Live CVE & 0day intelligence

Sound the depths of every vulnerability.

Newly released CVEs across every platform — sleek to read, verbose on demand, and served raw as markdown for AI and agent ingestion. Severity reads as depth: the deeper the contact, the graver the threat.

Browse the feed For agents → /llms.txt

Depth = severity + exploitation

HadalCritical and actively exploited (CISA KEV / 0day)
AbyssalCritical with a public exploit or in-the-wild use
MidnightCritical, or high with PoC / in-the-wild
TwilightHigh severity, or a signal on a lesser flaw
SunlitLow / medium · no exploitation signal

42215

Tracked CVEs

4234

Critical

486

Exploited in wild

5706

Last 7 days

Trending now

Bluesky + Hacker News mentions, last 7 days

1CVE-2026-88771Critical· 9.8Improper input validation vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway. This issue affects ADC: before 14.1-73.37, before 13.1-64.23, before 14.1-73.37 FIPS, and before 13.1.37.279 FIPS and NDcPP; Gateway: before 1…379

This week's digest →All digests

Feed

22 matches

CVE-2026-102150High· 7.2

1w ago

A function in the Kiteworks Advanced Forms component was reachable without authentication

A function in the Kiteworks Advanced Forms component was reachable without authentication. An unauthenticated attacker could potentially use it to carry out a limited set of internal service operations on the Kiteworks platform; it did n…

▾ Twilightaccellion · kiteworksEPSS 0.25%via NVD

CVE-2026-102134Medium· 5.4

1w ago

Kiteworks Core did not apply its gateway-level API security controls to every request authenticated through the platform's central authentication service

Kiteworks Core did not apply its gateway-level API security controls to every request authenticated through the platform's central authentication service. An authenticated user could reach REST API functionality over a request path on wh…

▾ Sunlitaccellion · kiteworksEPSS 0.21%via NVD

CVE-2026-102132High· 7.2

1w ago

An administrative import function in Kiteworks Core did not verify that the requesting administrator was entitled to create the privileged integration credential being imported

An administrative import function in Kiteworks Core did not verify that the requesting administrator was entitled to create the privileged integration credential being imported. A delegated administrator holding a single narrowly scoped …

▾ Twilightaccellion · kiteworksEPSS 0.34%via NVD

CVE-2026-102126High· 8.1

1w ago

A stored cross-site scripting (XSS) weakness in Kiteworks Core could allow an administrator holding only a single, narrowly scoped delegated permission to store crafted content that later executes arbitrary JavaScript in the authenticate…

A stored cross-site scripting (XSS) weakness in Kiteworks Core could allow an administrator holding only a single, narrowly scoped delegated permission to store crafted content that later executes arbitrary JavaScript in the authenticate…

▾ Twilightaccellion · kiteworksEPSS 0.21%via NVD

CVE-2026-102123High· 7.4

1w ago

A Kiteworks appliance setup interface did not confine a user-supplied file path to its intended directory, which could allow an unauthenticated attacker to write a file to any location writable by the affected service account, potentiall…

A Kiteworks appliance setup interface did not confine a user-supplied file path to its intended directory, which could allow an unauthenticated attacker to write a file to any location writable by the affected service account, potentiall…

▾ Twilightaccellion · kiteworksEPSS 0.32%via NVD

CVE-2026-102122Medium· 4.3

1w ago

Kiteworks did not correctly enforce which roles a shared folder's manager was permitted to assign

Kiteworks did not correctly enforce which roles a shared folder's manager was permitted to assign. In a default configuration, an authenticated user holding the Manager role on a folder could grant the Owner role to themselves or to othe…

▾ Sunlitaccellion · kiteworksEPSS 0.16%via NVD

CVE-2026-102120High· 8.8

1w ago

A privilege escalation vulnerability in Kiteworks could have allowed an attacker who had already obtained code execution on one node of a clustered Kiteworks deployment to run operating system commands with elevated privileges on another…

A privilege escalation vulnerability in Kiteworks could have allowed an attacker who had already obtained code execution on one node of a clustered Kiteworks deployment to run operating system commands with elevated privileges on another…

▾ Twilightaccellion · kiteworksEPSS 0.14%via NVD

CVE-2026-102118High· 7.8

1w ago

A local privilege escalation vulnerability in Kiteworks could have allowed an attacker with an existing shell under a low-privileged service account to escalate to root privileges on the appliance.

▾ Twilightaccellion · kiteworksEPSS 0.13%via NVD

CVE-2026-102115Critical· 9.8

1w ago

Kiteworks Core did not correctly validate a parameter submitted to the password reset workflow

Kiteworks Core did not correctly validate a parameter submitted to the password reset workflow. An unauthenticated attacker who knew the email address of a user with a locally stored password could potentially reset that account's passwo…

▾ Midnightaccellion · kiteworksEPSS 0.33%via NVD

CVE-2026-102114High· 7.2

1w ago

A command injection vulnerability in Kiteworks could allow a high-privileged authenticated administrator to execute arbitrary operating-system commands as root on the affected appliance node

A command injection vulnerability in Kiteworks could allow a high-privileged authenticated administrator to execute arbitrary operating-system commands as root on the affected appliance node. Successful exploitation requires an administr…

▾ Twilightaccellion · kiteworksEPSS 1.0%via NVD

CVE-2026-102113High· 7.8

1w ago

A privilege escalation vulnerability in Kiteworks could allow an attacker who has already obtained code execution as an unprivileged backend service account on the appliance to escalate to root

A privilege escalation vulnerability in Kiteworks could allow an attacker who has already obtained code execution as an unprivileged backend service account on the appliance to escalate to root. A privileged routine did not safely handle…

▾ Twilightaccellion · kiteworksEPSS 0.13%via NVD

CVE-2026-102112High· 7.8

1w ago

A privilege escalation vulnerability in Kiteworks could allow an attacker who has already obtained code execution as an unprivileged backend service account on the appliance to escalate to root and run arbitrary commands with the highest…

▾ Twilightaccellion · kiteworksEPSS 0.12%via NVD

CVE-2026-102111Medium· 4.9

1w ago

Kiteworks did not enforce the maximum permitted value for a configurable security-policy setting

Kiteworks did not enforce the maximum permitted value for a configurable security-policy setting. An authenticated administrator could set this value outside its intended range so that the associated control never activated, while the co…

▾ Sunlitaccellion · kiteworksEPSS 0.21%via NVD

CVE-2026-102107Medium· 4.6

1w ago

Kiteworks Core contains a business logic flaw in a Kiteworks file-request feature allowed an authenticated user to send a request that appeared to originate from another user, because the server did not verify that the requester was auth…

Kiteworks Core contains a business logic flaw in a Kiteworks file-request feature allowed an authenticated user to send a request that appeared to originate from another user, because the server did not verify that the requester was auth…

▾ Sunlitaccellion · kiteworksEPSS 0.16%via NVD

CVE-2026-102101High· 8.1

1w ago

Kiteworks Core before version 9.5.0 is vulnerable to Deserialization of Untrusted Data

Kiteworks Core before version 9.5.0 is vulnerable to Deserialization of Untrusted Data. A deserialization weakness in Kiteworks Core could, under certain conditions, allow crafted data to be deserialized unsafely, potentially resulting i…

▾ Twilightaccellion · kiteworksEPSS 0.31%via NVD

CVE-2026-102100High· 8.7

1w ago

Kiteworks Core before version 9.5.0 is vulnerable to Stored Cross-Site Scripting

Kiteworks Core before version 9.5.0 is vulnerable to Stored Cross-Site Scripting. A stored cross-site scripting (XSS) weakness in Kiteworks Core could allow an authenticated user to submit content that, when later viewed by another user,…

▾ Twilightaccellion · kiteworksEPSS 0.22%via NVD

CVE-2026-102099High· 7.2

1w ago

Kiteworks Core before version 9.5.0 is vulnerable to Arbitrary File Write

Kiteworks Core before version 9.5.0 is vulnerable to Arbitrary File Write. An improper restriction of a user-supplied file path in a Kiteworks administrative export feature could allow an authenticated administrator to write a file to an…

▾ Twilightaccellion · kiteworksEPSS 0.64%via NVD

CVE-2026-102098High· 7.2

1w ago

Kiteworks Core before version 9.5.0 is vulnerable to SQL Injection

Kiteworks Core before version 9.5.0 is vulnerable to SQL Injection. A stored SQL injection vulnerability in a Kiteworks administrative reporting feature could allow an authenticated administrator to read sensitive data from the underlyin…

▾ Twilightaccellion · kiteworksEPSS 0.33%via NVD

CVE-2026-102096High· 7.2

1w ago

Kiteworks Core before version 9.5.0 is vulnerable to OS Command Injection that allows an authenticated administrator to upload a configuration package whose contents were not sufficiently validated before being processed

Kiteworks Core before version 9.5.0 is vulnerable to OS Command Injection that allows an authenticated administrator to upload a configuration package whose contents were not sufficiently validated before being processed. A crafted packa…

▾ Twilightaccellion · kiteworksEPSS 1.1%via NVD

CVE-2026-102093High· 7.2

1w ago

Kiteworks Core before version 9.5.0 is vulnerable to Improper Privilege Management and does not correctly enforce restrictions on role assignment, which could allow an authenticated administrative user with limited, non-Sysadmin role-man…

Kiteworks Core before version 9.5.0 is vulnerable to Improper Privilege Management and does not correctly enforce restrictions on role assignment, which could allow an authenticated administrative user with limited, non-Sysadmin role-man…

▾ Twilightaccellion · kiteworksEPSS 0.34%via NVD

CVE-2026-102092High· 8.7

1w ago

Kiteworks Core before version 9.5.0 is vulnerable to Stored Cross-site Scripting (XSS) that could allow an authenticated user to store crafted content that executes arbitrary JavaScript in another user's authenticated session when they p…

Kiteworks Core before version 9.5.0 is vulnerable to Stored Cross-site Scripting (XSS) that could allow an authenticated user to store crafted content that executes arbitrary JavaScript in another user's authenticated session when they p…

▾ Twilightaccellion · kiteworksEPSS 0.21%via NVD

CVE-2026-102090Medium· 4.3

1w ago

Kiteworks Core before version 9.5.1 is vulnerable to Content Injection

Kiteworks Core before version 9.5.1 is vulnerable to Content Injection. A URL parameter in the PDF viewer was insufficiently validated, allowing an attacker-controlled document to be loaded and displayed under the trust of the legitimate…

▾ Sunlitaccellion · kiteworksEPSS 0.20%via NVD

From the blog

All posts →

Sep 8, 2026

Sound the depths of every vulnerability.

Trending now

Feed

A function in the Kiteworks Advanced Forms component was reachable without authentication

Kiteworks Core did not apply its gateway-level API security controls to every request authenticated through the platform's central authentication service

An administrative import function in Kiteworks Core did not verify that the requesting administrator was entitled to create the privileged integration credential being imported

A stored cross-site scripting (XSS) weakness in Kiteworks Core could allow an administrator holding only a single, narrowly scoped delegated permission to store crafted content that later executes arbitrary JavaScript in the authenticate…

A Kiteworks appliance setup interface did not confine a user-supplied file path to its intended directory, which could allow an unauthenticated attacker to write a file to any location writable by the affected service account, potentiall…

Kiteworks did not correctly enforce which roles a shared folder's manager was permitted to assign

A privilege escalation vulnerability in Kiteworks could have allowed an attacker who had already obtained code execution on one node of a clustered Kiteworks deployment to run operating system commands with elevated privileges on another…

A local privilege escalation vulnerability in Kiteworks could have allowed an attacker with an existing shell under a low-privileged service account to escalate to root privileges on the appliance.

Kiteworks Core did not correctly validate a parameter submitted to the password reset workflow

A command injection vulnerability in Kiteworks could allow a high-privileged authenticated administrator to execute arbitrary operating-system commands as root on the affected appliance node

A privilege escalation vulnerability in Kiteworks could allow an attacker who has already obtained code execution as an unprivileged backend service account on the appliance to escalate to root

A privilege escalation vulnerability in Kiteworks could allow an attacker who has already obtained code execution as an unprivileged backend service account on the appliance to escalate to root and run arbitrary commands with the highest…

Kiteworks did not enforce the maximum permitted value for a configurable security-policy setting

Kiteworks Core contains a business logic flaw in a Kiteworks file-request feature allowed an authenticated user to send a request that appeared to originate from another user, because the server did not verify that the requester was auth…

Kiteworks Core before version 9.5.0 is vulnerable to Deserialization of Untrusted Data

Kiteworks Core before version 9.5.0 is vulnerable to Stored Cross-Site Scripting

Kiteworks Core before version 9.5.0 is vulnerable to Arbitrary File Write

Kiteworks Core before version 9.5.0 is vulnerable to SQL Injection

Kiteworks Core before version 9.5.0 is vulnerable to OS Command Injection that allows an authenticated administrator to upload a configuration package whose contents were not sufficiently validated before being processed

Kiteworks Core before version 9.5.0 is vulnerable to Improper Privilege Management and does not correctly enforce restrictions on role assignment, which could allow an authenticated administrative user with limited, non-Sysadmin role-man…

Kiteworks Core before version 9.5.0 is vulnerable to Stored Cross-site Scripting (XSS) that could allow an authenticated user to store crafted content that executes arbitrary JavaScript in another user's authenticated session when they p…

Kiteworks Core before version 9.5.1 is vulnerable to Content Injection

From the blog

What's new: open corpus, three new MCP tools, vendor advisories, package pages

Wiring VulnSea into an agent: a hands-on tutorial

VulnSea is live

Sound the depths of every vulnerability.

Trending now

Feed

A function in the Kiteworks Advanced Forms component was reachable without authentication

Kiteworks Core did not apply its gateway-level API security controls to every request authenticated through the platform's central authentication service

An administrative import function in Kiteworks Core did not verify that the requesting administrator was entitled to create the privileged integration credential being imported

A stored cross-site scripting (XSS) weakness in Kiteworks Core could allow an administrator holding only a single, narrowly scoped delegated permission to store crafted content that later executes arbitrary JavaScript in the authenticate…

A Kiteworks appliance setup interface did not confine a user-supplied file path to its intended directory, which could allow an unauthenticated attacker to write a file to any location writable by the affected service account, potentiall…

Kiteworks did not correctly enforce which roles a shared folder's manager was permitted to assign

A privilege escalation vulnerability in Kiteworks could have allowed an attacker who had already obtained code execution on one node of a clustered Kiteworks deployment to run operating system commands with elevated privileges on another…

A local privilege escalation vulnerability in Kiteworks could have allowed an attacker with an existing shell under a low-privileged service account to escalate to root privileges on the appliance.

Kiteworks Core did not correctly validate a parameter submitted to the password reset workflow

A command injection vulnerability in Kiteworks could allow a high-privileged authenticated administrator to execute arbitrary operating-system commands as root on the affected appliance node

A privilege escalation vulnerability in Kiteworks could allow an attacker who has already obtained code execution as an unprivileged backend service account on the appliance to escalate to root

A privilege escalation vulnerability in Kiteworks could allow an attacker who has already obtained code execution as an unprivileged backend service account on the appliance to escalate to root and run arbitrary commands with the highest…

Kiteworks did not enforce the maximum permitted value for a configurable security-policy setting

Kiteworks Core contains a business logic flaw in a Kiteworks file-request feature allowed an authenticated user to send a request that appeared to originate from another user, because the server did not verify that the requester was auth…

Kiteworks Core before version 9.5.0 is vulnerable to Deserialization of Untrusted Data

Kiteworks Core before version 9.5.0 is vulnerable to Stored Cross-Site Scripting

Kiteworks Core before version 9.5.0 is vulnerable to Arbitrary File Write

Kiteworks Core before version 9.5.0 is vulnerable to SQL Injection

Kiteworks Core before version 9.5.0 is vulnerable to OS Command Injection that allows an authenticated administrator to upload a configuration package whose contents were not sufficiently validated before being processed

Kiteworks Core before version 9.5.0 is vulnerable to Improper Privilege Management and does not correctly enforce restrictions on role assignment, which could allow an authenticated administrative user with limited, non-Sysadmin role-man…

Kiteworks Core before version 9.5.0 is vulnerable to Stored Cross-site Scripting (XSS) that could allow an authenticated user to store crafted content that executes arbitrary JavaScript in another user's authenticated session when they p…

Kiteworks Core before version 9.5.1 is vulnerable to Content Injection

From the blog

What's new: open corpus, three new MCP tools, vendor advisories, package pages

Wiring VulnSea into an agent: a hands-on tutorial

VulnSea is live