Live CVE & 0day intelligence

Sound the depths of every vulnerability.

Newly released CVEs across every platform — sleek to read, verbose on demand, and served raw as markdown for AI and agent ingestion. Severity reads as depth: the deeper the contact, the graver the threat.

Browse the feed For agents → /llms.txt

Depth = severity + exploitation

HadalCritical and actively exploited (CISA KEV / 0day)
AbyssalCritical with a public exploit or in-the-wild use
MidnightCritical, or high with PoC / in-the-wild
TwilightHigh severity, or a signal on a lesser flaw
SunlitLow / medium · no exploitation signal

30352

Tracked CVEs

2979

Critical

377

Exploited in wild

5271

Last 7 days

Trending now

Bluesky + Hacker News mentions, last 7 days

1CVE-2026-85046High· 8.8Type confusion in V8 in Google Chrome prior to 152.0.7977.82 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page874
2CVE-2026-58704High· 8.8In Cellular Modem, there is a possible permission bypass due to a logic error in the code373
3CVE-2026-69836Critical· 10.0Microsoft Entra ID Remote Code Execution Vulnerability267
4CVE-2026-66747Critical· 9.8Zbtlink router firmware ships an embedded remote-control implant, ENDLESSDOORS, present in every published build across the product line266
5CVE-2026-18963Critical· 9.1A flaw was found in the reset-credentials flow of the keycloak-services component, which is the core engine for identity and access management in Red Hat Build of Keycloak263

This week's digest →All digests

Feed

24 matches

CVE-2026-93742Critical· 9.9PoC

2d ago

A weakness has been identified in Totolink A3002MU Hh-B20211125.1046

A weakness has been identified in Totolink A3002MU Hh-B20211125.1046. Affected by this issue is the function formWsc of the file /boafrm/formWsc. This manipulation of the argument localPin causes command injection. The attack can be init…

▾ AbyssalTotolink · A3002MUEPSS 1.9%via NVD

CVE-2026-93741Critical· 10.0

2d ago

A security flaw has been discovered in Totolink A3002MU Hh-B20211125.1046

A security flaw has been discovered in Totolink A3002MU Hh-B20211125.1046. Affected by this vulnerability is the function formWlWds of the file /boafrm/formWlWds. The manipulation of the argument submit-url results in buffer overflow. It…

▾ MidnightTotolink · A3002MUEPSS 0.64%via NVD

CVE-2026-93740Critical· 10.0PoC

3d ago

A vulnerability was identified in Totolink A3002MU Hh-B20211125.1046

A vulnerability was identified in Totolink A3002MU Hh-B20211125.1046. Affected is the function formWlEncrypt of the file /boafrm/formWlEncrypt. The manipulation of the argument submit-url leads to buffer overflow. It is possible to initi…

▾ AbyssalTotolink · A3002MUEPSS 0.61%via NVD

CVE-2026-93739Critical· 9.9

3d ago

A vulnerability was determined in Totolink A3002MU Hh-B20211125.1046

A vulnerability was determined in Totolink A3002MU Hh-B20211125.1046. This impacts the function formWlAc of the file /boafrm/formWlAc. Executing a manipulation of the argument submit-url can lead to buffer overflow. The attack may be per…

▾ MidnightTotolink · A3002MUEPSS 0.49%via NVD

CVE-2026-93738Critical· 9.9

3d ago

A vulnerability was found in Totolink A3002MU Hh-B20211125.1046

A vulnerability was found in Totolink A3002MU Hh-B20211125.1046. This affects the function formSchedule of the file /boafrm/formSchedule. Performing a manipulation of the argument webpage results in buffer overflow. The attack is possibl…

▾ MidnightTotolink · A3002MUEPSS 0.50%via NVD

CVE-2026-91853High· 7.4PoC

6d ago

A vulnerability has been found in TOTOLINK X5000R 9.1.0cu.2089_B20211224

A vulnerability has been found in TOTOLINK X5000R 9.1.0cu.2089_B20211224. The impacted element is the function exportOvpn of the file /cgi-bin/cstecgi.cgi?action=exportOvpn&type=user of the component Export Ovpn Handler. The manipulation…

▾ MidnightTOTOLINK · X5000REPSS 1.4%via NVD

CVE-2026-90608Critical· 9.9PoC

1w ago

A flaw has been found in Totolink A3002MU Hh-B20211125.1046

A flaw has been found in Totolink A3002MU Hh-B20211125.1046. The affected element is the function formPortFw of the file /boafrm/formPortFw of the component boa. This manipulation of the argument service_type causes buffer overflow. It i…

▾ AbyssalTotolink · A3002MUEPSS 0.80%via NVD

CVE-2026-90606Critical· 9.9PoC

1w ago

A security vulnerability has been detected in Totolink A3002MU Hh-B20211125.1046

A security vulnerability has been detected in Totolink A3002MU Hh-B20211125.1046. This issue affects the function formIpv6Setup of the file /boafrm/formIpv6Setup of the component boa. The manipulation of the argument static_ipv6 leads to…

▾ AbyssalTotolink · A3002MUEPSS 0.49%via NVD

CVE-2026-90605Critical· 9.9PoC

1w ago

A weakness has been identified in Totolink A3002MU Hh-B20211125.1046

A weakness has been identified in Totolink A3002MU Hh-B20211125.1046. This vulnerability affects the function formFilter of the file /boafrm/formFilter of the component boa. Executing a manipulation of the argument ip6addr can lead to bu…

▾ AbyssalTotolink · A3002MUEPSS 0.47%via NVD

CVE-2026-90604Low· 3.5PoC

1w ago

A security flaw has been discovered in Totolink A3002MU Hh-B20211125.1046

A security flaw has been discovered in Totolink A3002MU Hh-B20211125.1046. This affects an unknown part of the component Anchor Tag Handler. Performing a manipulation results in cross site scripting. Remote exploitation of the attack is …

▾ TwilightTotolink · A3002MUEPSS 0.20%via NVD

CVE-2026-90607Critical· 9.9PoC

1w ago

A vulnerability was detected in Totolink A3002MU Hh-B20211125.1046

A vulnerability was detected in Totolink A3002MU Hh-B20211125.1046. Impacted is the function formNewSchedule of the file /boafrm/formNewSchedule of the component boa. The manipulation of the argument submit-url results in buffer overflow…

▾ AbyssalTotolink · A3002MUEPSS 0.47%via NVD

CVE-2026-26731High· 8.8PoC

7mo ago

TOTOLINK A3002RU V2.1.1-B20211108.1455 was discovered to contain a stack-based buffer overflow via the routernamer`parameter in the formDnsv6 function.

▾ Midnighttotolink · a3002ru_firmwareEPSS 0.50%via NVD

CVE-2025-9577Low· 2.5

1y ago

A security flaw has been discovered in TOTOLINK X2000R up to 2.0.0

A security flaw has been discovered in TOTOLINK X2000R up to 2.0.0. The affected element is an unknown function of the file /etc/shadow.sample of the component Administrative Interface. The manipulation results in use of default credenti…

▾ Sunlittotolink · x2000r_firmwareEPSS 0.21%via NVD

CVE-2022-32993Critical· 9.8

4y ago

TOTOLINK A7000R V4.1cu.4134 was discovered to contain an access control issue via /cgi-bin/ExportSettings.sh.

▾ Midnighttotolink · a7000r_firmwareEPSS 0.94%via NVD

CVE-2021-42877High· 7.5

4y ago

TOTOLINK EX1200T V4.1.2cu.5215 contains a denial of service vulnerability in function RebootSystem of the file lib/cste_modules/system which can reboot the system.

▾ Twilighttotolink · ex1200t_firmwareEPSS 1.7%via NVD

CVE-2021-42875Critical· 9.8

4y ago

TOTOLINK EX1200T V4.1.2cu.5215 contains a remote command injection vulnerability in the function setDiagnosisCfg of the file lib/cste_modules/system.so to control the ipDoamin.

▾ Midnighttotolink · ex1200t_firmwareEPSS 4.4%via NVD

CVE-2021-42872Critical· 9.8

4y ago

TOTOLINK EX1200T V4.1.2cu.5215 is affected by a command injection vulnerability that can remotely execute arbitrary code.

▾ Midnighttotolink · ex1200t_firmwareEPSS 6.6%via NVD

CVE-2022-29641High· 7.5

4y ago

TOTOLINK A3100R V4.1.2cu.5050_B20200504 and V4.1.2cu.5247_B20211129 were discovered to contain a stack overflow via the startTime and endTime parameters in the function setParentalRules

TOTOLINK A3100R V4.1.2cu.5050_B20200504 and V4.1.2cu.5247_B20211129 were discovered to contain a stack overflow via the startTime and endTime parameters in the function setParentalRules. This vulnerability allows attackers to cause a Den…

▾ Twilighttotolink · a3100r_firmwareEPSS 1.2%via NVD

CVE-2021-46010High· 8.8

4y ago

Totolink A3100R V5.9c.4577 suffers from Use of Insufficiently Random Values via the web configuration

Totolink A3100R V5.9c.4577 suffers from Use of Insufficiently Random Values via the web configuration. The SESSION_ID is predictable. An attacker can hijack a valid session and conduct further malicious operations.

▾ Twilighttotolink · a3100r_firmwareEPSS 1.2%via NVD

CVE-2021-46009Critical· 9.8

4y ago

In Totolink A3100R V5.9c.4577, multiple pages can be read by curl or Burp Suite without authentication

In Totolink A3100R V5.9c.4577, multiple pages can be read by curl or Burp Suite without authentication. Additionally, admin configurations can be set without cookies.

▾ Midnighttotolink · a3100r_firmwareEPSS 13%via NVD

CVE-2021-46008High· 8.8

4y ago

In totolink a3100r V5.9c.4577, the hard-coded telnet password can be discovered from official released firmware

In totolink a3100r V5.9c.4577, the hard-coded telnet password can be discovered from official released firmware. An attacker, who has connected to the Wi-Fi, can easily telnet into the target with root shell if the telnet is function tur…

▾ Twilighttotolink · a3100r_firmwareEPSS 0.92%via NVD

CVE-2021-46007Critical· 9.8

4y ago

totolink a3100r V5.9c.4577 is vulnerable to os command injection

totolink a3100r V5.9c.4577 is vulnerable to os command injection. The backend of a page is executing the "ping" command, and the input field does not adequately filter special symbols. This can lead to command injection attacks.

▾ Midnighttotolink · ar3100r_firmwareEPSS 2.6%via NVD

CVE-2021-46006Medium· 6.5

4y ago

In Totolink A3100R V5.9c.4577, "test.asp" contains an API-like function, which is not authenticated

In Totolink A3100R V5.9c.4577, "test.asp" contains an API-like function, which is not authenticated. Using this function, an attacker can configure multiple settings without authentication.

▾ Sunlittotolink · a3100r_firmwareEPSS 5.5%via NVD

CVE-2021-44620Critical· 9.8

4y ago

A Command Injection vulnerability exits in TOTOLINK A3100R <=V4.1.2cu.5050_B20200504 in adm/ntm.asp via the hosTime parameters.

▾ Midnighttotolink · a3100r_firmwareEPSS 1.4%via NVD

From the blog

All posts →

Sep 8, 2026

Sound the depths of every vulnerability.

Trending now

Feed

A weakness has been identified in Totolink A3002MU Hh-B20211125.1046

A security flaw has been discovered in Totolink A3002MU Hh-B20211125.1046

A vulnerability was identified in Totolink A3002MU Hh-B20211125.1046

A vulnerability was determined in Totolink A3002MU Hh-B20211125.1046

A vulnerability was found in Totolink A3002MU Hh-B20211125.1046

A vulnerability has been found in TOTOLINK X5000R 9.1.0cu.2089_B20211224

A flaw has been found in Totolink A3002MU Hh-B20211125.1046

A security vulnerability has been detected in Totolink A3002MU Hh-B20211125.1046

A weakness has been identified in Totolink A3002MU Hh-B20211125.1046

A security flaw has been discovered in Totolink A3002MU Hh-B20211125.1046

A vulnerability was detected in Totolink A3002MU Hh-B20211125.1046

TOTOLINK A3002RU V2.1.1-B20211108.1455 was discovered to contain a stack-based buffer overflow via the routernamer`parameter in the formDnsv6 function.

A security flaw has been discovered in TOTOLINK X2000R up to 2.0.0

TOTOLINK A7000R V4.1cu.4134 was discovered to contain an access control issue via /cgi-bin/ExportSettings.sh.

TOTOLINK EX1200T V4.1.2cu.5215 contains a denial of service vulnerability in function RebootSystem of the file lib/cste_modules/system which can reboot the system.

TOTOLINK EX1200T V4.1.2cu.5215 contains a remote command injection vulnerability in the function setDiagnosisCfg of the file lib/cste_modules/system.so to control the ipDoamin.

TOTOLINK EX1200T V4.1.2cu.5215 is affected by a command injection vulnerability that can remotely execute arbitrary code.

TOTOLINK A3100R V4.1.2cu.5050_B20200504 and V4.1.2cu.5247_B20211129 were discovered to contain a stack overflow via the startTime and endTime parameters in the function setParentalRules

Totolink A3100R V5.9c.4577 suffers from Use of Insufficiently Random Values via the web configuration

In Totolink A3100R V5.9c.4577, multiple pages can be read by curl or Burp Suite without authentication

In totolink a3100r V5.9c.4577, the hard-coded telnet password can be discovered from official released firmware

totolink a3100r V5.9c.4577 is vulnerable to os command injection

In Totolink A3100R V5.9c.4577, "test.asp" contains an API-like function, which is not authenticated

A Command Injection vulnerability exits in TOTOLINK A3100R <=V4.1.2cu.5050_B20200504 in adm/ntm.asp via the hosTime parameters.

From the blog

What's new: open corpus, three new MCP tools, vendor advisories, package pages

Wiring VulnSea into an agent: a hands-on tutorial

VulnSea is live

Sound the depths of every vulnerability.

Trending now

Feed

A weakness has been identified in Totolink A3002MU Hh-B20211125.1046

A security flaw has been discovered in Totolink A3002MU Hh-B20211125.1046

A vulnerability was identified in Totolink A3002MU Hh-B20211125.1046

A vulnerability was determined in Totolink A3002MU Hh-B20211125.1046

A vulnerability was found in Totolink A3002MU Hh-B20211125.1046

A vulnerability has been found in TOTOLINK X5000R 9.1.0cu.2089_B20211224

A flaw has been found in Totolink A3002MU Hh-B20211125.1046

A security vulnerability has been detected in Totolink A3002MU Hh-B20211125.1046

A weakness has been identified in Totolink A3002MU Hh-B20211125.1046

A security flaw has been discovered in Totolink A3002MU Hh-B20211125.1046

A vulnerability was detected in Totolink A3002MU Hh-B20211125.1046

TOTOLINK A3002RU V2.1.1-B20211108.1455 was discovered to contain a stack-based buffer overflow via the routernamer`parameter in the formDnsv6 function.

A security flaw has been discovered in TOTOLINK X2000R up to 2.0.0

TOTOLINK A7000R V4.1cu.4134 was discovered to contain an access control issue via /cgi-bin/ExportSettings.sh.

TOTOLINK EX1200T V4.1.2cu.5215 contains a denial of service vulnerability in function RebootSystem of the file lib/cste_modules/system which can reboot the system.

TOTOLINK EX1200T V4.1.2cu.5215 contains a remote command injection vulnerability in the function setDiagnosisCfg of the file lib/cste_modules/system.so to control the ipDoamin.

TOTOLINK EX1200T V4.1.2cu.5215 is affected by a command injection vulnerability that can remotely execute arbitrary code.

TOTOLINK A3100R V4.1.2cu.5050_B20200504 and V4.1.2cu.5247_B20211129 were discovered to contain a stack overflow via the startTime and endTime parameters in the function setParentalRules

Totolink A3100R V5.9c.4577 suffers from Use of Insufficiently Random Values via the web configuration

In Totolink A3100R V5.9c.4577, multiple pages can be read by curl or Burp Suite without authentication

In totolink a3100r V5.9c.4577, the hard-coded telnet password can be discovered from official released firmware

totolink a3100r V5.9c.4577 is vulnerable to os command injection

In Totolink A3100R V5.9c.4577, "test.asp" contains an API-like function, which is not authenticated

A Command Injection vulnerability exits in TOTOLINK A3100R <=V4.1.2cu.5050_B20200504 in adm/ntm.asp via the hosTime parameters.

From the blog

What's new: open corpus, three new MCP tools, vendor advisories, package pages

Wiring VulnSea into an agent: a hands-on tutorial

VulnSea is live