Live CVE & 0day intelligence

Sound the depths of every vulnerability.

Newly released CVEs across every platform — sleek to read, verbose on demand, and served raw as markdown for AI and agent ingestion. Severity reads as depth: the deeper the contact, the graver the threat.

Browse the feed For agents → /llms.txt

Depth = severity + exploitation

HadalCritical and actively exploited (CISA KEV / 0day)
AbyssalCritical with a public exploit or in-the-wild use
MidnightCritical, or high with PoC / in-the-wild
TwilightHigh severity, or a signal on a lesser flaw
SunlitLow / medium · no exploitation signal

34760

Tracked CVEs

3389

Critical

423

Exploited in wild

4804

Last 7 days

Trending now

Bluesky + Hacker News mentions, last 7 days

1CVE-2026-58704High· 8.8In Cellular Modem, there is a possible permission bypass due to a logic error in the code374
2CVE-2026-69836Critical· 10.0Microsoft Entra ID Remote Code Execution Vulnerability267
3CVE-2026-66747Critical· 9.8Zbtlink router firmware ships an embedded remote-control implant, ENDLESSDOORS, present in every published build across the product line266
4CVE-2026-18963Critical· 9.1A flaw was found in the reset-credentials flow of the keycloak-services component, which is the core engine for identity and access management in Red Hat Build of Keycloak263

This week's digest →All digests

Feed

26 matches

CVE-2026-42505Medium· 5.3

2mo ago

Handshakes which used Encrypted Client Hello could be de-anonymized by a passive network observer due to a disclosure of pre-shared key identities in the unencrypted client hello.

▾ Sunlitgolang · goEPSS 0.41%via NVD

CVE-2026-39822High· 7.8

2mo ago

On Unix systems, opening a file in an os.Root improperly follows symlinks to locations outside of the Root when the final path component of the a path is a symbolic link and the path ends in /

On Unix systems, opening a file in an os.Root improperly follows symlinks to locations outside of the Root when the final path component of the a path is a symbolic link and the path ends in /. For example, 'root.Open("symlink/")' will o…

▾ Twilightgolang · goEPSS 0.18%via NVD

CVE-2026-39821Critical· 9.6

4mo ago

The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label

The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label. For example, ToUnicode("xn--example-.com") incorrectly returns the name "example.com" rather than an error. This behavior …

▾ Midnightgolang · netEPSS 0.64%via NVD

CVE-2026-39832Critical· 9.1

4mo ago

When adding a key to a remote agent constraint extensions such as [email protected] were not serialized in the request

When adding a key to a remote agent constraint extensions such as [email protected] were not serialized in the request. Destination restrictions were silently stripped when forwarding keys, allowing unrestricted use of…

▾ Midnightgolang · cryptoEPSS 0.72%via NVD

CVE-2026-39835Medium· 5.3

4mo ago

SSH servers which use CertChecker as a public key callback without setting IsUserAuthority or IsHostAuthority could be caused to panic by a client presenting a certificate

SSH servers which use CertChecker as a public key callback without setting IsUserAuthority or IsHostAuthority could be caused to panic by a client presenting a certificate. CertChecker now returns an error instead of panicking when these…

▾ Sunlitgolang · cryptoEPSS 0.66%via NVD

CVE-2026-39830Critical· 9.1

4mo ago

A malicious SSH peer could send unsolicited global request responses to fill an internal buffer, blocking the connection's read loop

A malicious SSH peer could send unsolicited global request responses to fill an internal buffer, blocking the connection's read loop. The blocked goroutine could not be released by calling Close(), resulting in a resource leak per connec…

▾ Midnightgolang · cryptoEPSS 0.62%via NVD

CVE-2026-39829High· 7.5

4mo ago

The RSA and DSA public key parsers did not enforce size limits on key parameters

The RSA and DSA public key parsers did not enforce size limits on key parameters. A crafted public key with an excessively large modulus or DSA parameter could cause several minutes of CPU consumption during signature verification. This …

▾ Twilightgolang · cryptoEPSS 0.62%via NVD

CVE-2026-42508Critical· 9.1

4mo ago

Previously, a revoked 'SignatureKey' belonging to a CA was not correctly checked for revocation

Previously, a revoked 'SignatureKey' belonging to a CA was not correctly checked for revocation. Now, both the 'key' and 'key.SignatureKey' are checked for @revoked.

▾ Midnightgolang · cryptoEPSS 0.65%via NVD

CVE-2026-33814High· 7.5

4mo ago

When processing HTTP/2 SETTINGS frames, transport will enter an infinite loop of writing CONTINUATION frames if it receives a SETTINGS_MAX_FRAME_SIZE with a value of 0.

▾ Twilightgolang · goEPSS 0.87%via NVD

CVE-2026-42499High· 7.5

4mo ago

Pathological inputs could cause DoS through consumePhrase when parsing an email address according to RFC 5322.

▾ Twilightgolang · goEPSS 0.80%via NVD

CVE-2026-39820High· 7.5

4mo ago

Well-crafted inputs reaching ParseAddress, ParseAddressList, and ParseDate were able to trigger excessive CPU exhaustion and memory allocations.

▾ Twilightgolang · goEPSS 0.87%via NVD

CVE-2026-33811High· 7.5

4mo ago

When using LookupCNAME with the cgo DNS resolver, a very long CNAME response can trigger a double-free of C memory and a crash.

▾ Twilightgolang · goEPSS 0.88%via NVD

CVE-2026-42503High· 8.8

4mo ago

gopls by default communicates via pipe

gopls by default communicates via pipe. However, -port and -listen flags are supported as means of debugging. If -listen is given a value without an explicit host (e.g. :8080), or -port is used, gopls will listen on 0.0.0.0. As a result…

▾ Twilightgolang · goplsEPSS 0.35%via NVD

CVE-2026-32288Medium· 5.5

5mo ago

tar.Reader can allocate an unbounded amount of memory when reading a maliciously-crafted archive containing a large number of sparse regions encoded in the "old GNU sparse map" format.

▾ Sunlitgolang · goEPSS 0.18%via NVD

CVE-2026-27144High· 7.1

5mo ago

The compiler is meant to unwrap pointers which are the operands of a memory move; a no-op interface conversion prevented the compiler from making the correct determination about non-overlapping moves, potentially leading to memory corrup…

The compiler is meant to unwrap pointers which are the operands of a memory move; a no-op interface conversion prevented the compiler from making the correct determination about non-overlapping moves, potentially leading to memory corrup…

▾ Twilightgolang · goEPSS 0.18%via NVD

CVE-2026-27143Critical· 9.8

5mo ago

Arithmetic over induction variables in loops were not correctly checked for underflow or overflow

Arithmetic over induction variables in loops were not correctly checked for underflow or overflow. As a result, the compiler would allow for invalid indexing to occur at runtime, potentially leading to memory corruption.

▾ Midnightgolang · goEPSS 0.66%via NVD

CVE-2026-27140High· 8.8

5mo ago

SWIG file names containing 'cgo' and well-crafted payloads could lead to code smuggling and arbitrary code execution at build time due to trust layer bypass.

▾ Twilightgolang · goEPSS 0.81%via NVD

CVE-2026-32283High· 7.5

5mo ago

If one side of the TLS connection sends multiple key update messages post-handshake in a single record, the connection can deadlock, causing uncontrolled consumption of resources

If one side of the TLS connection sends multiple key update messages post-handshake in a single record, the connection can deadlock, causing uncontrolled consumption of resources. This can lead to a denial of service. This only affects T…

▾ Twilightgolang · goEPSS 0.67%via NVD

CVE-2026-32280High· 7.5

5mo ago

During chain building, the amount of work that is done is not correctly limited when a large number of intermediate certificates are passed in VerifyOptions.Intermediates, which can lead to a denial of service

During chain building, the amount of work that is done is not correctly limited when a large number of intermediate certificates are passed in VerifyOptions.Intermediates, which can lead to a denial of service. This affects both direct u…

▾ Twilightgolang · goEPSS 0.70%via NVD

CVE-2026-33810High· 8.2

5mo ago

When verifying a certificate chain containing excluded DNS constraints, these constraints are not correctly applied to wildcard DNS SANs which use a different case than the constraint

When verifying a certificate chain containing excluded DNS constraints, these constraints are not correctly applied to wildcard DNS SANs which use a different case than the constraint. This only affects validation of otherwise trusted ce…

▾ Twilightgolang · goEPSS 0.34%via NVD

CVE-2026-27137High· 7.5

6mo ago

When verifying a certificate chain which contains a certificate containing multiple email address constraints which share common local portions but different domain portions, these constraints will not be properly applied, and only the l…

When verifying a certificate chain which contains a certificate containing multiple email address constraints which share common local portions but different domain portions, these constraints will not be properly applied, and only the l…

▾ Twilightgolang · goEPSS 0.66%via NVD

CVE-2026-25679High· 7.5

6mo ago

url.Parse insufficiently validated the host/authority component and accepted some invalid URLs.

▾ Twilightgolang · goEPSS 0.80%via NVD

CVE-2025-61732High· 8.6

7mo ago

A discrepancy between how Go and C/C++ comments were parsed allowed for code smuggling into the resulting cgo binary.

▾ Twilightgolang · goEPSS 0.49%via NVD

CVE-2025-61731High· 7.8

8mo ago

Building a malicious file with cmd/go can cause can cause a write to an attacker-controlled file with partial control of the file content

Building a malicious file with cmd/go can cause can cause a write to an attacker-controlled file with partial control of the file content. The "#cgo pkg-config:" directive in a Go source file provides command-line arguments to provide to…

▾ Twilightgolang · goEPSS 0.62%via NVD

CVE-2025-61726High· 7.5

8mo ago

The net/url package does not set a limit on the number of query parameters in a query

The net/url package does not set a limit on the number of query parameters in a query. While the maximum size of query parameters in URLs is generally limited by the maximum request header size, the net/http.Request.ParseForm method can …

▾ Twilightgolang · goEPSS 2.3%via NVD

From the blog

All posts →

Sep 8, 2026

Sound the depths of every vulnerability.

Trending now

Feed

Handshakes which used Encrypted Client Hello could be de-anonymized by a passive network observer due to a disclosure of pre-shared key identities in the unencrypted client hello.

On Unix systems, opening a file in an os.Root improperly follows symlinks to locations outside of the Root when the final path component of the a path is a symbolic link and the path ends in /

The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label

When adding a key to a remote agent constraint extensions such as [email protected] were not serialized in the request

SSH servers which use CertChecker as a public key callback without setting IsUserAuthority or IsHostAuthority could be caused to panic by a client presenting a certificate

A malicious SSH peer could send unsolicited global request responses to fill an internal buffer, blocking the connection's read loop

The RSA and DSA public key parsers did not enforce size limits on key parameters

Previously, a revoked 'SignatureKey' belonging to a CA was not correctly checked for revocation

When processing HTTP/2 SETTINGS frames, transport will enter an infinite loop of writing CONTINUATION frames if it receives a SETTINGS_MAX_FRAME_SIZE with a value of 0.

Pathological inputs could cause DoS through consumePhrase when parsing an email address according to RFC 5322.

Well-crafted inputs reaching ParseAddress, ParseAddressList, and ParseDate were able to trigger excessive CPU exhaustion and memory allocations.

When using LookupCNAME with the cgo DNS resolver, a very long CNAME response can trigger a double-free of C memory and a crash.

gopls by default communicates via pipe

tar.Reader can allocate an unbounded amount of memory when reading a maliciously-crafted archive containing a large number of sparse regions encoded in the "old GNU sparse map" format.

The compiler is meant to unwrap pointers which are the operands of a memory move; a no-op interface conversion prevented the compiler from making the correct determination about non-overlapping moves, potentially leading to memory corrup…

Arithmetic over induction variables in loops were not correctly checked for underflow or overflow

SWIG file names containing 'cgo' and well-crafted payloads could lead to code smuggling and arbitrary code execution at build time due to trust layer bypass.

If one side of the TLS connection sends multiple key update messages post-handshake in a single record, the connection can deadlock, causing uncontrolled consumption of resources

During chain building, the amount of work that is done is not correctly limited when a large number of intermediate certificates are passed in VerifyOptions.Intermediates, which can lead to a denial of service

When verifying a certificate chain containing excluded DNS constraints, these constraints are not correctly applied to wildcard DNS SANs which use a different case than the constraint

When verifying a certificate chain which contains a certificate containing multiple email address constraints which share common local portions but different domain portions, these constraints will not be properly applied, and only the l…

url.Parse insufficiently validated the host/authority component and accepted some invalid URLs.

A discrepancy between how Go and C/C++ comments were parsed allowed for code smuggling into the resulting cgo binary.

Building a malicious file with cmd/go can cause can cause a write to an attacker-controlled file with partial control of the file content

The net/url package does not set a limit on the number of query parameters in a query

From the blog

What's new: open corpus, three new MCP tools, vendor advisories, package pages

Wiring VulnSea into an agent: a hands-on tutorial

VulnSea is live

Sound the depths of every vulnerability.

Trending now

Feed

Handshakes which used Encrypted Client Hello could be de-anonymized by a passive network observer due to a disclosure of pre-shared key identities in the unencrypted client hello.

On Unix systems, opening a file in an os.Root improperly follows symlinks to locations outside of the Root when the final path component of the a path is a symbolic link and the path ends in /

The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label

When adding a key to a remote agent constraint extensions such as [email protected] were not serialized in the request

SSH servers which use CertChecker as a public key callback without setting IsUserAuthority or IsHostAuthority could be caused to panic by a client presenting a certificate

A malicious SSH peer could send unsolicited global request responses to fill an internal buffer, blocking the connection's read loop

The RSA and DSA public key parsers did not enforce size limits on key parameters

Previously, a revoked 'SignatureKey' belonging to a CA was not correctly checked for revocation

When processing HTTP/2 SETTINGS frames, transport will enter an infinite loop of writing CONTINUATION frames if it receives a SETTINGS_MAX_FRAME_SIZE with a value of 0.

Pathological inputs could cause DoS through consumePhrase when parsing an email address according to RFC 5322.

Well-crafted inputs reaching ParseAddress, ParseAddressList, and ParseDate were able to trigger excessive CPU exhaustion and memory allocations.

When using LookupCNAME with the cgo DNS resolver, a very long CNAME response can trigger a double-free of C memory and a crash.

gopls by default communicates via pipe

tar.Reader can allocate an unbounded amount of memory when reading a maliciously-crafted archive containing a large number of sparse regions encoded in the "old GNU sparse map" format.

The compiler is meant to unwrap pointers which are the operands of a memory move; a no-op interface conversion prevented the compiler from making the correct determination about non-overlapping moves, potentially leading to memory corrup…

Arithmetic over induction variables in loops were not correctly checked for underflow or overflow

SWIG file names containing 'cgo' and well-crafted payloads could lead to code smuggling and arbitrary code execution at build time due to trust layer bypass.

If one side of the TLS connection sends multiple key update messages post-handshake in a single record, the connection can deadlock, causing uncontrolled consumption of resources

During chain building, the amount of work that is done is not correctly limited when a large number of intermediate certificates are passed in VerifyOptions.Intermediates, which can lead to a denial of service

When verifying a certificate chain containing excluded DNS constraints, these constraints are not correctly applied to wildcard DNS SANs which use a different case than the constraint

When verifying a certificate chain which contains a certificate containing multiple email address constraints which share common local portions but different domain portions, these constraints will not be properly applied, and only the l…

url.Parse insufficiently validated the host/authority component and accepted some invalid URLs.

A discrepancy between how Go and C/C++ comments were parsed allowed for code smuggling into the resulting cgo binary.

Building a malicious file with cmd/go can cause can cause a write to an attacker-controlled file with partial control of the file content

The net/url package does not set a limit on the number of query parameters in a query

From the blog

What's new: open corpus, three new MCP tools, vendor advisories, package pages

Wiring VulnSea into an agent: a hands-on tutorial

VulnSea is live