Live CVE & 0day intelligence

Sound the depths of every vulnerability.

Newly released CVEs across every platform — sleek to read, verbose on demand, and served raw as markdown for AI and agent ingestion. Severity reads as depth: the deeper the contact, the graver the threat.

Browse the feed For agents → /llms.txt

Depth = severity + exploitation

HadalCritical and actively exploited (CISA KEV / 0day)
AbyssalCritical with a public exploit or in-the-wild use
MidnightCritical, or high with PoC / in-the-wild
TwilightHigh severity, or a signal on a lesser flaw
SunlitLow / medium · no exploitation signal

34737

Tracked CVEs

3386

Critical

421

Exploited in wild

4805

Last 7 days

Trending now

Bluesky + Hacker News mentions, last 7 days

1CVE-2026-58704High· 8.8In Cellular Modem, there is a possible permission bypass due to a logic error in the code374
2CVE-2026-69836Critical· 10.0Microsoft Entra ID Remote Code Execution Vulnerability267
3CVE-2026-66747Critical· 9.8Zbtlink router firmware ships an embedded remote-control implant, ENDLESSDOORS, present in every published build across the product line266
4CVE-2026-18963Critical· 9.1A flaw was found in the reset-credentials flow of the keycloak-services component, which is the core engine for identity and access management in Red Hat Build of Keycloak263

This week's digest →All digests

Feed

14 matches

CVE-2026-52827High· 7.1

1w ago

Kimai is an open-source time tracking application

Kimai is an open-source time tracking application. Prior to 2.59.0, the KIMAI_SESSION cookie issued after password verification but before TOTP completion is accepted by every /api route because config/packages/security.yaml protects the…

▾ Twilightkimai · kimaiEPSS 0.58%via NVD

CVE-2026-52828Medium· 5.3

1w ago

Kimai is an open-source time tracking application

Kimai is an open-source time tracking application. Prior to 2.58.0, ExportController::createExportTemplate() and ExportController::editExportTemplate() inherit only the class-level create_export permission, which ROLE_TEAMLEAD receives b…

▾ Sunlitkimai · kimaiEPSS 0.46%via NVD

CVE-2026-52819Medium· 6.3PoC

1w ago

Kimai is an open-source time tracking application

Kimai is an open-source time tracking application. Prior to 2.57.0, the GET /api/timesheets list endpoint accepts user and users[] target identifiers from a caller with view_other_timesheet but does not apply access_user or verify that a…

▾ Twilightkimai · kimaiEPSS 0.50%via NVD

CVE-2026-52820Medium· 5.3

1w ago

Kimai is an open-source time tracking application

Kimai is an open-source time tracking application. Prior to 2.57.0, PATCH /api/timesheets/{id} and POST /api/timesheets accept a user-controlled project identifier through TimesheetApiEditForm and FormTrait, and ProjectRepository::getQue…

▾ Sunlitkimai · kimaiEPSS 0.45%via NVD

CVE-2026-52821Medium· 5.3

1w ago

Kimai is an open-source time tracking application

Kimai is an open-source time tracking application. Prior to 2.57.0, GET or POST requests to /en/admin/activity/create/{project} and /en/admin/project/create/{customer} require only the generic create_activity or create_project capability…

▾ Sunlitkimai · kimaiEPSS 0.43%via NVD

CVE-2026-52822Medium· 5.3

1w ago

Kimai is an open-source time tracking application

Kimai is an open-source time tracking application. Prior to 2.58.0, PATCH /api/timesheets/{id}/restart, PATCH /api/timesheets/{id}/duplicate, and the web duplicate workflow can derive a new record from an owned historical timesheet after…

▾ Sunlitkimai · kimaiEPSS 0.46%via NVD

CVE-2026-52823Medium· 5.3

1w ago

Kimai is an open-source time tracking application

Kimai is an open-source time tracking application. Prior to 2.58.0, TimesheetController exposes GET /api/timesheets/{id}/stop and GET /api/timesheets/{id}/restart, which reuse an authenticated browser session and perform state-changing o…

▾ Sunlitkimai · kimaiEPSS 0.30%via NVD

CVE-2026-52824Critical· 9.1PoC

1w ago

Kimai is an open-source time tracking application

Kimai is an open-source time tracking application. Prior to 2.58.0, the official Docker image sets APP_SECRET to the public value change_this_to_something_unique in Dockerfile, and .docker/entrypoint.sh neither replaces nor rejects that …

▾ Abyssalkimai · kimaiEPSS 1.3%via NVD

CVE-2026-52825Medium· 5.3

1w ago

Kimai is an open-source time tracking application

Kimai is an open-source time tracking application. Prior to 2.58.0, POST /api/teams/{id}/members/{userId} and POST /api/teams/{id}/activities/{activityId} verify that a teamlead may edit the Team but do not verify access_user for the ref…

▾ Sunlitkimai · kimaiEPSS 0.45%via NVD

CVE-2026-52826Medium· 5.3

1w ago

Kimai is an open-source time tracking application

Kimai is an open-source time tracking application. Prior to 2.57.0, GET or POST requests to /en/admin/project/{id}/rate/{rate}, /en/admin/customer/{id}/rate/{rate}, and /en/admin/activity/{id}/rate/{rate} independently resolve the author…

▾ Sunlitkimai · kimaiEPSS 0.43%via NVD

CVE-2026-49992Medium· 6.3

2w ago

Kimai is an open-source time tracking application

Kimai is an open-source time tracking application. Versions prior to 2.58.0 contain authenticated cross-site request forgery issues in their default team creation shortcuts for projects, customers, and activities. These endpoints are exp…

▾ Sunlitkimai · kimaiEPSS 0.22%via NVD

CVE-2026-49865Medium· 5.3PoC

2w ago

Kimai is an open-source time tracking application

Kimai is an open-source time tracking application. Versions prior to 2.58.0 contain a server-side request forgery vulnerability in their invoice PDF preview and generation workflow. If an attacker can control Markdown content that is lat…

▾ Twilightkimai · kimaiEPSS 0.35%via NVD

GHSA-j5mc-p8qg-39j7Low

2mo ago