Live CVE & 0day intelligence

Sound the depths of every vulnerability.

Newly released CVEs across every platform — sleek to read, verbose on demand, and served raw as markdown for AI and agent ingestion. Severity reads as depth: the deeper the contact, the graver the threat.

Browse the feed For agents → /llms.txt

Depth = severity + exploitation

HadalCritical and actively exploited (CISA KEV / 0day)
AbyssalCritical with a public exploit or in-the-wild use
MidnightCritical, or high with PoC / in-the-wild
TwilightHigh severity, or a signal on a lesser flaw
SunlitLow / medium · no exploitation signal

60544

Tracked CVEs

5658

Critical

567

Exploited in wild

12619

Last 7 days

Trending now

Bluesky + Hacker News mentions, last 7 days

1CVE-2026-88771Critical· 9.8Improper input validation vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway. This issue affects ADC: before 14.1-73.37, before 13.1-64.23, before 14.1-73.37 FIPS, and before 13.1.37.279 FIPS and NDcPP; Gateway: before 1…479

This week's digest →All digests

Feed

6 matches

CVE-2026-59963High· 7.1

2d ago

Tandoor Recipes: Private recipe file and share-link authorization bypass in recipe utility API endpoints

Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Prior to 2.6.10, recipe utility endpoints retrieve same-Space Recipe objects without invoking the private-recipe owner or sharing permis…

▾ TwilightTandoorRecipes · recipesEPSS 0.21%via CVEORG

CVE-2026-61726High· 8.1

2d ago

Tandoor Recipes: Private recipe authorization bypass via /api/step/ - read and modify another Space member's private recipe content

Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Prior to 2.6.12, StepViewSet and IngredientViewSet filter only by active Space and use role-level CustomIsUser checks instead of the pri…

▾ TwilightTandoorRecipes · recipesEPSS 0.23%via CVEORG

CVE-2026-59970High· 7.7PoC

2d ago

Tandoor Recipes: Blind SSRF via AI provider URL (api_base)

Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Prior to 2.6.10, passes an administrator-controlled AI provider URL directly to LiteLLM without applying the server's outbound-request S…

▾ MidnightTandoorRecipes · recipesEPSS 0.31%via CVEORG

CVE-2026-59966Medium· 5.7PoC

2d ago

Tandoor Recipes: ReDoS (Regular Expression Denial of Service) via User-Controlled Automation Regex Patterns

Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Prior to 2.6.10, executes user-controlled Automation regular-expression patterns with Python re.sub() without complexity validation or a…

▾ TwilightTandoorRecipes · recipesEPSS 0.32%via CVEORG

CVE-2026-59962Medium· 6.5

2d ago

Tandoor Recipes: ORM ORDER BY Injection via FK Traversal in Tandoor Recipes

Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Prior to 2.6.10, passes unvalidated sort_order and order_field strings into Django ORM order_by() calls when an authenticated user suppl…

▾ SunlitTandoorRecipes · recipesEPSS 0.27%via CVEORG

CVE-2026-59967Medium· 5.4

2d ago

Tandoor Recipes: Cross-user IDOR in /api/recipe-from-source/ bookmarklet import — read and destroy another space member's pending BookmarkletImport

Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Prior to 2.6.10, looks up BookmarkletImport by sequential primary key within the active Space without restricting created_by to the requ…

▾ SunlitTandoorRecipes · recipesEPSS 0.22%via CVEORG

From the blog

All posts →

Sep 8, 2026

Sound the depths of every vulnerability.

Trending now

Feed

Tandoor Recipes: Private recipe file and share-link authorization bypass in recipe utility API endpoints

Tandoor Recipes: Private recipe authorization bypass via /api/step/ - read and modify another Space member's private recipe content

Tandoor Recipes: Blind SSRF via AI provider URL (api_base)

Tandoor Recipes: ReDoS (Regular Expression Denial of Service) via User-Controlled Automation Regex Patterns

Tandoor Recipes: ORM ORDER BY Injection via FK Traversal in Tandoor Recipes

Tandoor Recipes: Cross-user IDOR in /api/recipe-from-source/ bookmarklet import — read and destroy another space member's pending BookmarkletImport

From the blog

What's new: open corpus, three new MCP tools, vendor advisories, package pages

Wiring VulnSea into an agent: a hands-on tutorial

VulnSea is live

Sound the depths of every vulnerability.

Trending now

Feed

Tandoor Recipes: Private recipe file and share-link authorization bypass in recipe utility API endpoints

Tandoor Recipes: Private recipe authorization bypass via /api/step/ - read and modify another Space member's private recipe content

Tandoor Recipes: Blind SSRF via AI provider URL (api_base)

Tandoor Recipes: ReDoS (Regular Expression Denial of Service) via User-Controlled Automation Regex Patterns

Tandoor Recipes: ORM ORDER BY Injection via FK Traversal in Tandoor Recipes

Tandoor Recipes: Cross-user IDOR in /api/recipe-from-source/ bookmarklet import — read and destroy another space member's pending BookmarkletImport

From the blog

What's new: open corpus, three new MCP tools, vendor advisories, package pages

Wiring VulnSea into an agent: a hands-on tutorial

VulnSea is live