Live CVE & 0day intelligence

Sound the depths of every vulnerability.

Newly released CVEs across every platform — sleek to read, verbose on demand, and served raw as markdown for AI and agent ingestion. Severity reads as depth: the deeper the contact, the graver the threat.

Browse the feed For agents → /llms.txt

Depth = severity + exploitation

HadalCritical and actively exploited (CISA KEV / 0day)
AbyssalCritical with a public exploit or in-the-wild use
MidnightCritical, or high with PoC / in-the-wild
TwilightHigh severity, or a signal on a lesser flaw
SunlitLow / medium · no exploitation signal

65676

Tracked CVEs

6142

Critical

661

Exploited in wild

5776

Last 7 days

Trending now

Bluesky + Hacker News mentions, last 7 days

1CVE-2026-109618Critical· 9.2RCE via OOM corruption4664
2CVE-2026-109619Critical· 9.2RCE via stale global state2064
3CVE-2026-99999Critical· 9.3In the Linux kernel, the following vulnerability has been resolved: ipv4: validate checksum_start before completing checksum If a packet with bad checksum metadata gets into the ipv4 stack, skb_checksum_help can corrupt the network hea…863
4CVE-2026-111497Critical· 9.2Out-of-Bounds Write in Google Brotli Decoder663
5CVE-2026-110264Critical· 10.0Integer Overflow or Wraparound in GitLab267
6CVE-2026-108707Critical· 9.8Wukong_HRM through commit 186115e contains an authentication bypass vulnerability in ParamAspect that allows unauthenticated attackers to call every HRM API endpoint by omitting the AUTH-TOKEN header266

This week's digest →All digests

Feed

11 matches

CVE-2026-55444Medium· 5.3

today

Goobi viewer: Solr query injection via the legacy RSS servlet q and filterQuery parameters

The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. Prior to version 26.05, the legacy RSS servlet (RssResolver, GET /rss/) accepts the q and filterQuery parameters and concatenates them…

▾ Sunlitintranda · goobi-viewer-corevia CVEORG

CVE-2026-55459High· 7.4

today

Goobi viewer: OpenID JWT audience not enforced by the verifier

The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. From version 25.01 to before version 26.05, AuthenticationEndpoint.verifyOpenIdToken builds its verifier as JWT.require(algorithm).wit…

▾ Twilightintranda · goobi-viewer-corevia CVEORG

CVE-2026-55442Medium· 5.3

today

Goobi viewer: cleanUpQuery double-brace bypass allows arbitrary Solr local-param injection

The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. From version 23.03 to before version 26.05, SolrTools.cleanUpQuery() strips Solr local-parameter syntax ({!...}) from user-supplied qu…

▾ Sunlitintranda · goobi-viewer-corevia CVEORG

CVE-2026-55457High· 7.4

today

Goobi viewer: Empty webapi.authorization.token default permits unauthenticated authorization bypass

The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. Prior to version 26.05, Configuration.getWebApiToken returns the empty string when webapi.authorization.token is not configured. Autho…

▾ Twilightintranda · goobi-viewer-corevia CVEORG

CVE-2026-46346Medium· 6.5

today

Goobi viewer: Predictable Password Reset Token Allows Unauthorized Password Reset

The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. Prior to version 26.05, the password reset token is predictably based on the time of the reset request. An attacker who knows the targ…

▾ Sunlitintranda · goobi-viewer-corevia CVEORG

CVE-2026-55463Medium· 6.5

today

Goobi viewer: WebSocket endpoints lack server-side authentication and origin validation

The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. From version 4.11.0 to before version 26.05, several Jakarta WebSocket endpoints in goobi-viewer-core (DownloadTaskEndpoint, CampaignE…

▾ Sunlitintranda · goobi-viewer-corevia CVEORG

CVE-2026-46347Medium· 6.8

today

Goobi viewer: Predictable Replacement Password Allows Account Takeover After Password Reset

The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. Prior to version 26.05, when a password reset link is visited, the application generates a replacement password in a predictable way a…

▾ Sunlitintranda · goobi-viewer-corevia CVEORG

CVE-2026-55486Critical· 9.3

today

Goobi viewer: IIIF Auth 2.0 origin parameter unsanitized — CSP malformation and reflected XSS

The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. From version 25.08 to before version 26.05, the IIIF Auth 2.0 endpoints auth/login and auth/token in AuthorizationFlowResource accept …

▾ Midnightintranda · goobi-viewer-corevia CVEORG

CVE-2026-55465Medium· 5.3

today

Goobi viewer: Solr injection via unvalidated region parameter in spatial search

The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. From version 22.04 to before version 26.05, the unauthenticated REST endpoint GET /api/v1/index/{solrField}/spatial/search concatenate…

▾ Sunlitintranda · goobi-viewer-corevia CVEORG

CVE-2026-46652Critical· 9.8

today

Path traversal via HTTP `Content-Disposition` header in ExternalFilesDownloader enables remote code execution in Goobi viewer

The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. From version 24.03 to before version 26.05, ExternalFilesDownloader.getFilename() extracts the destination filename from a server-supp…

▾ Midnightintranda · goobi-viewer-corevia CVEORG

CVE-2026-46651Critical· 9.8

today

Unauthenticated SSRF and local file inclusion via DownloadTaskEndpoint WebSocket in Goobi viewer

The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. From version 24.03 to before version 26.05, the DownloadTaskEndpoint WebSocket endpoint (/tasks/download/monitor.socket) in goobi-view…

▾ Midnightintranda · goobi-viewer-corevia CVEORG

From the blog

All posts →

Sep 8, 2026

Sound the depths of every vulnerability.

Trending now

Feed

Goobi viewer: Solr query injection via the legacy RSS servlet q and filterQuery parameters

Goobi viewer: OpenID JWT audience not enforced by the verifier

Goobi viewer: cleanUpQuery double-brace bypass allows arbitrary Solr local-param injection

Goobi viewer: Empty webapi.authorization.token default permits unauthenticated authorization bypass

Goobi viewer: Predictable Password Reset Token Allows Unauthorized Password Reset

Goobi viewer: WebSocket endpoints lack server-side authentication and origin validation

Goobi viewer: Predictable Replacement Password Allows Account Takeover After Password Reset

Goobi viewer: IIIF Auth 2.0 origin parameter unsanitized — CSP malformation and reflected XSS

Goobi viewer: Solr injection via unvalidated region parameter in spatial search

Path traversal via HTTP `Content-Disposition` header in ExternalFilesDownloader enables remote code execution in Goobi viewer

Unauthenticated SSRF and local file inclusion via DownloadTaskEndpoint WebSocket in Goobi viewer

From the blog

What's new: open corpus, three new MCP tools, vendor advisories, package pages

Wiring VulnSea into an agent: a hands-on tutorial

VulnSea is live

Sound the depths of every vulnerability.

Trending now

Feed

Goobi viewer: Solr query injection via the legacy RSS servlet q and filterQuery parameters

Goobi viewer: OpenID JWT audience not enforced by the verifier

Goobi viewer: cleanUpQuery double-brace bypass allows arbitrary Solr local-param injection

Goobi viewer: Empty webapi.authorization.token default permits unauthenticated authorization bypass

Goobi viewer: Predictable Password Reset Token Allows Unauthorized Password Reset

Goobi viewer: WebSocket endpoints lack server-side authentication and origin validation

Goobi viewer: Predictable Replacement Password Allows Account Takeover After Password Reset

Goobi viewer: IIIF Auth 2.0 origin parameter unsanitized — CSP malformation and reflected XSS

Goobi viewer: Solr injection via unvalidated region parameter in spatial search

Path traversal via HTTP `Content-Disposition` header in ExternalFilesDownloader enables remote code execution in Goobi viewer

Unauthenticated SSRF and local file inclusion via DownloadTaskEndpoint WebSocket in Goobi viewer

From the blog

What's new: open corpus, three new MCP tools, vendor advisories, package pages

Wiring VulnSea into an agent: a hands-on tutorial

VulnSea is live