Live CVE & 0day intelligence

Sound the depths of every vulnerability.

Newly released CVEs across every platform — sleek to read, verbose on demand, and served raw as markdown for AI and agent ingestion. Severity reads as depth: the deeper the contact, the graver the threat.

Browse the feed For agents → /llms.txt

Depth = severity + exploitation

HadalCritical and actively exploited (CISA KEV / 0day)
AbyssalCritical with a public exploit or in-the-wild use
MidnightCritical, or high with PoC / in-the-wild
TwilightHigh severity, or a signal on a lesser flaw
SunlitLow / medium · no exploitation signal

30485

Tracked CVEs

2990

Critical

380

Exploited in wild

4914

Last 7 days

Trending now

Bluesky + Hacker News mentions, last 7 days

1CVE-2026-85046High· 8.8Type confusion in V8 in Google Chrome prior to 152.0.7977.82 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page874
2CVE-2026-58704High· 8.8In Cellular Modem, there is a possible permission bypass due to a logic error in the code373
3CVE-2026-69836Critical· 10.0Microsoft Entra ID Remote Code Execution Vulnerability267
4CVE-2026-66747Critical· 9.8Zbtlink router firmware ships an embedded remote-control implant, ENDLESSDOORS, present in every published build across the product line266
5CVE-2026-18963Critical· 9.1A flaw was found in the reset-credentials flow of the keycloak-services component, which is the core engine for identity and access management in Red Hat Build of Keycloak263

This week's digest →All digests

Feed

16 matches

CVE-2026-84445High· 8.7

1w ago

gRPC-Go is the Go language implementation of gRPC

gRPC-Go is the Go language implementation of gRPC. Prior to 1.82.2 and 1.83.2, servers created with xds.NewGRPCServer() allow internal/transport/http2_server.go to accept an RPC containing neither the :authority header nor the Host heade…

▾ Twilightgrpc · grpc-goEPSS 0.69%via NVD

CVE-2026-84303Medium

3w ago

gRPC-Go is the Go language implementation of gRPC

gRPC-Go is the Go language implementation of gRPC. Prior to 1.83.1, the xDS RBAC HTTP filter in internal/xds/httpfilter/rbac/rbac.go does not lowercase header matcher names in normalizeHeaderMatcher even though incoming metadata keys are…

▾ Sunlitgrpc · google.golang.org/grpcEPSS 0.31%via NVD

CVE-2026-84304High

3w ago

gRPC-Go is the Go language implementation of gRPC

gRPC-Go is the Go language implementation of gRPC. Prior to 1.83.1, internal/transport/transport.go stores each fragmented HTTP/2 DATA frame as a separate recvMsg in recvBuffer, so millions of one-byte frames can consume disproportionate…

▾ Twilightgrpc · google.golang.org/grpcEPSS 0.41%via NVD

CVE-2026-48853Critical

4w ago

gRPC Erlang package vulnerable to Remote Code Execution with attacker-controlled gRPC payloads

▾ Midnightgrpc · grpcEPSS 0.57%via GHSA

CVE-2026-48599High

4w ago

gRPC Erlang package's path bindings are overridable by query string and request body

▾ Twilightgrpc · grpcEPSS 0.27%via GHSA

CVE-2026-48854High

4w ago

gRPC Erlang package has unbounded request body accumulation in `read_full_body/3`

▾ Twilightgrpc · grpcEPSS 0.34%via GHSA

CVE-2026-53430High

4w ago

gRPC Erlang package has unbounded gzip decompression (decompression bomb)

▾ Twilightgrpc · grpcEPSS 0.35%via GHSA

GO-2026-6061None

1mo ago

Vulnerabilities in the xDS RBAC authorization engine and the HTTP/2 transport server implementation in google.golang.org/grpc

▾ Sunlitgrpc · google.golang.org/grpcvia OSV

GHSA-hrxh-6v49-42gfHigh

2mo ago

gRPC-Go: xDS RBAC and HTTP/2 Vulnerabilities

▾ Twilightgrpc · google.golang.org/grpcvia GHSA

CVE-2026-48069High· 7.5

3mo ago

@grpc/grpc-js: An incoming malformed compressed message can cause a client or server crash

▾ Twilightgrpc · @grpc/grpc-jsEPSS 0.88%via GHSA

CVE-2026-48068High· 7.5

3mo ago

@grpc/grpc-js: A malformed request can cause a server crash

▾ Twilightgrpc · @grpc/grpc-jsEPSS 0.62%via GHSA

CVE-2026-33186Critical· 9.1PoC

6mo ago

gRPC-Go is the Go language implementation of gRPC

gRPC-Go is the Go language implementation of gRPC. Versions prior to 1.79.3 have an authorization bypass resulting from improper input validation of the HTTP/2 `:path` pseudo-header. The gRPC-Go server was too lenient in its routing logi…

▾ Abyssalgrpc · grpcEPSS 1.6%via NVD

CVE-2023-4785High· 7.5

3y ago

From the blog

All posts →

Sep 8, 2026

Sound the depths of every vulnerability.

Trending now

Feed

gRPC-Go is the Go language implementation of gRPC

gRPC-Go is the Go language implementation of gRPC

gRPC-Go is the Go language implementation of gRPC

gRPC Erlang package vulnerable to Remote Code Execution with attacker-controlled gRPC payloads

gRPC Erlang package's path bindings are overridable by query string and request body

gRPC Erlang package has unbounded request body accumulation in `read_full_body/3`

gRPC Erlang package has unbounded gzip decompression (decompression bomb)

Vulnerabilities in the xDS RBAC authorization engine and the HTTP/2 transport server implementation in google.golang.org/grpc

gRPC-Go: xDS RBAC and HTTP/2 Vulnerabilities

@grpc/grpc-js: An incoming malformed compressed message can cause a client or server crash

@grpc/grpc-js: A malformed request can cause a server crash

gRPC-Go is the Go language implementation of gRPC

Denial of Service Vulnerability in gRPC TCP Server (Posix-compatible platforms)

gRPC connection termination issue

gRPC Reachable Assertion issue

Connection confusion in gRPC

From the blog

What's new: open corpus, three new MCP tools, vendor advisories, package pages

Wiring VulnSea into an agent: a hands-on tutorial

VulnSea is live

Sound the depths of every vulnerability.

Trending now

Feed

gRPC-Go is the Go language implementation of gRPC

gRPC-Go is the Go language implementation of gRPC

gRPC-Go is the Go language implementation of gRPC

gRPC Erlang package vulnerable to Remote Code Execution with attacker-controlled gRPC payloads

gRPC Erlang package's path bindings are overridable by query string and request body

gRPC Erlang package has unbounded request body accumulation in `read_full_body/3`

gRPC Erlang package has unbounded gzip decompression (decompression bomb)

Vulnerabilities in the xDS RBAC authorization engine and the HTTP/2 transport server implementation in google.golang.org/grpc

gRPC-Go: xDS RBAC and HTTP/2 Vulnerabilities

@grpc/grpc-js: An incoming malformed compressed message can cause a client or server crash

@grpc/grpc-js: A malformed request can cause a server crash

gRPC-Go is the Go language implementation of gRPC

Denial of Service Vulnerability in gRPC TCP Server (Posix-compatible platforms)

gRPC connection termination issue

gRPC Reachable Assertion issue

Connection confusion in gRPC

From the blog

What's new: open corpus, three new MCP tools, vendor advisories, package pages

Wiring VulnSea into an agent: a hands-on tutorial

VulnSea is live