Live CVE & 0day intelligence

Sound the depths of every vulnerability.

Newly released CVEs across every platform — sleek to read, verbose on demand, and served raw as markdown for AI and agent ingestion. Severity reads as depth: the deeper the contact, the graver the threat.

Browse the feed For agents → /llms.txt

Depth = severity + exploitation

HadalCritical and actively exploited (CISA KEV / 0day)
AbyssalCritical with a public exploit or in-the-wild use
MidnightCritical, or high with PoC / in-the-wild
TwilightHigh severity, or a signal on a lesser flaw
SunlitLow / medium · no exploitation signal

36130

Tracked CVEs

3551

Critical

437

Exploited in wild

5188

Last 7 days

Trending now

Bluesky + Hacker News mentions, last 7 days

1CVE-2026-88771Critical· 9.8Improper input validation vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway. This issue affects ADC: before 14.1-73.37, before 13.1-64.23, before 14.1-73.37 FIPS, and before 13.1.37.279 FIPS and NDcPP; Gateway: before 1…379
2CVE-2026-58704High· 8.8In Cellular Modem, there is a possible permission bypass due to a logic error in the code374
3CVE-2026-66747Critical· 9.8Zbtlink router firmware ships an embedded remote-control implant, ENDLESSDOORS, present in every published build across the product line266
4CVE-2026-18963Critical· 9.1A flaw was found in the reset-credentials flow of the keycloak-services component, which is the core engine for identity and access management in Red Hat Build of Keycloak263

This week's digest →All digests

Feed

10 matches

CVE-2026-71189Low· 3.5

today

An attacker can construct a request that, if issued by another application user, will cause JavaScript code supplied by the attacker to execute within the user's browser in the context of that user's session with the application.

An attacker can construct a request that, if issued by another application user, will cause JavaScript code supplied by the attacker to execute within the user's browser in the context of that user's session with the application.

▾ SunlitToptech Systems · TMS7via NVD

CVE-2026-69662Low· 3.7

today

The application uses unsafe functions that allow execution of inline scripts and string evaluation functions.

▾ SunlitToptech Systems · TMS7via NVD

CVE-2026-71379Critical· 10.0

today

The file export endpoint allows any unauthenticated attacker to export arbitrary database tables by sending a crafted POST request.

▾ MidnightToptech Systems · TMS7via NVD

CVE-2026-70356Critical· 9.1

today

The TMS file upload endpoint fails to enforce server-side file type restrictions, allowing an attacker to upload and execute arbitrary PHP files on the web server.

▾ MidnightToptech Systems · TMS7via NVD

CVE-2026-72510Critical· 9.0

today

The "supplier_no" parameter used in the business allocation search feature is vulnerable to time-based blind SQL injection.

▾ MidnightToptech Systems · TMS7via NVD

CVE-2026-63713Critical· 9.0

today

The "search" parameter in the view audit logs feature within the utilities section is susceptible to a time-based blind SQL injection vulnerability.

▾ MidnightToptech Systems · TMS7via NVD

CVE-2026-68954Critical· 9.0

today

The "pattern" parameter used in search function in the home page of the TMS application is vulnerable to time-based blind SQL injection vulnerability.

▾ MidnightToptech Systems · TMS7via NVD

CVE-2026-68068Critical· 9.0

today

The "screenID" parameter in the electronic transaction queue viewer feature within the manual transactions section is susceptible to a time-based blind SQL injection vulnerability.

▾ MidnightToptech Systems · TMS7via NVD

CVE-2026-72507Critical· 9.0

today

The "reportType" parameter in the product summary report feature within the balancing reports section is susceptible to a time-based blind SQL injection vulnerability.

▾ MidnightToptech Systems · TMS7via NVD

CVE-2026-71302High· 7.1

today

The application accepts user-supplied session identifiers and does not regenerate the session ID after authentication

The application accepts user-supplied session identifiers and does not regenerate the session ID after authentication. This allows an attacker to predefine a session ID and reuse it after victim authentication, resulting in session takeo…

▾ TwilightToptech Systems · TMS7via NVD

From the blog

All posts →

Sep 8, 2026

Sound the depths of every vulnerability.

Trending now

Feed

An attacker can construct a request that, if issued by another application user, will cause JavaScript code supplied by the attacker to execute within the user's browser in the context of that user's session with the application.

The application uses unsafe functions that allow execution of inline scripts and string evaluation functions.

The file export endpoint allows any unauthenticated attacker to export arbitrary database tables by sending a crafted POST request.

The TMS file upload endpoint fails to enforce server-side file type restrictions, allowing an attacker to upload and execute arbitrary PHP files on the web server.

The "supplier_no" parameter used in the business allocation search feature is vulnerable to time-based blind SQL injection.

The "search" parameter in the view audit logs feature within the utilities section is susceptible to a time-based blind SQL injection vulnerability.

The "pattern" parameter used in search function in the home page of the TMS application is vulnerable to time-based blind SQL injection vulnerability.

The "screenID" parameter in the electronic transaction queue viewer feature within the manual transactions section is susceptible to a time-based blind SQL injection vulnerability.

The "reportType" parameter in the product summary report feature within the balancing reports section is susceptible to a time-based blind SQL injection vulnerability.

The application accepts user-supplied session identifiers and does not regenerate the session ID after authentication

From the blog

What's new: open corpus, three new MCP tools, vendor advisories, package pages

Wiring VulnSea into an agent: a hands-on tutorial

VulnSea is live

Sound the depths of every vulnerability.

Trending now

Feed

An attacker can construct a request that, if issued by another application user, will cause JavaScript code supplied by the attacker to execute within the user's browser in the context of that user's session with the application.

The application uses unsafe functions that allow execution of inline scripts and string evaluation functions.

The file export endpoint allows any unauthenticated attacker to export arbitrary database tables by sending a crafted POST request.

The TMS file upload endpoint fails to enforce server-side file type restrictions, allowing an attacker to upload and execute arbitrary PHP files on the web server.

The "supplier_no" parameter used in the business allocation search feature is vulnerable to time-based blind SQL injection.

The "search" parameter in the view audit logs feature within the utilities section is susceptible to a time-based blind SQL injection vulnerability.

The "pattern" parameter used in search function in the home page of the TMS application is vulnerable to time-based blind SQL injection vulnerability.

The "screenID" parameter in the electronic transaction queue viewer feature within the manual transactions section is susceptible to a time-based blind SQL injection vulnerability.

The "reportType" parameter in the product summary report feature within the balancing reports section is susceptible to a time-based blind SQL injection vulnerability.

The application accepts user-supplied session identifiers and does not regenerate the session ID after authentication

From the blog

What's new: open corpus, three new MCP tools, vendor advisories, package pages

Wiring VulnSea into an agent: a hands-on tutorial

VulnSea is live