names may be leaked to unauthenticated users in KNIME Business Hub

Sensitive cookies without 'Secure' and 'HttpOnly' attributes in KNIME Business Hub

Unrestricted network access between execution contexts in KNIME Business Hub

Basic account information visible to unauthenticated user in Business Hub SaaS

A wrong permission check in KNIME Business Hub before version 1.17.0 allowed an authenticated user to save jobs of other users as if there were saved by the job owner

An open redirect vulnerability existed in KNIME Business Hub prior to version 1.16.0

Potentially sensitive information in jobs on KNIME Business Hub prior to 1.16.0 were visible to all members of the user's team

From the blog

What's new: open corpus, three new MCP tools, vendor advisories, package pages

Wiring VulnSea into an agent: a hands-on tutorial

VulnSea is live