Live CVE & 0day intelligence

Sound the depths of every vulnerability.

Newly released CVEs across every platform — sleek to read, verbose on demand, and served raw as markdown for AI and agent ingestion. Severity reads as depth: the deeper the contact, the graver the threat.

Browse the feed For agents → /llms.txt

Depth = severity + exploitation

HadalCritical and actively exploited (CISA KEV / 0day)
AbyssalCritical with a public exploit or in-the-wild use
MidnightCritical, or high with PoC / in-the-wild
TwilightHigh severity, or a signal on a lesser flaw
SunlitLow / medium · no exploitation signal

63716

Tracked CVEs

5888

Critical

585

Exploited in wild

11467

Last 7 days

Trending now

Bluesky + Hacker News mentions, last 7 days

1CVE-2026-108707Critical· 9.8Wukong_HRM through commit 186115e contains an authentication bypass vulnerability in ParamAspect that allows unauthenticated attackers to call every HRM API endpoint by omitting the AUTH-TOKEN header266

This week's digest →All digests

Feed

16 matches

CVE-2026-112899Medium

yesterday

Pillow: EPS load(scale) lets Ghostscript render past the decompression bomb limit

▾ SunlitPillow · Pillowvia GHSA

CVE-2026-112895High· 8.7

yesterday

Pillow: Unbounded recursion parsing a PDF page tree or trailer chain (incomplete fix for CVE-2026-42310)

▾ Twilightpillow · pillowEPSS 0.29%via GHSA

CVE-2026-112897High· 8.7

yesterday

Pillow: TiffDecode returns uninitialized memory as pixels for short JPEG strips

▾ TwilightPillow · PillowEPSS 0.29%via GHSA

CVE-2026-112896High· 8.8PoC

yesterday

Pillow: TIFF encoder ColorMap plane-size mismatch causes a heap out-of-bounds read

▾ MidnightPillow · PillowEPSS 0.29%via GHSA

CVE-2026-112395Medium· 6.5

yesterday

Pillow: OOB read in TiffDecode.c tile and RGBA paths leaks heap memory into pixels

▾ TwilightPillow · PillowEPSS 0.29%via GHSA

CVE-2026-112397High· 8.7PoC

yesterday

Pillow: Out-of-bounds access in _imagingmorph on a zero-width image

▾ MidnightPillow · PillowEPSS 0.44%via GHSA

CVE-2026-59198Medium· 6.5

3mo ago

Pillow TGA RLE encoder can serialize up to ~57 KB of adjacent heap data into generated images

▾ Sunlitpillow · pillowEPSS 0.31%via OSV

CVE-2026-59203Medium· 5.3

3mo ago

Pillow EpsImagePlugin negative %%BeginBinary byte count causes infinite loop denial of service

▾ Sunlitpillow · pillowEPSS 0.40%via OSV

CVE-2026-55798Medium· 4.5

3mo ago

Pillow: WindowsViewer.get_command() OS command injection via unescaped shell path

▾ Sunlitpillow · pillowEPSS 0.18%via OSV

CVE-2026-54059High· 7.5

3mo ago

Pillow `PcfFontFile._load_bitmaps()`: `Image.frombytes()` called without `_decompression_bomb_check()` — bomb protection bypass via PCF f…

Pillow `PcfFontFile._load_bitmaps()`: `Image.frombytes()` called without `_decompression_bomb_check()` — bomb protection bypass via PCF font loading

▾ Twilightpillow · pillowEPSS 0.41%via OSV

CVE-2026-42309Medium· 5.5

5mo ago

Pillow has a heap buffer overflow with nested list coordinates

▾ Sunlitpillow · pillowEPSS 0.18%via GHSA

CVE-2024-28219Medium· 6.7

2y ago

Pillow buffer overflow vulnerability

▾ Sunlitpillow · pillowEPSS 1.00%via OSV

CVE-2023-50447High· 8.1

2y ago

Arbitrary Code Execution in Pillow

▾ Twilightpillow · pillowEPSS 1.7%via OSV

From the blog

All posts →

Sep 8, 2026

What's new: open corpus, three new MCP tools, vendor advisories, package pages

A summary of everything that shipped over the last two weeks — the whole corpus is open, agents get change feeds, alias resolution and EPSS movers, and the data now includes CVE.org, vendor CSAF, aggregated exploits and per-source scores.

Jul 1, 2026

Wiring VulnSea into an agent: a hands-on tutorial

A step-by-step guide to plugging VulnSea into automated and agentic workflows — poll the delta, triage without burning tokens, match an SBOM, and let an MCP-native model do the reasoning.

Jun 29, 2026

VulnSea is live

CVE and 0day intelligence that reads like an instrument — built for analysts and AI agents alike. Here's what it does and where it's going.

Sound the depths of every vulnerability.

Trending now

Feed

Pillow: EPS load(scale) lets Ghostscript render past the decompression bomb limit

Pillow: Unbounded recursion parsing a PDF page tree or trailer chain (incomplete fix for CVE-2026-42310)

Pillow: TiffDecode returns uninitialized memory as pixels for short JPEG strips

Pillow: TIFF encoder ColorMap plane-size mismatch causes a heap out-of-bounds read

Pillow tiled-TIFF decoder reads past tile buffer in copy4 (Unpack.c:1290)

Pillow: GIF seek keeps rejected size after DecompressionBombError, allowing DoS

Pillow: Heap buffer overflow in ImagingJpegDecode

Pillow: OOB read in TiffDecode.c tile and RGBA paths leaks heap memory into pixels

Pillow: Out-of-bounds access in _imagingmorph on a zero-width image

Pillow TGA RLE encoder can serialize up to ~57 KB of adjacent heap data into generated images

Pillow EpsImagePlugin negative %%BeginBinary byte count causes infinite loop denial of service

Pillow: WindowsViewer.get_command() OS command injection via unescaped shell path

Pillow `PcfFontFile._load_bitmaps()`: `Image.frombytes()` called without `_decompression_bomb_check()` — bomb protection bypass via PCF f…

Pillow has a heap buffer overflow with nested list coordinates

Pillow buffer overflow vulnerability

Arbitrary Code Execution in Pillow

From the blog

What's new: open corpus, three new MCP tools, vendor advisories, package pages

Wiring VulnSea into an agent: a hands-on tutorial

VulnSea is live

Sound the depths of every vulnerability.

Trending now

Feed

Pillow: EPS load(scale) lets Ghostscript render past the decompression bomb limit

Pillow: Unbounded recursion parsing a PDF page tree or trailer chain (incomplete fix for CVE-2026-42310)

Pillow: TiffDecode returns uninitialized memory as pixels for short JPEG strips

Pillow: TIFF encoder ColorMap plane-size mismatch causes a heap out-of-bounds read

Pillow tiled-TIFF decoder reads past tile buffer in copy4 (Unpack.c:1290)

Pillow: GIF seek keeps rejected size after DecompressionBombError, allowing DoS

Pillow: Heap buffer overflow in ImagingJpegDecode

Pillow: OOB read in TiffDecode.c tile and RGBA paths leaks heap memory into pixels

Pillow: Out-of-bounds access in _imagingmorph on a zero-width image

Pillow TGA RLE encoder can serialize up to ~57 KB of adjacent heap data into generated images

Pillow EpsImagePlugin negative %%BeginBinary byte count causes infinite loop denial of service

Pillow: WindowsViewer.get_command() OS command injection via unescaped shell path

Pillow `PcfFontFile._load_bitmaps()`: `Image.frombytes()` called without `_decompression_bomb_check()` — bomb protection bypass via PCF f…

Pillow has a heap buffer overflow with nested list coordinates

Pillow buffer overflow vulnerability

Arbitrary Code Execution in Pillow

From the blog

What's new: open corpus, three new MCP tools, vendor advisories, package pages

Wiring VulnSea into an agent: a hands-on tutorial

VulnSea is live