Live CVE & 0day intelligence

Sound the depths of every vulnerability.

Newly released CVEs across every platform — sleek to read, verbose on demand, and served raw as markdown for AI and agent ingestion. Severity reads as depth: the deeper the contact, the graver the threat.

Browse the feed For agents → /llms.txt

Depth = severity + exploitation

HadalCritical and actively exploited (CISA KEV / 0day)
AbyssalCritical with a public exploit or in-the-wild use
MidnightCritical, or high with PoC / in-the-wild
TwilightHigh severity, or a signal on a lesser flaw
SunlitLow / medium · no exploitation signal

55308

Tracked CVEs

5285

Critical

544

Exploited in wild

11500

Last 7 days

Trending now

Bluesky + Hacker News mentions, last 7 days

1CVE-2026-88771Critical· 9.8Improper input validation vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway. This issue affects ADC: before 14.1-73.37, before 13.1-64.23, before 14.1-73.37 FIPS, and before 13.1.37.279 FIPS and NDcPP; Gateway: before 1…479

This week's digest →All digests

Feed

24 matches

CVE-2026-81797Critical· 9.8

5d ago

Unauthenticated PHP Object Injection in Buzz Stone | Magazine & Viral Blog WordPress Theme <= 1.0.2 versions.

▾ MidnightThemeRex · Buzz Stone | Magazine & Viral Blog WordPress ThemeEPSS 0.32%via NVD

CVE-2026-78535Critical· 9.8

5d ago

Unauthenticated PHP Object Injection in N7 | Golf Club Sports & Events <= 2.21 versions.

▾ MidnightThemeREX · N7 | Golf Club Sports & EventsEPSS 0.31%via NVD

CVE-2026-62123Critical· 9.8

5d ago

Unauthenticated PHP Object Injection in Invetex <= 2.18 versions.

▾ MidnightThemeREX · InvetexEPSS 0.31%via NVD

CVE-2026-62120Critical· 9.8

5d ago

Unauthenticated PHP Object Injection in Law Office <= 3.20 versions.

▾ MidnightThemeREX · Law OfficeEPSS 0.31%via NVD

CVE-2026-62090Critical· 9.8

5d ago

Unauthenticated PHP Object Injection in WineShop <= 3.20 versions.

▾ MidnightThemeREX · WineShopEPSS 0.39%via NVD

CVE-2026-62087Critical· 9.8

5d ago

Unauthenticated PHP Object Injection in Equadio <= 1.1.4 versions.

▾ MidnightThemeREX · EquadioEPSS 0.39%via NVD

CVE-2026-62086Critical· 9.8

5d ago

Unauthenticated PHP Object Injection in Juno <= 2.25 versions.

▾ MidnightThemeREX · JunoEPSS 0.39%via NVD

CVE-2026-62074High· 8.1

5d ago

Unauthenticated Local File Inclusion in Ozeum <= 1.3.0 versions.

▾ TwilightThemeREX · OzeumEPSS 0.35%via NVD

CVE-2026-62054Critical· 9.8

5d ago

Unauthenticated PHP Object Injection in Yacht Rental <= 2.6 versions.

▾ MidnightThemeREX · Yacht RentalEPSS 0.39%via NVD

CVE-2026-62053Critical· 9.8

5d ago

Unauthenticated PHP Object Injection in Wine House <= 3.20 versions.

▾ MidnightThemeREX · Wine HouseEPSS 0.39%via NVD

CVE-2026-62052Critical· 9.8

5d ago

Unauthenticated PHP Object Injection in Tipsy <= 1.6 versions.

▾ MidnightThemeREX · TipsyEPSS 0.39%via NVD

CVE-2026-62051Critical· 9.8

5d ago

Unauthenticated PHP Object Injection in Stargaze <= 1.10 versions.

▾ MidnightThemeREX · StargazeEPSS 0.39%via NVD

CVE-2026-62050Critical· 9.8

5d ago

Unauthenticated PHP Object Injection in Splendour <= 1.23 versions.

▾ MidnightThemeREX · SplendourEPSS 0.39%via NVD

CVE-2026-94063High· 7.1

6d ago

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeREX Education Center education allows Reflected XSS.This issue affects Education Center: from n/a through 3.6.12.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeREX Education Center education allows Reflected XSS.This issue affects Education Center: from n/a through 3.6.12.

▾ TwilightThemeREX · educationEPSS 0.15%via NVD

CVE-2026-97235High· 7.1

2w ago

Unauthenticated Cross Site Scripting (XSS) in ThemeREX Addons < 2.45.0 versions.

▾ TwilightThemeRex · ThemeREX AddonsEPSS 0.18%via NVD

CVE-2026-97236Medium· 6.5

2w ago

Subscriber Cross Site Scripting (XSS) in ThemeREX Addons < 2.45.0 versions.

▾ SunlitThemeRex · ThemeREX AddonsEPSS 0.21%via NVD

CVE-2026-62105Critical· 9.8

1mo ago

Unauthenticated PHP Object Injection in ThemeREX Addons < 2.45.0 versions.

▾ MidnightThemeRex · ThemeREX AddonsEPSS 0.56%via NVD

From the blog

All posts →

Sep 8, 2026

What's new: open corpus, three new MCP tools, vendor advisories, package pages

A summary of everything that shipped over the last two weeks — the whole corpus is open, agents get change feeds, alias resolution and EPSS movers, and the data now includes CVE.org, vendor CSAF, aggregated exploits and per-source scores.

Jul 1, 2026

Wiring VulnSea into an agent: a hands-on tutorial

A step-by-step guide to plugging VulnSea into automated and agentic workflows — poll the delta, triage without burning tokens, match an SBOM, and let an MCP-native model do the reasoning.

Jun 29, 2026

VulnSea is live

CVE and 0day intelligence that reads like an instrument — built for analysts and AI agents alike. Here's what it does and where it's going.

Sound the depths of every vulnerability.

Trending now

Feed

Unauthenticated PHP Object Injection in Buzz Stone | Magazine & Viral Blog WordPress Theme <= 1.0.2 versions.

Unauthenticated PHP Object Injection in Photolia <= 1.0.3 versions.

Unauthenticated PHP Object Injection in Jacqueline <= 2.22 versions.

Unauthenticated PHP Object Injection in Alliance <= 3.11 versions.

Unauthenticated PHP Object Injection in ShiftCV <= 3.0.14 versions.

Unauthenticated PHP Object Injection in Windsor <= 2.10 versions.

Unauthenticated PHP Object Injection in Education Center <= 3.6.12 versions.

Unauthenticated PHP Object Injection in Asia Garden <= 1.3.1 versions.

Unauthenticated PHP Object Injection in N7 | Golf Club Sports & Events <= 2.21 versions.

Unauthenticated PHP Object Injection in Invetex <= 2.18 versions.

Unauthenticated PHP Object Injection in Law Office <= 3.20 versions.

Unauthenticated PHP Object Injection in WineShop <= 3.20 versions.

Unauthenticated PHP Object Injection in Equadio <= 1.1.4 versions.

Unauthenticated PHP Object Injection in Juno <= 2.25 versions.

Unauthenticated Local File Inclusion in Ozeum <= 1.3.0 versions.

Unauthenticated PHP Object Injection in Yacht Rental <= 2.6 versions.

Unauthenticated PHP Object Injection in Wine House <= 3.20 versions.

Unauthenticated PHP Object Injection in Tipsy <= 1.6 versions.

Unauthenticated PHP Object Injection in Stargaze <= 1.10 versions.

Unauthenticated PHP Object Injection in Splendour <= 1.23 versions.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeREX Education Center education allows Reflected XSS.This issue affects Education Center: from n/a through 3.6.12.

Unauthenticated Cross Site Scripting (XSS) in ThemeREX Addons < 2.45.0 versions.

Subscriber Cross Site Scripting (XSS) in ThemeREX Addons < 2.45.0 versions.

Unauthenticated PHP Object Injection in ThemeREX Addons < 2.45.0 versions.

From the blog

What's new: open corpus, three new MCP tools, vendor advisories, package pages

Wiring VulnSea into an agent: a hands-on tutorial

VulnSea is live

Sound the depths of every vulnerability.

Trending now

Feed

Unauthenticated PHP Object Injection in Buzz Stone | Magazine & Viral Blog WordPress Theme <= 1.0.2 versions.

Unauthenticated PHP Object Injection in Photolia <= 1.0.3 versions.

Unauthenticated PHP Object Injection in Jacqueline <= 2.22 versions.

Unauthenticated PHP Object Injection in Alliance <= 3.11 versions.

Unauthenticated PHP Object Injection in ShiftCV <= 3.0.14 versions.

Unauthenticated PHP Object Injection in Windsor <= 2.10 versions.

Unauthenticated PHP Object Injection in Education Center <= 3.6.12 versions.

Unauthenticated PHP Object Injection in Asia Garden <= 1.3.1 versions.

Unauthenticated PHP Object Injection in N7 | Golf Club Sports & Events <= 2.21 versions.

Unauthenticated PHP Object Injection in Invetex <= 2.18 versions.

Unauthenticated PHP Object Injection in Law Office <= 3.20 versions.

Unauthenticated PHP Object Injection in WineShop <= 3.20 versions.

Unauthenticated PHP Object Injection in Equadio <= 1.1.4 versions.

Unauthenticated PHP Object Injection in Juno <= 2.25 versions.

Unauthenticated Local File Inclusion in Ozeum <= 1.3.0 versions.

Unauthenticated PHP Object Injection in Yacht Rental <= 2.6 versions.

Unauthenticated PHP Object Injection in Wine House <= 3.20 versions.

Unauthenticated PHP Object Injection in Tipsy <= 1.6 versions.

Unauthenticated PHP Object Injection in Stargaze <= 1.10 versions.

Unauthenticated PHP Object Injection in Splendour <= 1.23 versions.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeREX Education Center education allows Reflected XSS.This issue affects Education Center: from n/a through 3.6.12.

Unauthenticated Cross Site Scripting (XSS) in ThemeREX Addons < 2.45.0 versions.

Subscriber Cross Site Scripting (XSS) in ThemeREX Addons < 2.45.0 versions.

Unauthenticated PHP Object Injection in ThemeREX Addons < 2.45.0 versions.

From the blog

What's new: open corpus, three new MCP tools, vendor advisories, package pages

Wiring VulnSea into an agent: a hands-on tutorial

VulnSea is live