Live CVE & 0day intelligence

Sound the depths of every vulnerability.

Newly released CVEs across every platform — sleek to read, verbose on demand, and served raw as markdown for AI and agent ingestion. Severity reads as depth: the deeper the contact, the graver the threat.

Browse the feed For agents → /llms.txt

Depth = severity + exploitation

HadalCritical and actively exploited (CISA KEV / 0day)
AbyssalCritical with a public exploit or in-the-wild use
MidnightCritical, or high with PoC / in-the-wild
TwilightHigh severity, or a signal on a lesser flaw
SunlitLow / medium · no exploitation signal

30432

Tracked CVEs

2986

Critical

380

Exploited in wild

4906

Last 7 days

Trending now

Bluesky + Hacker News mentions, last 7 days

1CVE-2026-85046High· 8.8Type confusion in V8 in Google Chrome prior to 152.0.7977.82 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page874
2CVE-2026-58704High· 8.8In Cellular Modem, there is a possible permission bypass due to a logic error in the code373
3CVE-2026-69836Critical· 10.0Microsoft Entra ID Remote Code Execution Vulnerability267
4CVE-2026-66747Critical· 9.8Zbtlink router firmware ships an embedded remote-control implant, ENDLESSDOORS, present in every published build across the product line266
5CVE-2026-18963Critical· 9.1A flaw was found in the reset-credentials flow of the keycloak-services component, which is the core engine for identity and access management in Red Hat Build of Keycloak263

This week's digest →All digests

Feed

21 matches

CVE-2026-88057Medium· 5.3

1w ago

Angular: Sanitization bypass via directive host bindings on concrete host elements in @angular/core and @angular/compiler

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.28, 21.2.20, and 22.1.0, Angular's compiler and runtime in @angular/core and @angular/compi…

▾ Sunlitangular · angularEPSS 0.41%via CVEORG

CVE-2026-88059Medium· 4.0

1w ago

Angular: Information Leak via `HttpTransferCache` Bypass When Using `withRequestsMadeViaParent`

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.28, 21.2.20, and 22.1.1, Angular's @angular/common HttpTransferCache can cache an authentic…

▾ Sunlitangular · angularEPSS 0.30%via CVEORG

CVE-2026-88056High· 8.6PoC

1w ago

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.30, 21.2.22, and 22.1.4, Angular Server-Side Rendering in @angular/platform-server processe…

▾ Midnightangular · angularEPSS 0.43%via NVD

CVE-2026-88058High· 8.6PoC

1w ago

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.30, 21.2.22, and 22.1.4, Angular server-side rendering (SSR) in @angular/platform-server se…

▾ Midnightangular · angularEPSS 0.50%via NVD

CVE-2026-88060High· 8.6PoC

1w ago

Angular: SSR XSS via Unescaped <template> Content Across DocumentFragment Boundaries in Fallback Raw-Content Elements

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.30, 21.2.22, and 22.1.4, Angular server-side rendering (SSR) in @angular/platform-server se…

▾ Midnightangular · angularEPSS 0.70%via CVEORG

CVE-2026-68945High

1mo ago

Angular: Cache-Key Ambiguity in HttpTransferCache Leading to Cross-Request Response Reuse and State Poisoning

▾ Twilightangular · @angular/commonEPSS 0.12%via GHSA

CVE-2026-69149High

1mo ago

Angular SSR: Missing Fallback Raw-Content Serialization Escaping leads to Cross-Site Scripting (XSS)

▾ Twilightangular · @angular/platform-serverEPSS 0.21%via GHSA

CVE-2026-69151High

1mo ago

Angular i18n: Cross-Site Scripting (XSS) via event-handler attributes

▾ Twilightangular · @angular/compilerEPSS 0.20%via GHSA

CVE-2026-54267High

3mo ago

Angular Client Hydration DOM Clobbering & Response-Cache Poisoning

▾ Twilightangular · @angular/coreEPSS 0.32%via GHSA

CVE-2026-50168High

3mo ago

@angular/platform-server: URL Parser Differential leading to SSRF Allowlist Bypass

▾ Twilightangular · @angular/platform-serverEPSS 0.24%via GHSA

CVE-2026-50169Medium

3mo ago

Angular Service Worker Policy-Bypass & Credential-Stripping Vulnerabilities

▾ Sunlitangular · @angular/service-workerEPSS 0.23%via GHSA

CVE-2026-52725Medium

3mo ago

@angular/core: Angular Template and Dynamic Component Namespace Bypass leading to Cross-Site Scripting (XSS)

▾ Sunlitangular · @angular/coreEPSS 0.40%via GHSA

CVE-2026-50170High

3mo ago

@angular/common: Information Leak via Default Caching of Credentialed Requests in HttpTransferCache

▾ Twilightangular · @angular/commonEPSS 0.43%via GHSA

CVE-2026-50171High

3mo ago

@angular/common: Denial of Service (DoS) via OOM in Number Formatting (digitsInfo)

▾ Twilightangular · @angular/commonEPSS 0.26%via GHSA

CVE-2026-50184Medium

3mo ago

@angular/service-worker: Request Credential & Cache Policy Stripping

▾ Sunlitangular · @angular/service-workerEPSS 0.21%via GHSA

CVE-2026-50555High

3mo ago

@angular/platform-server: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

▾ Twilightangular · @angular/platform-serverEPSS 0.27%via GHSA

CVE-2026-50557Medium

3mo ago

Angular: Template and Attribute Namespace Sanitization Bypass (XSS)

▾ Sunlitangular · @angular/coreEPSS 0.34%via GHSA

CVE-2026-54265Medium

3mo ago

@angular/compiler: Two-Way Property Binding Sanitization Bypass (XSS)

▾ Sunlitangular · @angular/compilerEPSS 0.34%via GHSA

CVE-2026-54266High

3mo ago

@angular/common: Weak 32-Bit Cache Key Hashing in `HttpTransferCache` Leading to Cross-Request Data Leakage and State Poisoning

▾ Twilightangular · @angular/commonEPSS 0.13%via GHSA

CVE-2026-54268High

3mo ago

@angular/common: Denial of Service (DoS) via OOM in Date Formatting (formatDate)

▾ Twilightangular · @angular/commonEPSS 0.58%via GHSA

CVE-2026-54264High

3mo ago

@angular/service-worker: Sensitive Header Leakage on Cross-Origin Redirects in Angular Service Worker

▾ Twilightangular · @angular/service-workerEPSS 0.39%via GHSA

From the blog

All posts →

Sep 8, 2026

Sound the depths of every vulnerability.

Trending now

Feed

Angular: Sanitization bypass via directive host bindings on concrete host elements in @angular/core and @angular/compiler

Angular: Information Leak via `HttpTransferCache` Bypass When Using `withRequestsMadeViaParent`

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages

Angular: SSR XSS via Unescaped <template> Content Across DocumentFragment Boundaries in Fallback Raw-Content Elements

Angular: Cache-Key Ambiguity in HttpTransferCache Leading to Cross-Request Response Reuse and State Poisoning

Angular SSR: Missing Fallback Raw-Content Serialization Escaping leads to Cross-Site Scripting (XSS)

Angular i18n: Cross-Site Scripting (XSS) via event-handler attributes

Angular Client Hydration DOM Clobbering & Response-Cache Poisoning

@angular/platform-server: URL Parser Differential leading to SSRF Allowlist Bypass

Angular Service Worker Policy-Bypass & Credential-Stripping Vulnerabilities

@angular/core: Angular Template and Dynamic Component Namespace Bypass leading to Cross-Site Scripting (XSS)

@angular/common: Information Leak via Default Caching of Credentialed Requests in HttpTransferCache

@angular/common: Denial of Service (DoS) via OOM in Number Formatting (digitsInfo)

@angular/service-worker: Request Credential & Cache Policy Stripping

@angular/platform-server: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Angular: Template and Attribute Namespace Sanitization Bypass (XSS)

@angular/compiler: Two-Way Property Binding Sanitization Bypass (XSS)

@angular/common: Weak 32-Bit Cache Key Hashing in `HttpTransferCache` Leading to Cross-Request Data Leakage and State Poisoning

@angular/common: Denial of Service (DoS) via OOM in Date Formatting (formatDate)

@angular/service-worker: Sensitive Header Leakage on Cross-Origin Redirects in Angular Service Worker

From the blog

What's new: open corpus, three new MCP tools, vendor advisories, package pages

Wiring VulnSea into an agent: a hands-on tutorial

VulnSea is live

Sound the depths of every vulnerability.

Trending now

Feed

Angular: Sanitization bypass via directive host bindings on concrete host elements in @angular/core and @angular/compiler

Angular: Information Leak via `HttpTransferCache` Bypass When Using `withRequestsMadeViaParent`

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages

Angular: SSR XSS via Unescaped <template> Content Across DocumentFragment Boundaries in Fallback Raw-Content Elements

Angular: Cache-Key Ambiguity in HttpTransferCache Leading to Cross-Request Response Reuse and State Poisoning

Angular SSR: Missing Fallback Raw-Content Serialization Escaping leads to Cross-Site Scripting (XSS)

Angular i18n: Cross-Site Scripting (XSS) via event-handler attributes

Angular Client Hydration DOM Clobbering & Response-Cache Poisoning

@angular/platform-server: URL Parser Differential leading to SSRF Allowlist Bypass

Angular Service Worker Policy-Bypass & Credential-Stripping Vulnerabilities

@angular/core: Angular Template and Dynamic Component Namespace Bypass leading to Cross-Site Scripting (XSS)

@angular/common: Information Leak via Default Caching of Credentialed Requests in HttpTransferCache

@angular/common: Denial of Service (DoS) via OOM in Number Formatting (digitsInfo)

@angular/service-worker: Request Credential & Cache Policy Stripping

@angular/platform-server: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Angular: Template and Attribute Namespace Sanitization Bypass (XSS)

@angular/compiler: Two-Way Property Binding Sanitization Bypass (XSS)

@angular/common: Weak 32-Bit Cache Key Hashing in `HttpTransferCache` Leading to Cross-Request Data Leakage and State Poisoning

@angular/common: Denial of Service (DoS) via OOM in Date Formatting (formatDate)

@angular/service-worker: Sensitive Header Leakage on Cross-Origin Redirects in Angular Service Worker

From the blog

What's new: open corpus, three new MCP tools, vendor advisories, package pages

Wiring VulnSea into an agent: a hands-on tutorial

VulnSea is live