Live CVE & 0day intelligence

Sound the depths of every vulnerability.

Newly released CVEs across every platform — sleek to read, verbose on demand, and served raw as markdown for AI and agent ingestion. Severity reads as depth: the deeper the contact, the graver the threat.

Browse the feed For agents → /llms.txt

Depth = severity + exploitation

HadalCritical and actively exploited (CISA KEV / 0day)
AbyssalCritical with a public exploit or in-the-wild use
MidnightCritical, or high with PoC / in-the-wild
TwilightHigh severity, or a signal on a lesser flaw
SunlitLow / medium · no exploitation signal

30464

Tracked CVEs

2987

Critical

380

Exploited in wild

4938

Last 7 days

Trending now

Bluesky + Hacker News mentions, last 7 days

1CVE-2026-85046High· 8.8Type confusion in V8 in Google Chrome prior to 152.0.7977.82 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page874
2CVE-2026-58704High· 8.8In Cellular Modem, there is a possible permission bypass due to a logic error in the code373
3CVE-2026-69836Critical· 10.0Microsoft Entra ID Remote Code Execution Vulnerability267
4CVE-2026-66747Critical· 9.8Zbtlink router firmware ships an embedded remote-control implant, ENDLESSDOORS, present in every published build across the product line266
5CVE-2026-18963Critical· 9.1A flaw was found in the reset-credentials flow of the keycloak-services component, which is the core engine for identity and access management in Red Hat Build of Keycloak263

This week's digest →All digests

Feed

41 matches

CVE-2026-59881Medium

1mo ago

AIOHTTP: WebSocket client accepts compressed frames without negotiated permessage-deflate

▾ Sunlitaiohttp · aiohttpEPSS 0.30%via OSV

CVE-2026-54276Medium· 6.1

3mo ago

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.1, DigestAuthMiddleware can send an authentication response after following a cross-origin redirect. This likely requires an open redirect vuln…

▾ Sunlitaiohttp · aiohttpEPSS 0.31%via NVD

CVE-2026-54280High· 7.5

3mo ago

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.1, payload resources are not closed correctly when a client disconnects in the middle of a write. If a payload is using an open file or similar…

▾ Twilightaiohttp · aiohttpEPSS 0.28%via NVD

CVE-2026-50269Low

3mo ago

aiohttp allows unlimited trailer headers, leading to possible uncapped memory usage

▾ Sunlitaiohttp · aiohttpEPSS 0.44%via OSV

CVE-2026-34515Medium

5mo ago

AIOHTTP affected by UNC SSRF/NTLMv2 Credential Theft/Local File Read in static resource handler on Windows

▾ Sunlitaiohttp · aiohttpEPSS 0.43%via OSV

CVE-2026-34519Low

5mo ago

AIOHTTP has HTTP response splitting via \r in reason phrase

▾ Sunlitaiohttp · aiohttpEPSS 0.29%via OSV

CVE-2026-34516High· 7.5

5mo ago

AIOHTTP has a Multipart Header Size Bypass

▾ Twilightaiohttp · aiohttpEPSS 0.44%via OSV

CVE-2026-34513Low

5mo ago

AIOHTTP Affected by Denial of Service (DoS) via Unbounded DNS Cache in TCPConnector

▾ Sunlitaiohttp · aiohttpEPSS 0.44%via OSV

CVE-2026-34525Medium

5mo ago

AIOHTTP accepts duplicate Host headers

▾ Sunlitaiohttp · aiohttpEPSS 0.29%via OSV

CVE-2026-34518Medium· 5.3

5mo ago

AIOHTTP leaks Cookie and Proxy-Authorization headers on cross-origin redirect

▾ Sunlitaiohttp · aiohttpEPSS 0.34%via OSV

CVE-2026-34520Critical· 9.1

5mo ago

AIOHTTP's C parser (llhttp) accepts null bytes and control characters in response header values - header injection/security bypass

▾ Midnightaiohttp · aiohttpEPSS 0.46%via OSV

CVE-2026-34517Low

5mo ago

AIOHTTP has late size enforcement for non-file multipart fields causes memory DoS

▾ Sunlitaiohttp · aiohttpEPSS 0.38%via OSV

CVE-2026-34514Low

5mo ago

AIOHTTP has CRLF injection through multipart part content type header construction

▾ Sunlitaiohttp · aiohttpEPSS 0.32%via OSV

CVE-2025-69230Medium· 5.3

8mo ago

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. In versions 3.13.2 and below, reading multiple invalid cookies can lead to a logging storm. If the cookies attribute is accessed in an application, then an a…

▾ Sunlitaiohttp · aiohttpEPSS 0.37%via NVD

CVE-2025-69225Low

8mo ago

AIOHTTP has unicode match groups in regexes for ASCII protocol elements

▾ Sunlitaiohttp · aiohttpEPSS 0.28%via OSV

CVE-2025-69229Medium

8mo ago

AIOHTTP vulnerable to DoS through chunked messages

▾ Sunlitaiohttp · aiohttpEPSS 0.40%via OSV

CVE-2025-69224Low

8mo ago

AIOHTTP's unicode processing of header values could cause parsing discrepancies

▾ Sunlitaiohttp · aiohttpEPSS 0.24%via OSV

From the blog

All posts →

Sep 8, 2026

Sound the depths of every vulnerability.

Trending now

Feed

AIOHTTP: WebSocket client accepts compressed frames without negotiated permessage-deflate

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python

aiohttp: CRLF injection in multipart headers

aiohttp: Host-Only Cookies Become Domain Cookies After CookieJar Persistence

aiohttp: C HTTP Parser Bypasses max_line_size for Fragmented Lines

aiohttp: Unread Compressed Request Bodies Bypass client_max_size During Cleanup

aiohttp: HTTP/1 Pipelined Requests Queue Without Limit

aiohttp: TLS Server Hostname Override Is Ignored When Reusing HTTPS Connections

aiohttp: Incomplete websocket frame payloads bypass memory limits

AIOHTTP is vulnerable to cross-origin redirect with per-request cookies

aiohttp allows unlimited trailer headers, leading to possible uncapped memory usage

AIOHTTP affected by UNC SSRF/NTLMv2 Credential Theft/Local File Read in static resource handler on Windows

AIOHTTP has HTTP response splitting via \r in reason phrase

AIOHTTP has a Multipart Header Size Bypass

AIOHTTP Affected by Denial of Service (DoS) via Unbounded DNS Cache in TCPConnector

AIOHTTP accepts duplicate Host headers

AIOHTTP leaks Cookie and Proxy-Authorization headers on cross-origin redirect

AIOHTTP's C parser (llhttp) accepts null bytes and control characters in response header values - header injection/security bypass

AIOHTTP has late size enforcement for non-file multipart fields causes memory DoS

AIOHTTP has CRLF injection through multipart part content type header construction

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python

AIOHTTP has unicode match groups in regexes for ASCII protocol elements

AIOHTTP vulnerable to DoS through chunked messages

AIOHTTP's unicode processing of header values could cause parsing discrepancies

From the blog

What's new: open corpus, three new MCP tools, vendor advisories, package pages

Wiring VulnSea into an agent: a hands-on tutorial

VulnSea is live

Sound the depths of every vulnerability.

Trending now

Feed

AIOHTTP: WebSocket client accepts compressed frames without negotiated permessage-deflate

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python

aiohttp: CRLF injection in multipart headers

aiohttp: Host-Only Cookies Become Domain Cookies After CookieJar Persistence

aiohttp: C HTTP Parser Bypasses max_line_size for Fragmented Lines

aiohttp: Unread Compressed Request Bodies Bypass client_max_size During Cleanup

aiohttp: HTTP/1 Pipelined Requests Queue Without Limit

aiohttp: TLS Server Hostname Override Is Ignored When Reusing HTTPS Connections

aiohttp: Incomplete websocket frame payloads bypass memory limits

AIOHTTP is vulnerable to cross-origin redirect with per-request cookies

aiohttp allows unlimited trailer headers, leading to possible uncapped memory usage

AIOHTTP affected by UNC SSRF/NTLMv2 Credential Theft/Local File Read in static resource handler on Windows

AIOHTTP has HTTP response splitting via \r in reason phrase

AIOHTTP has a Multipart Header Size Bypass

AIOHTTP Affected by Denial of Service (DoS) via Unbounded DNS Cache in TCPConnector

AIOHTTP accepts duplicate Host headers

AIOHTTP leaks Cookie and Proxy-Authorization headers on cross-origin redirect

AIOHTTP's C parser (llhttp) accepts null bytes and control characters in response header values - header injection/security bypass

AIOHTTP has late size enforcement for non-file multipart fields causes memory DoS

AIOHTTP has CRLF injection through multipart part content type header construction

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python

AIOHTTP has unicode match groups in regexes for ASCII protocol elements

AIOHTTP vulnerable to DoS through chunked messages

AIOHTTP's unicode processing of header values could cause parsing discrepancies

From the blog

What's new: open corpus, three new MCP tools, vendor advisories, package pages

Wiring VulnSea into an agent: a hands-on tutorial

VulnSea is live