Live CVE & 0day intelligence

Sound the depths of every vulnerability.

Newly released CVEs across every platform — sleek to read, verbose on demand, and served raw as markdown for AI and agent ingestion. Severity reads as depth: the deeper the contact, the graver the threat.

Browse the feed For agents → /llms.txt

Depth = severity + exploitation

HadalCritical and actively exploited (CISA KEV / 0day)
AbyssalCritical with a public exploit or in-the-wild use
MidnightCritical, or high with PoC / in-the-wild
TwilightHigh severity, or a signal on a lesser flaw
SunlitLow / medium · no exploitation signal

30474

Tracked CVEs

2988

Critical

380

Exploited in wild

4929

Last 7 days

Trending now

Bluesky + Hacker News mentions, last 7 days

1CVE-2026-85046High· 8.8Type confusion in V8 in Google Chrome prior to 152.0.7977.82 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page874
2CVE-2026-58704High· 8.8In Cellular Modem, there is a possible permission bypass due to a logic error in the code373
3CVE-2026-69836Critical· 10.0Microsoft Entra ID Remote Code Execution Vulnerability267
4CVE-2026-66747Critical· 9.8Zbtlink router firmware ships an embedded remote-control implant, ENDLESSDOORS, present in every published build across the product line266
5CVE-2026-18963Critical· 9.1A flaw was found in the reset-credentials flow of the keycloak-services component, which is the core engine for identity and access management in Red Hat Build of Keycloak263

This week's digest →All digests

Feed

39 matches

CVE-2026-15830None

1mo ago

An issue was discovered in Django 5.2 before 5.2.17 and 6.0 before 6.0.8.

An issue was discovered in Django 5.2 before 5.2.17 and 6.0 before 6.0.8. GeoDjango's `django.contrib.gis.geos.GEOSGeometry` is subject to a potential denial-of-service when parsing deeply nested `GEOMETRYCOLLECTION` objects supplied as …

▾ Sunlitdjango · djangoEPSS 1.3%via OSV

CVE-2026-53878Medium· 6.1

2mo ago

Django: DomainNameValidator permits newline characters that may enable HTTP header injection

▾ Sunlitdjango · djangoEPSS 0.33%via OSV

CVE-2026-53877Medium· 4.8

2mo ago

Django: GDALRaster may over-read heap memory when constructed from bytes

▾ Sunlitdjango · djangoEPSS 0.44%via OSV

CVE-2026-48588Low· 3.1

2mo ago

Django: cache middleware may expose private responses when unrelated request cookies are present

▾ Sunlitdjango · djangoEPSS 0.43%via OSV

CVE-2026-35193Low· 3.1

3mo ago

Django: UpdateCacheMiddleware may disclose private cached responses by omitting Authorization from Vary

▾ Sunlitdjango · djangoEPSS 0.37%via OSV

CVE-2026-6873Low· 3.1

3mo ago

Django: signed cookies are vulnerable to salt namespace collisions

▾ Sunlitdjango · djangoEPSS 0.24%via OSV

CVE-2026-48587Low· 3.1

3mo ago

Django: has_vary_header may expose cached responses when Vary values contain whitespace

▾ Sunlitdjango · djangoEPSS 0.37%via OSV

CVE-2026-8404Low· 3.1

3mo ago

Django: UpdateCacheMiddleware may disclose cached responses due to case-sensitive Cache-Control handling

▾ Sunlitdjango · djangoEPSS 0.29%via OSV

CVE-2026-7666Low· 3.1

3mo ago

Django fails to prevent reuse of a partially-initialized connection after a failed `STARTTLS` handshake

▾ Sunlitdjango · djangoEPSS 0.15%via OSV

CVE-2026-5766Medium· 5.3

4mo ago

Django: SGI requests with a missing or understated `Content-Length` header could bypass the `DATA_UPLOAD_MAX_MEMORY_SIZE` limit

▾ Twilightdjango · djangoEPSS 0.77%via OSV

CVE-2026-33033Medium· 6.5PoC

5mo ago

Django has potential DoS via MultiPartParser through crafted multipart uploads

▾ Twilightdjango · djangoEPSS 0.88%via OSV

CVE-2026-25674Low· 3.7

6mo ago

Django has a Race Condition vulnerability

▾ Sunlitdjango · djangoEPSS 0.34%via OSV

CVE-2026-25673High· 7.5

6mo ago

Django vulnerable to Uncontrolled Resource Consumption

▾ Twilightdjango · djangoEPSS 0.73%via OSV

CVE-2026-1285Low

7mo ago

Django has Inefficient Algorithmic Complexity

▾ Sunlitdjango · djangoEPSS 1.0%via OSV

CVE-2025-14550Low

7mo ago

Django has Inefficient Algorithmic Complexity

▾ Sunlitdjango · djangoEPSS 1.0%via OSV

CVE-2025-13473Low

7mo ago

Django has Observable Timing Discrepancy

▾ Sunlitdjango · djangoEPSS 0.74%via OSV

CVE-2025-64460Medium

9mo ago

Django is vulnerable to DoS via XML serializer text extraction

▾ Sunlitdjango · djangoEPSS 2.1%via OSV

CVE-2025-13372Medium· 4.3

9mo ago

Django is vulnerable to SQL injection in column aliases

▾ Sunlitdjango · djangoEPSS 0.92%via OSV

CVE-2025-64458High· 7.5PoC

10mo ago

Django has a denial-of-service vulnerability in HttpResponseRedirect and HttpResponsePermanentRedirect on Windows

▾ Midnightdjango · djangoEPSS 1.9%via OSV

CVE-2025-57833High· 7.1PoC

1y ago

Django is subject to SQL injection through its column aliases

▾ Midnightdjango · djangoEPSS 16%via OSV

CVE-2025-48432Medium· 4.0

1y ago

Django Improper Output Neutralization for Logs vulnerability

▾ Sunlitdjango · djangoEPSS 0.75%via OSV

CVE-2025-32873Medium· 5.3PoC

1y ago

Django has a denial-of-service possibility in strip_tags()

▾ Twilightdjango · djangoEPSS 14%via OSV

From the blog

All posts →

Sep 8, 2026

What's new: open corpus, three new MCP tools, vendor advisories, package pages

A summary of everything that shipped over the last two weeks — the whole corpus is open, agents get change feeds, alias resolution and EPSS movers, and the data now includes CVE.org, vendor CSAF, aggregated exploits and per-source scores.

Jul 1, 2026

Wiring VulnSea into an agent: a hands-on tutorial

A step-by-step guide to plugging VulnSea into automated and agentic workflows — poll the delta, triage without burning tokens, match an SBOM, and let an MCP-native model do the reasoning.

Jun 29, 2026

VulnSea is live

CVE and 0day intelligence that reads like an instrument — built for analysts and AI agents alike. Here's what it does and where it's going.

Sound the depths of every vulnerability.

Trending now

Feed

An issue was discovered in Django 5.2 before 5.2.17 and 6.0 before 6.0.8.

Django: DomainNameValidator permits newline characters that may enable HTTP header injection

Django: GDALRaster may over-read heap memory when constructed from bytes

Django: cache middleware may expose private responses when unrelated request cookies are present

Django: UpdateCacheMiddleware may disclose private cached responses by omitting Authorization from Vary

Django: signed cookies are vulnerable to salt namespace collisions

Django: has_vary_header may expose cached responses when Vary values contain whitespace

Django: UpdateCacheMiddleware may disclose cached responses due to case-sensitive Cache-Control handling

Django fails to prevent reuse of a partially-initialized connection after a failed `STARTTLS` handshake

Django has an Improper Handling of Length Parameter Inconsistency

Django Uses Cache Containing Sensitive Information

Django vulnerable to privilege abuse in ModelAdmin.list_editable

Django: SGI requests with a missing or understated `Content-Length` header could bypass the `DATA_UPLOAD_MAX_MEMORY_SIZE` limit

Django has potential DoS via MultiPartParser through crafted multipart uploads

Django has a Race Condition vulnerability

Django vulnerable to Uncontrolled Resource Consumption

Django has Inefficient Algorithmic Complexity

Django has Inefficient Algorithmic Complexity

Django has Observable Timing Discrepancy

Django is vulnerable to DoS via XML serializer text extraction

Django is vulnerable to SQL injection in column aliases

Django has a denial-of-service vulnerability in HttpResponseRedirect and HttpResponsePermanentRedirect on Windows

Django is subject to SQL injection through its column aliases

Django Improper Output Neutralization for Logs vulnerability

Django has a denial-of-service possibility in strip_tags()

From the blog

What's new: open corpus, three new MCP tools, vendor advisories, package pages

Wiring VulnSea into an agent: a hands-on tutorial

VulnSea is live

Sound the depths of every vulnerability.

Trending now

Feed

An issue was discovered in Django 5.2 before 5.2.17 and 6.0 before 6.0.8.

Django: DomainNameValidator permits newline characters that may enable HTTP header injection

Django: GDALRaster may over-read heap memory when constructed from bytes

Django: cache middleware may expose private responses when unrelated request cookies are present

Django: UpdateCacheMiddleware may disclose private cached responses by omitting Authorization from Vary

Django: signed cookies are vulnerable to salt namespace collisions

Django: has_vary_header may expose cached responses when Vary values contain whitespace

Django: UpdateCacheMiddleware may disclose cached responses due to case-sensitive Cache-Control handling

Django fails to prevent reuse of a partially-initialized connection after a failed `STARTTLS` handshake

Django has an Improper Handling of Length Parameter Inconsistency

Django Uses Cache Containing Sensitive Information

Django vulnerable to privilege abuse in ModelAdmin.list_editable

Django: SGI requests with a missing or understated `Content-Length` header could bypass the `DATA_UPLOAD_MAX_MEMORY_SIZE` limit

Django has potential DoS via MultiPartParser through crafted multipart uploads

Django has a Race Condition vulnerability

Django vulnerable to Uncontrolled Resource Consumption

Django has Inefficient Algorithmic Complexity

Django has Inefficient Algorithmic Complexity

Django has Observable Timing Discrepancy

Django is vulnerable to DoS via XML serializer text extraction

Django is vulnerable to SQL injection in column aliases

Django has a denial-of-service vulnerability in HttpResponseRedirect and HttpResponsePermanentRedirect on Windows

Django is subject to SQL injection through its column aliases

Django Improper Output Neutralization for Logs vulnerability

Django has a denial-of-service possibility in strip_tags()

From the blog

What's new: open corpus, three new MCP tools, vendor advisories, package pages

Wiring VulnSea into an agent: a hands-on tutorial

VulnSea is live