Live CVE & 0day intelligence

Sound the depths of every vulnerability.

Newly released CVEs across every platform — sleek to read, verbose on demand, and served raw as markdown for AI and agent ingestion. Severity reads as depth: the deeper the contact, the graver the threat.

Browse the feed For agents → /llms.txt

Depth = severity + exploitation

HadalCritical and actively exploited (CISA KEV / 0day)
AbyssalCritical with a public exploit or in-the-wild use
MidnightCritical, or high with PoC / in-the-wild
TwilightHigh severity, or a signal on a lesser flaw
SunlitLow / medium · no exploitation signal

65287

Tracked CVEs

6117

Critical

657

Exploited in wild

6068

Last 7 days

Trending now

Bluesky + Hacker News mentions, last 7 days

1CVE-2026-109618Critical· 9.2RCE via OOM corruption4464
2CVE-2026-109619Critical· 9.2RCE via stale global state1964
3CVE-2026-99999Critical· 9.3In the Linux kernel, the following vulnerability has been resolved: ipv4: validate checksum_start before completing checksum If a packet with bad checksum metadata gets into the ipv4 stack, skb_checksum_help can corrupt the network hea…863
4CVE-2026-110264Critical· 10.0Integer Overflow or Wraparound in GitLab267
5CVE-2026-108707Critical· 9.8Wukong_HRM through commit 186115e contains an authentication bypass vulnerability in ParamAspect that allows unauthenticated attackers to call every HRM API endpoint by omitting the AUTH-TOKEN header266

This week's digest →All digests

Feed

9 matches

CVE-2026-115355High· 7.5

yesterday

Mistune before 3.3.0 Path Traversal and XSS via Include Directive

Mistune before 3.3.0 contains a path traversal vulnerability in the Include directive that allows attackers to read arbitrary files by supplying ../ sequences in include paths. Attackers can also inject HTML through unescaped error messa…

▾ Twilightlepture · mistunevia CVEORG

CVE-2026-115353High· 8.6

yesterday

Mistune before 3.3.0 Path Traversal via include Directive

Mistune before 3.3.0 contains a path traversal vulnerability in the RST include directive that allows attackers to read arbitrary files by supplying relative or absolute paths. Attackers can submit markdown containing include directives …

▾ Twilightlepture · mistunevia CVEORG

CVE-2026-115354Medium· 6.5

yesterday

Mistune before 3.3.0 Arbitrary Local File Read via Include Directive

Mistune before 3.3.0 contains a path traversal vulnerability in the opt-in Include directive that allows attackers to read local files by supplying relative or absolute include paths. Attackers who submit Markdown rendered via Markdown.r…

▾ Sunlitlepture · mistunevia CVEORG

CVE-2026-115352High· 7.5

yesterday

Mistune before 3.3.0 Quadratic-Time DoS via Unmatched Brackets in Inline Parser

Mistune before 3.3.0 contains an algorithmic complexity vulnerability in the inline link parser that allows unauthenticated attackers to exhaust CPU by submitting long runs of unmatched '[' characters. Attackers can send small markdown p…

▾ Twilightlepture · mistunevia CVEORG

CVE-2026-115351Medium· 4.7

yesterday

Mistune 3.2.1 before 3.3.0 CSS Injection via Figure Directive figwidth Option

Mistune from 3.2.1 before 3.3.0 contains a CSS injection vulnerability that allows attackers controlling markdown input to inject arbitrary style declarations via the unvalidated figwidth option of the figure directive. Attackers can app…

▾ Sunlitlepture · mistunevia CVEORG

CVE-2026-115350Medium· 6.1

yesterday

Mistune before 3.3.0 Stored XSS via Include Directive HTML Files

Mistune before 3.3.0 contains a cross-site scripting vulnerability in the Include directive that emits included .html, .xhtml, or .htm file content as raw block_html tokens. Attackers who can plant an HTML file readable by the renderer c…

▾ Sunlitlepture · mistunevia CVEORG

CVE-2026-115349High· 7.5

yesterday

Mistune 3.0.0 before 3.3.0 Denial of Service via Nested Bracket Parsing

Mistune from 3.0.0 before 3.3.0 contains an algorithmic complexity denial of service vulnerability in the parse_link_text function in src/mistune/helpers.py. Attackers can submit markdown with deeply nested square brackets triggering qua…

▾ Twilightlepture · mistunevia CVEORG

CVE-2026-115348High· 7.5

yesterday

Mistune before 3.3.0 Quadratic-Time DoS via parse_link_text

Mistune from 3.0.0 before 3.3.0 contains an algorithmic complexity vulnerability in the inline link parser's parse_link_text function that allows unauthenticated attackers to exhaust CPU with unbalanced brackets. Attackers can submit Mar…

▾ Twilightlepture · mistunevia CVEORG

CVE-2026-115347High· 7.5

yesterday

Mistune before 3.3.0 Quadratic Denial of Service via parse_link_text

Mistune before 3.3.0 contains an inefficient algorithmic complexity vulnerability in parse_link_text that allows remote attackers to cause denial of service through unbalanced square brackets. Attackers can submit markdown containing lon…

▾ Twilightlepture · mistunevia CVEORG

From the blog

All posts →

Sep 8, 2026

Sound the depths of every vulnerability.

Trending now

Feed

Mistune before 3.3.0 Path Traversal and XSS via Include Directive

Mistune before 3.3.0 Path Traversal via include Directive

Mistune before 3.3.0 Arbitrary Local File Read via Include Directive

Mistune before 3.3.0 Quadratic-Time DoS via Unmatched Brackets in Inline Parser

Mistune 3.2.1 before 3.3.0 CSS Injection via Figure Directive figwidth Option

Mistune before 3.3.0 Stored XSS via Include Directive HTML Files

Mistune 3.0.0 before 3.3.0 Denial of Service via Nested Bracket Parsing

Mistune before 3.3.0 Quadratic-Time DoS via parse_link_text

Mistune before 3.3.0 Quadratic Denial of Service via parse_link_text

From the blog

What's new: open corpus, three new MCP tools, vendor advisories, package pages

Wiring VulnSea into an agent: a hands-on tutorial

VulnSea is live

Sound the depths of every vulnerability.

Trending now

Feed

Mistune before 3.3.0 Path Traversal and XSS via Include Directive

Mistune before 3.3.0 Path Traversal via include Directive

Mistune before 3.3.0 Arbitrary Local File Read via Include Directive

Mistune before 3.3.0 Quadratic-Time DoS via Unmatched Brackets in Inline Parser

Mistune 3.2.1 before 3.3.0 CSS Injection via Figure Directive figwidth Option

Mistune before 3.3.0 Stored XSS via Include Directive HTML Files

Mistune 3.0.0 before 3.3.0 Denial of Service via Nested Bracket Parsing

Mistune before 3.3.0 Quadratic-Time DoS via parse_link_text

Mistune before 3.3.0 Quadratic Denial of Service via parse_link_text

From the blog

What's new: open corpus, three new MCP tools, vendor advisories, package pages

Wiring VulnSea into an agent: a hands-on tutorial

VulnSea is live