Live CVE & 0day intelligence

Sound the depths of every vulnerability.

Newly released CVEs across every platform — sleek to read, verbose on demand, and served raw as markdown for AI and agent ingestion. Severity reads as depth: the deeper the contact, the graver the threat.

Browse the feed For agents → /llms.txt

Depth = severity + exploitation

HadalCritical and actively exploited (CISA KEV / 0day)
AbyssalCritical with a public exploit or in-the-wild use
MidnightCritical, or high with PoC / in-the-wild
TwilightHigh severity, or a signal on a lesser flaw
SunlitLow / medium · no exploitation signal

46727

Tracked CVEs

4571

Critical

517

Exploited in wild

7433

Last 7 days

Trending now

Bluesky + Hacker News mentions, last 7 days

1CVE-2026-88771Critical· 9.8Improper input validation vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway. This issue affects ADC: before 14.1-73.37, before 13.1-64.23, before 14.1-73.37 FIPS, and before 13.1.37.279 FIPS and NDcPP; Gateway: before 1…479

This week's digest →All digests

Feed

12 matches

CVE-2026-56336Medium· 5.3PoC

2mo ago

Capgo before 12.128.2 contains an information disclosure vulnerability in the unauthenticated /private/sso/check-domain endpoint that returns internal org_id and provider_id values

Capgo before 12.128.2 contains an information disclosure vulnerability in the unauthenticated /private/sso/check-domain endpoint that returns internal org_id and provider_id values. Attackers can enumerate email domains to build mappings…

▾ TwilightCapgo · CapgoEPSS 0.34%via NVD

CVE-2026-56281Low· 3.8PoC

2mo ago

Capgo before 12.128.2 contains a sql injection vulnerability in the POST /private/admin_stats endpoint where the limit parameter is destructured from unvalidated request body and interpolated directly into Cloudflare Analytics Engine SQL…

Capgo before 12.128.2 contains a sql injection vulnerability in the POST /private/admin_stats endpoint where the limit parameter is destructured from unvalidated request body and interpolated directly into Cloudflare Analytics Engine SQL…

▾ TwilightCapgo · CapgoEPSS 0.33%via NVD

CVE-2026-56305High· 8.3PoC

3mo ago

Capgo - Authentication Bypass in Password Change via Missing Current Password Validation

Capgo before 12.128.2 contains an authentication bypass vulnerability in the password change endpoint that allows attackers to change user passwords without requiring current password confirmation. Attackers with temporary session access…

▾ MidnightCapgo · CapgoEPSS 0.52%via CVEORG

CVE-2026-56298Medium· 4.3

3mo ago

Capgo - EXIF Metadata Exposure in App Information Image Upload

Capgo before 12.128.2 fails to strip EXIF metadata from images uploaded via the app information endpoint, exposing sensitive geolocation data. Attackers can upload images containing EXIF metadata to extract geographic location informatio…

▾ SunlitCapgo · CapgoEPSS 0.31%via CVEORG

CVE-2026-56256High· 7.1PoC

3mo ago

Capgo - Two-Factor Authentication Bypass via Organization Management API

Capgo before 12.128.2 enforces mandatory two-factor authentication only at the UI level. Sensitive Organization (ORG) management API endpoints (e.g., editing organization details, inviting users) do not validate 2FA completion on the bac…

▾ MidnightCapgo · CapgoEPSS 0.41%via CVEORG

CVE-2026-56223High· 8.7PoC

3mo ago

Capgo before 12.128.2 contains a cross-domain SSO account takeover vulnerability in the provision-user endpoint that allows attackers to merge arbitrary victim accounts based on email match without validating SSO provider domain authoriz…

Capgo before 12.128.2 contains a cross-domain SSO account takeover vulnerability in the provision-user endpoint that allows attackers to merge arbitrary victim accounts based on email match without validating SSO provider domain authoriz…

▾ MidnightCapgo · CapgoEPSS 0.40%via NVD

CVE-2026-56236Medium· 6.1PoC

3mo ago

Capgo CLI before 12.128.2 contains arbitrary file overwrite vulnerabilities in login and build credentials operations that follow symlinks without validation

Capgo CLI before 12.128.2 contains arbitrary file overwrite vulnerabilities in login and build credentials operations that follow symlinks without validation. Attackers can create malicious symlinks in repositories to overwrite arbitrary…

▾ Twilightcapgo · cliEPSS 0.18%via NVD

CVE-2026-56332Medium· 4.7PoC

3mo ago

Capgo before 12.128.2 contains an open redirect vulnerability in the confirm-signup endpoint that allows attackers to redirect users to arbitrary external websites

Capgo before 12.128.2 contains an open redirect vulnerability in the confirm-signup endpoint that allows attackers to redirect users to arbitrary external websites. The confirmation_url parameter is not validated, enabling attackers to c…

▾ TwilightCapgo · CapgoEPSS 0.30%via NVD

CVE-2026-56228Medium· 4.9

3mo ago

Capgo - Denial of Service via Improper Password Policy Length Validation

Capgo before 12.128.2 fails to enforce a maximum value on the minimum password length field in its password policy configuration. An authenticated organization administrator can set an extremely large numeric value (e.g., billions of cha…

▾ SunlitCapgo · CapgoEPSS 0.47%via CVEORG

CVE-2026-56212Low· 3.8PoC

3mo ago

Capgo - Improper 2FA Enforcement Logic via Team Security Settings

Capgo before 12.128.2 contains an authentication logic flaw: a user with permission to manage team or organization security settings can enable mandatory two-factor authentication for all team members without first enabling 2FA on their …

▾ TwilightCapgo · CapgoEPSS 0.34%via CVEORG

CVE-2026-53867Medium· 4.3

3mo ago

Capgo < 12.128.2 - Orphaned File Retention via Profile Image Replacement

Capgo before 12.128.2 fails to delete previously uploaded profile images from backend storage when users replace or remove them. Attackers can access orphaned image files through previously generated URLs, allowing unauthorized retrieval…

▾ SunlitCapgo · CapgoEPSS 0.31%via CVEORG

CVE-2026-53868High· 7.5

3mo ago

Capgo < 12.128.2 - Denial of Service via Unverified Email Account Registration and Deletion

Capgo before 12.128.2 contains a denial of service vulnerability allowing attackers to register accounts using arbitrary email addresses without verification, then initiate deletion to lock emails in pending deletion state. Attackers can…

▾ TwilightCapgo · CapgoEPSS 0.45%via CVEORG

From the blog

All posts →

Sep 8, 2026

Sound the depths of every vulnerability.

Trending now

Feed

Capgo before 12.128.2 contains an information disclosure vulnerability in the unauthenticated /private/sso/check-domain endpoint that returns internal org_id and provider_id values

Capgo before 12.128.2 contains a sql injection vulnerability in the POST /private/admin_stats endpoint where the limit parameter is destructured from unvalidated request body and interpolated directly into Cloudflare Analytics Engine SQL…

Capgo - Authentication Bypass in Password Change via Missing Current Password Validation

Capgo - EXIF Metadata Exposure in App Information Image Upload

Capgo - Two-Factor Authentication Bypass via Organization Management API

Capgo before 12.128.2 contains a cross-domain SSO account takeover vulnerability in the provision-user endpoint that allows attackers to merge arbitrary victim accounts based on email match without validating SSO provider domain authoriz…

Capgo CLI before 12.128.2 contains arbitrary file overwrite vulnerabilities in login and build credentials operations that follow symlinks without validation

Capgo before 12.128.2 contains an open redirect vulnerability in the confirm-signup endpoint that allows attackers to redirect users to arbitrary external websites

Capgo - Denial of Service via Improper Password Policy Length Validation

Capgo - Improper 2FA Enforcement Logic via Team Security Settings

Capgo < 12.128.2 - Orphaned File Retention via Profile Image Replacement

Capgo < 12.128.2 - Denial of Service via Unverified Email Account Registration and Deletion

From the blog

What's new: open corpus, three new MCP tools, vendor advisories, package pages

Wiring VulnSea into an agent: a hands-on tutorial

VulnSea is live

Sound the depths of every vulnerability.

Trending now

Feed

Capgo before 12.128.2 contains an information disclosure vulnerability in the unauthenticated /private/sso/check-domain endpoint that returns internal org_id and provider_id values

Capgo before 12.128.2 contains a sql injection vulnerability in the POST /private/admin_stats endpoint where the limit parameter is destructured from unvalidated request body and interpolated directly into Cloudflare Analytics Engine SQL…

Capgo - Authentication Bypass in Password Change via Missing Current Password Validation

Capgo - EXIF Metadata Exposure in App Information Image Upload

Capgo - Two-Factor Authentication Bypass via Organization Management API

Capgo before 12.128.2 contains a cross-domain SSO account takeover vulnerability in the provision-user endpoint that allows attackers to merge arbitrary victim accounts based on email match without validating SSO provider domain authoriz…

Capgo CLI before 12.128.2 contains arbitrary file overwrite vulnerabilities in login and build credentials operations that follow symlinks without validation

Capgo before 12.128.2 contains an open redirect vulnerability in the confirm-signup endpoint that allows attackers to redirect users to arbitrary external websites

Capgo - Denial of Service via Improper Password Policy Length Validation

Capgo - Improper 2FA Enforcement Logic via Team Security Settings

Capgo < 12.128.2 - Orphaned File Retention via Profile Image Replacement

Capgo < 12.128.2 - Denial of Service via Unverified Email Account Registration and Deletion

From the blog

What's new: open corpus, three new MCP tools, vendor advisories, package pages

Wiring VulnSea into an agent: a hands-on tutorial

VulnSea is live