Live CVE & 0day intelligence

Sound the depths of every vulnerability.

Newly released CVEs across every platform — sleek to read, verbose on demand, and served raw as markdown for AI and agent ingestion. Severity reads as depth: the deeper the contact, the graver the threat.

Browse the feed For agents → /llms.txt

Depth = severity + exploitation

HadalCritical and actively exploited (CISA KEV / 0day)
AbyssalCritical with a public exploit or in-the-wild use
MidnightCritical, or high with PoC / in-the-wild
TwilightHigh severity, or a signal on a lesser flaw
SunlitLow / medium · no exploitation signal

34763

Tracked CVEs

3390

Critical

423

Exploited in wild

4803

Last 7 days

Trending now

Bluesky + Hacker News mentions, last 7 days

1CVE-2026-58704High· 8.8In Cellular Modem, there is a possible permission bypass due to a logic error in the code374
2CVE-2026-69836Critical· 10.0Microsoft Entra ID Remote Code Execution Vulnerability267
3CVE-2026-66747Critical· 9.8Zbtlink router firmware ships an embedded remote-control implant, ENDLESSDOORS, present in every published build across the product line266
4CVE-2026-18963Critical· 9.1A flaw was found in the reset-credentials flow of the keycloak-services component, which is the core engine for identity and access management in Red Hat Build of Keycloak263

This week's digest →All digests

Feed

38 matches

CVE-2026-76154High· 7.3

1w ago

A stored cross-site scripting vulnerability in the Geomap panel's MapLibre base layer allows a user with the Editor role to execute arbitrary JavaScript in another user's session by hosting a malicious style configuration, enabling escal…

A stored cross-site scripting vulnerability in the Geomap panel's MapLibre base layer allows a user with the Editor role to execute arbitrary JavaScript in another user's session by hosting a malicious style configuration, enabling escal…

▾ TwilightGrafana · Grafana OSSEPSS 0.35%via NVD

CVE-2026-15815High· 8.8

1w ago

Grafana OSS and Grafana Enterprise did not safely resolve symbolic links when extracting plugin archives

Grafana OSS and Grafana Enterprise did not safely resolve symbolic links when extracting plugin archives. A crafted plugin archive can chain relative symbolic link entries to escape the plugin installation directory, writing arbitrary fi…

▾ TwilightGrafana · Grafana OSSEPSS 0.66%via NVD

CVE-2026-14199High· 7.1

3w ago

Only self-managed Grafana instances with Auth Proxy authentication and identity caching enabled (sync_ttl greater than zero) are affected

Only self-managed Grafana instances with Auth Proxy authentication and identity caching enabled (sync_ttl greater than zero) are affected. The Auth Proxy cache key concatenated the username and forwarded identity attributes without a del…

▾ Twilightgrafana · grafanaEPSS 0.31%via NVD

CVE-2026-11817Medium· 5.3

1mo ago

CVE-2026-11817 CVE Record

This vulnerability only affects Grafana stacks configured with multiple organizations; single-organization deployments are not impacted. In a multi-organization stack, a user who is an Org Admin of a single organization can call GET /api…

▾ SunlitGrafana · Grafana OSSEPSS 0.35%via CVEORG

CVE-2026-42127High· 7.5

3mo ago

The public dashboard query endpoint does not limit request body size before processing, allowing unauthenticated attackers to trigger excessive memory allocation by sending arbitrarily large JSON payloads

The public dashboard query endpoint does not limit request body size before processing, allowing unauthenticated attackers to trigger excessive memory allocation by sending arbitrarily large JSON payloads. This can lead to denial of serv…

▾ Twilightgrafana · grafanaEPSS 0.43%via NVD

CVE-2026-9029High· 7.3

3mo ago

A user with Editor permissions can place a malicious script in the attribution field of a Geomap panel's XYZ tile layer via a template variable

A user with Editor permissions can place a malicious script in the attribution field of a Geomap panel's XYZ tile layer via a template variable. The script then executes in the browser of any user who views the affected dashboard (stored…

▾ Twilightgrafana · grafanaEPSS 0.32%via NVD

CVE-2026-42129High· 7.7

3mo ago

A user with Viewer permissions can use a path traversal in the Loki data source plugin to reach administrative Loki endpoints and read sensitive backend configuration and internal service information.

A user with Viewer permissions can use a path traversal in the Loki data source plugin to reach administrative Loki endpoints and read sensitive backend configuration and internal service information.

▾ Twilightgrafana · loki_datasourceEPSS 0.44%via NVD

CVE-2026-10601Medium· 5.4

3mo ago

A user with Viewer permissions can use specially crafted requests to the Tempo and Loki data source plugins to reach unintended backend endpoints

A user with Viewer permissions can use specially crafted requests to the Tempo and Loki data source plugins to reach unintended backend endpoints. Depending on the backend configuration this can expose data source credentials, leak inter…

▾ Sunlitgrafana · grafanaEPSS 0.29%via NVD

CVE-2026-27878Medium· 6.5

3mo ago

Grafana Tempo vulnerable to an out-of-memory crash

▾ Sunlitgrafana · github.com/grafana/tempoEPSS 0.41%via OSV

CVE-2026-11769Medium

3mo ago

Grafana Operator: Privilege escalation from namespace admin to cluster admin via GrafanaDashboard jsonnetLib fileName

▾ Sunlitgrafana · github.com/grafana/grafana-operator/v5EPSS 0.36%via GHSA

GHSA-v82c-5c2q-hx9gMedium

3mo ago

Duplicate Advisory: Privilege escalation from namespace admin to cluster admin via GrafanaDashboard jsonnetLib fileName

▾ Sunlitgrafana · github.com/grafana/grafana-operatorvia GHSA

CVE-2026-21728High· 7.5

5mo ago

Tempo queries with large limits can cause large memory allocations which can impact the availability of the service, depending on its deployment strategy. Mitigation can be done by setting max_result_limit in the search config, e.g

Tempo queries with large limits can cause large memory allocations which can impact the availability of the service, depending on its deployment strategy. Mitigation can be done by setting max_result_limit in the search config, e.g. to …

▾ Twilightgrafana · tempoEPSS 0.64%via NVD

CVE-2026-21727Low· 3.3

5mo ago

A cross-tenant isolation vulnerability was found in Grafana’s Correlations feature affecting legacy correlation records

A cross-tenant isolation vulnerability was found in Grafana’s Correlations feature affecting legacy correlation records. Due to a backward compatibility condition allowing org_id = 0 records to be returned across organizations, a user wi…

▾ Sunlitgrafana · grafanaEPSS 0.20%via NVD

CVE-2025-41118Critical· 9.1

5mo ago

Pyroscope is an open-source continuous profiling database

Pyroscope is an open-source continuous profiling database. The database supports various storage backends, including Tencent Cloud Object Storage (COS). If the database is configured to use Tencent COS as the storage backend, an attacke…

▾ Midnightgrafana · pyroscopeEPSS 0.41%via NVD

CVE-2026-21726Medium· 5.3

5mo ago

Grafana OSS: Authorization bypass allows users with Editor role to modify protected webhook URLs without permissions

▾ Sunlitgrafana · github.com/grafana/grafanaEPSS 0.26%via OSV

CVE-2026-21721High· 8.1PoC

8mo ago

The dashboard permissions API does not verify the target dashboard scope and only checks the dashboards.permissions:* action

The dashboard permissions API does not verify the target dashboard scope and only checks the dashboards.permissions:* action. As a result, a user who has permission management rights on one dashboard can read and modify permissions on ot…

▾ Midnightgrafana · grafanaEPSS 0.73%via NVD

CVE-2026-21720High· 7.5

8mo ago

Every uncached /avatar/:hash request spawns a goroutine that refreshes the Gravatar image

Every uncached /avatar/:hash request spawns a goroutine that refreshes the Gravatar image. If the refresh sits in the 10-slot worker queue longer than three seconds, the handler times out and stops listening for the result, so that gorou…

▾ Twilightgrafana · grafanaEPSS 0.70%via NVD

CVE-2025-3415Medium· 4.3PoC

1y ago

Grafana's insecure DingDing Alert integration exposes sensitive information

▾ Twilightgrafana · github.com/grafana/grafanaEPSS 0.98%via OSV

CVE-2025-3260High· 8.3

1y ago

Grafana vulnerable to authenticated users bypassing dashboard, folder permissions

▾ Twilightgrafana · github.com/grafana/grafanaEPSS 0.56%via OSV

CVE-2024-10452Low· 2.2

1y ago

Grafana org admin can delete pending invites in different org

▾ Sunlitgrafana · github.com/grafana/grafanaEPSS 0.49%via OSV

CVE-2021-41244Critical· 9.1

2y ago

Grafana Fine-grained access control vulnerability

▾ Midnightgrafana · github.com/grafana/grafanaEPSS 2.9%via OSV

CVE-2021-43815Medium· 4.3

2y ago

Grafana directory traversal for .cvs files

▾ Sunlitgrafana · github.com/grafana/grafanaEPSS 1.8%via OSV

From the blog

All posts →

Sep 8, 2026

Sound the depths of every vulnerability.

Trending now

Feed

A stored cross-site scripting vulnerability in the Geomap panel's MapLibre base layer allows a user with the Editor role to execute arbitrary JavaScript in another user's session by hosting a malicious style configuration, enabling escal…

Grafana OSS and Grafana Enterprise did not safely resolve symbolic links when extracting plugin archives

Only self-managed Grafana instances with Auth Proxy authentication and identity caching enabled (sync_ttl greater than zero) are affected

CVE-2026-11817 CVE Record

The public dashboard query endpoint does not limit request body size before processing, allowing unauthenticated attackers to trigger excessive memory allocation by sending arbitrarily large JSON payloads

A user with Editor permissions can place a malicious script in the attribution field of a Geomap panel's XYZ tile layer via a template variable

A user with Viewer permissions can use a path traversal in the Loki data source plugin to reach administrative Loki endpoints and read sensitive backend configuration and internal service information.

A user with Viewer permissions can use specially crafted requests to the Tempo and Loki data source plugins to reach unintended backend endpoints

Grafana Tempo vulnerable to an out-of-memory crash

Grafana Operator: Privilege escalation from namespace admin to cluster admin via GrafanaDashboard jsonnetLib fileName

Duplicate Advisory: Privilege escalation from namespace admin to cluster admin via GrafanaDashboard jsonnetLib fileName

Tempo queries with large limits can cause large memory allocations which can impact the availability of the service, depending on its deployment strategy. Mitigation can be done by setting max_result_limit in the search config, e.g

A cross-tenant isolation vulnerability was found in Grafana’s Correlations feature affecting legacy correlation records

Pyroscope is an open-source continuous profiling database

Grafana Loki Path Traversal - CVE-2021-36156 Bypass

Grafana public dashboards disclose all direct mode datasources

Grafana Tempo has Inadequate Encryption Strength

Grafana OSS: Authorization bypass allows users with Editor role to modify protected webhook URLs without permissions

The dashboard permissions API does not verify the target dashboard scope and only checks the dashboards.permissions:* action

Every uncached /avatar/:hash request spawns a goroutine that refreshes the Gravatar image

Grafana's insecure DingDing Alert integration exposes sensitive information

Grafana vulnerable to authenticated users bypassing dashboard, folder permissions

Grafana org admin can delete pending invites in different org

Grafana Fine-grained access control vulnerability

Grafana directory traversal for .cvs files

From the blog

What's new: open corpus, three new MCP tools, vendor advisories, package pages

Wiring VulnSea into an agent: a hands-on tutorial

VulnSea is live

Sound the depths of every vulnerability.

Trending now

Feed

A stored cross-site scripting vulnerability in the Geomap panel's MapLibre base layer allows a user with the Editor role to execute arbitrary JavaScript in another user's session by hosting a malicious style configuration, enabling escal…

Grafana OSS and Grafana Enterprise did not safely resolve symbolic links when extracting plugin archives

Only self-managed Grafana instances with Auth Proxy authentication and identity caching enabled (sync_ttl greater than zero) are affected

CVE-2026-11817 CVE Record

The public dashboard query endpoint does not limit request body size before processing, allowing unauthenticated attackers to trigger excessive memory allocation by sending arbitrarily large JSON payloads

A user with Editor permissions can place a malicious script in the attribution field of a Geomap panel's XYZ tile layer via a template variable

A user with Viewer permissions can use a path traversal in the Loki data source plugin to reach administrative Loki endpoints and read sensitive backend configuration and internal service information.

A user with Viewer permissions can use specially crafted requests to the Tempo and Loki data source plugins to reach unintended backend endpoints

Grafana Tempo vulnerable to an out-of-memory crash

Grafana Operator: Privilege escalation from namespace admin to cluster admin via GrafanaDashboard jsonnetLib fileName

Duplicate Advisory: Privilege escalation from namespace admin to cluster admin via GrafanaDashboard jsonnetLib fileName

Tempo queries with large limits can cause large memory allocations which can impact the availability of the service, depending on its deployment strategy. Mitigation can be done by setting max_result_limit in the search config, e.g

A cross-tenant isolation vulnerability was found in Grafana’s Correlations feature affecting legacy correlation records

Pyroscope is an open-source continuous profiling database

Grafana Loki Path Traversal - CVE-2021-36156 Bypass

Grafana public dashboards disclose all direct mode datasources

Grafana Tempo has Inadequate Encryption Strength

Grafana OSS: Authorization bypass allows users with Editor role to modify protected webhook URLs without permissions

The dashboard permissions API does not verify the target dashboard scope and only checks the dashboards.permissions:* action

Every uncached /avatar/:hash request spawns a goroutine that refreshes the Gravatar image

Grafana's insecure DingDing Alert integration exposes sensitive information

Grafana vulnerable to authenticated users bypassing dashboard, folder permissions

Grafana org admin can delete pending invites in different org

Grafana Fine-grained access control vulnerability

Grafana directory traversal for .cvs files

From the blog

What's new: open corpus, three new MCP tools, vendor advisories, package pages

Wiring VulnSea into an agent: a hands-on tutorial

VulnSea is live