Live CVE & 0day intelligence

Sound the depths of every vulnerability.

Newly released CVEs across every platform — sleek to read, verbose on demand, and served raw as markdown for AI and agent ingestion. Severity reads as depth: the deeper the contact, the graver the threat.

Browse the feed For agents → /llms.txt

Depth = severity + exploitation

HadalCritical and actively exploited (CISA KEV / 0day)
AbyssalCritical with a public exploit or in-the-wild use
MidnightCritical, or high with PoC / in-the-wild
TwilightHigh severity, or a signal on a lesser flaw
SunlitLow / medium · no exploitation signal

30957

Tracked CVEs

3084

Critical

384

Exploited in wild

4116

Last 7 days

Trending now

Bluesky + Hacker News mentions, last 7 days

1CVE-2026-85046High· 8.8Type confusion in V8 in Google Chrome prior to 152.0.7977.82 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page874
2CVE-2026-58704High· 8.8In Cellular Modem, there is a possible permission bypass due to a logic error in the code373
3CVE-2026-69836Critical· 10.0Microsoft Entra ID Remote Code Execution Vulnerability267
4CVE-2026-66747Critical· 9.8Zbtlink router firmware ships an embedded remote-control implant, ENDLESSDOORS, present in every published build across the product line266
5CVE-2026-18963Critical· 9.1A flaw was found in the reset-credentials flow of the keycloak-services component, which is the core engine for identity and access management in Red Hat Build of Keycloak263

This week's digest →All digests

Feed

10 matches

CVE-2026-19515High· 7.0

1w ago

The WSO2 Integrator MI VS Code extension fails to properly sanitize or validate user-supplied input when processing Micro Integrator projects opened from untrusted sources

The WSO2 Integrator MI VS Code extension fails to properly sanitize or validate user-supplied input when processing Micro Integrator projects opened from untrusted sources. This allows a crafted project to inject and execute arbitrary op…

▾ TwilightWSO2 · WSO2 Integrator: MI for Visual Studio CodeEPSS 0.14%via NVD

CVE-2025-5802Medium· 5.3

1w ago

The self-registration flow accepts user-supplied input for usernames without adequately preventing the disclosure of username existence

The self-registration flow accepts user-supplied input for usernames without adequately preventing the disclosure of username existence. When a user attempts to register with an existing username, the system responds with an error messag…

▾ SunlitWSO2 · WSO2 API ManagerEPSS 0.25%via NVD

CVE-2025-13166Low· 3.7

1w ago

The SMS OTP flow fails to adequately handle error messages, allowing an attacker to infer the existence of registered user accounts based on the responses received during the OTP initiation process. This weakness can be exploited by an …

The SMS OTP flow fails to adequately handle error messages, allowing an attacker to infer the existence of registered user accounts based on the responses received during the OTP initiation process. This weakness can be exploited by an …

▾ SunlitWSO2 · WSO2 Identity ServerEPSS 0.22%via NVD

CVE-2026-4103Medium· 6.4

1w ago

Insufficient HTML sanitization in the Publisher Portal and Developer Portal allows untrusted user input to be rendered without proper encoding or neutralization

Insufficient HTML sanitization in the Publisher Portal and Developer Portal allows untrusted user input to be rendered without proper encoding or neutralization. This enables the injection and execution of malicious JavaScript when affec…

▾ SunlitWSO2 · WSO2 API Control PlaneEPSS 0.18%via NVD

CVE-2026-3096Medium· 4.7

1w ago

The product's web portals allow external links to be opened in a new browser tab

The product's web portals allow external links to be opened in a new browser tab. In certain configurations, the originating window retains access to the newly opened page, allowing interaction between the two browser contexts when navig…

▾ SunlitWSO2 · WSO2 API Control PlaneEPSS 0.21%via NVD

CVE-2026-3416Medium· 5.9

2w ago

The API Publisher component previously used a non-cryptographic pseudorandom number generator (PRNG) to create shared secrets for Webhook HMAC validation

The API Publisher component previously used a non-cryptographic pseudorandom number generator (PRNG) to create shared secrets for Webhook HMAC validation. This PRNG lacks sufficient entropy for security-sensitive operations, allowing a s…

▾ Sunlitwso2 · api_control_planeEPSS 0.26%via NVD

CVE-2025-12737High· 8.4

2w ago

The administrative operations within the Carbon Console do not adequately validate specific user-supplied input

The administrative operations within the Carbon Console do not adequately validate specific user-supplied input. This oversight allows a malicious actor with administrative privileges to inject and execute arbitrary code remotely. Succe…

▾ Twilightwso2 · api_control_planeEPSS 0.22%via NVD

CVE-2024-6832Medium· 5.9

1mo ago

The account locking mechanism fails to trigger when secondary user stores are inaccessible

The account locking mechanism fails to trigger when secondary user stores are inaccessible. The software does not maintain a consistent state for account locking if it cannot reach all configured user stores, allowing an attacker to repe…

▾ Sunlitwso2 · api_control_planeEPSS 0.24%via NVD

CVE-2024-10302Medium· 4.0

1mo ago

The user self-signup flow in multiple WSO2 products fails to adequately validate user-supplied input

The user self-signup flow in multiple WSO2 products fails to adequately validate user-supplied input. This weakness allows arbitrary unvalidated data to be included within user claims, which are then used by downstream processes. Allowi…

▾ Sunlitwso2 · api_control_planeEPSS 0.17%via NVD

CVE-2025-12107High· 8.4

7mo ago

The Velocity template engine, utilized by the affected product, accepts and processes template syntax without sufficient sanitization or validation of user-controlled input

The Velocity template engine, utilized by the affected product, accepts and processes template syntax without sufficient sanitization or validation of user-controlled input. This allows an authenticated administrator to inject arbitrary …

▾ Twilightwso2 · identity_serverEPSS 0.65%via NVD

From the blog

All posts →

Sep 8, 2026

Sound the depths of every vulnerability.

Trending now

Feed

The WSO2 Integrator MI VS Code extension fails to properly sanitize or validate user-supplied input when processing Micro Integrator projects opened from untrusted sources

The self-registration flow accepts user-supplied input for usernames without adequately preventing the disclosure of username existence

The SMS OTP flow fails to adequately handle error messages, allowing an attacker to infer the existence of registered user accounts based on the responses received during the OTP initiation process. This weakness can be exploited by an …

Insufficient HTML sanitization in the Publisher Portal and Developer Portal allows untrusted user input to be rendered without proper encoding or neutralization

The product's web portals allow external links to be opened in a new browser tab

The API Publisher component previously used a non-cryptographic pseudorandom number generator (PRNG) to create shared secrets for Webhook HMAC validation

The administrative operations within the Carbon Console do not adequately validate specific user-supplied input

The account locking mechanism fails to trigger when secondary user stores are inaccessible

The user self-signup flow in multiple WSO2 products fails to adequately validate user-supplied input

The Velocity template engine, utilized by the affected product, accepts and processes template syntax without sufficient sanitization or validation of user-controlled input

From the blog

What's new: open corpus, three new MCP tools, vendor advisories, package pages

Wiring VulnSea into an agent: a hands-on tutorial

VulnSea is live

Sound the depths of every vulnerability.

Trending now

Feed

The WSO2 Integrator MI VS Code extension fails to properly sanitize or validate user-supplied input when processing Micro Integrator projects opened from untrusted sources

The self-registration flow accepts user-supplied input for usernames without adequately preventing the disclosure of username existence

The SMS OTP flow fails to adequately handle error messages, allowing an attacker to infer the existence of registered user accounts based on the responses received during the OTP initiation process. This weakness can be exploited by an …

Insufficient HTML sanitization in the Publisher Portal and Developer Portal allows untrusted user input to be rendered without proper encoding or neutralization

The product's web portals allow external links to be opened in a new browser tab

The API Publisher component previously used a non-cryptographic pseudorandom number generator (PRNG) to create shared secrets for Webhook HMAC validation

The administrative operations within the Carbon Console do not adequately validate specific user-supplied input

The account locking mechanism fails to trigger when secondary user stores are inaccessible

The user self-signup flow in multiple WSO2 products fails to adequately validate user-supplied input

The Velocity template engine, utilized by the affected product, accepts and processes template syntax without sufficient sanitization or validation of user-controlled input

From the blog

What's new: open corpus, three new MCP tools, vendor advisories, package pages

Wiring VulnSea into an agent: a hands-on tutorial

VulnSea is live