Live CVE & 0day intelligence

Sound the depths of every vulnerability.

Newly released CVEs across every platform — sleek to read, verbose on demand, and served raw as markdown for AI and agent ingestion. Severity reads as depth: the deeper the contact, the graver the threat.

Browse the feed For agents → /llms.txt

Depth = severity + exploitation

HadalCritical and actively exploited (CISA KEV / 0day)
AbyssalCritical with a public exploit or in-the-wild use
MidnightCritical, or high with PoC / in-the-wild
TwilightHigh severity, or a signal on a lesser flaw
SunlitLow / medium · no exploitation signal

34736

Tracked CVEs

3386

Critical

421

Exploited in wild

4807

Last 7 days

Trending now

Bluesky + Hacker News mentions, last 7 days

1CVE-2026-58704High· 8.8In Cellular Modem, there is a possible permission bypass due to a logic error in the code374
2CVE-2026-69836Critical· 10.0Microsoft Entra ID Remote Code Execution Vulnerability267
3CVE-2026-66747Critical· 9.8Zbtlink router firmware ships an embedded remote-control implant, ENDLESSDOORS, present in every published build across the product line266
4CVE-2026-18963Critical· 9.1A flaw was found in the reset-credentials flow of the keycloak-services component, which is the core engine for identity and access management in Red Hat Build of Keycloak263

This week's digest →All digests

Feed

17 matches

CVE-2026-79669Medium· 4.3

1mo ago

Ech0 before 4.4.3 lacks authorization checks on system log endpoints allowing any authenticated non-admin user to read and stream all server logs

Ech0 before 4.4.3 lacks authorization checks on system log endpoints allowing any authenticated non-admin user to read and stream all server logs. Attackers can access historical logs and real-time log streams via GET /api/system/logs, G…

▾ Sunlitlin-snow · github.com/lin-snow/ech0EPSS 0.21%via NVD

CVE-2026-79664High· 7.4

1mo ago

Ech0 before 4.7.3 fails to properly revoke access tokens created with never-expire option, allowing attackers to maintain perpetual authenticated access after token theft

Ech0 before 4.7.3 fails to properly revoke access tokens created with never-expire option, allowing attackers to maintain perpetual authenticated access after token theft. Three independent revocation mechanisms fail: logout panics on ni…

▾ Twilightlin-snow · github.com/lin-snow/ech0EPSS 0.27%via NVD

CVE-2026-79659High· 7.7

1mo ago

Ech0 before 4.7.3 contains a server-side request forgery vulnerability in the fetchPeerConnectInfo function that uses unvalidated HTTP requests instead of safe request methods with URL validation

Ech0 before 4.7.3 contains a server-side request forgery vulnerability in the fetchPeerConnectInfo function that uses unvalidated HTTP requests instead of safe request methods with URL validation. Authenticated attackers can supply arbit…

▾ Twilightlin-snow · github.com/lin-snow/ech0EPSS 0.26%via NVD

GO-2026-5981None

2mo ago

Ech0: ParseAcceptLanguage `_` separator bypass enables ~70x CPU amplification via Accept-Language header in i18n.Middleware in github.com…

Ech0: ParseAcceptLanguage `_` separator bypass enables ~70x CPU amplification via Accept-Language header in i18n.Middleware in github.com/lin-snow/ech0

▾ Sunlitlin-snow · github.com/lin-snow/ech0via OSV

GHSA-mqxv-9rm6-w8qcHigh

2mo ago

Ech0: ParseAcceptLanguage `_` separator bypass enables ~70x CPU amplification via Accept-Language header in i18n.Middleware

▾ Twilightlin-snow · github.com/lin-snow/ech0via GHSA

CVE-2026-79660Medium· 5.3

4mo ago

Ech0 comment model's Email field returned on public /api/comments endpoints

▾ Sunlitlin-snow · github.com/lin-snow/Ech0EPSS 0.41%via OSV

CVE-2026-79668Medium· 5.3

4mo ago

Ech0's Unauthenticated Like Endpoint Enables Arbitrary Engagement Metric Inflation

▾ Sunlitlin-snow · github.com/lin-snow/ech0EPSS 0.43%via OSV

CVE-2026-79661Medium· 6.5

4mo ago

Ech0 allows PUT /api/echo/like/:id unauthenticated: anonymous callers to modify any echo's fav_count

▾ Sunlitlin-snow · github.com/lin-snow/Ech0EPSS 0.43%via OSV

CVE-2026-79662High· 8.0

4mo ago

Ech0's OAuth redirect URI validation ignores path component, enables exchange-code theft

▾ Twilightlin-snow · github.com/lin-snow/Ech0EPSS 0.32%via OSV

CVE-2026-79663Medium· 4.8

4mo ago

Ech0's RSS feed renders unescaped tag names and raw-HTML markdown, stored XSS against subscribers

▾ Sunlitlin-snow · github.com/lin-snow/Ech0EPSS 0.25%via OSV

GHSA-fpw6-hrg5-q5x5High· 7.4

4mo ago

ech0's acess tokens with expiry=never cannot be revoked: logout panics, delete does not blacklist JTI

▾ Twilightlin-snow · github.com/lin-snow/ech0via OSV

CVE-2026-79671Medium· 5.5

5mo ago

Ech0 has SSRF via DNS Resolution Bypass in Webhook URL Validation

▾ Sunlitlin-snow · github.com/lin-snow/ech0EPSS 0.31%via OSV

CVE-2026-79673Medium· 6.5

5mo ago

Ech0 Scope Bypass: profile:read Access Token Can Change Admin Password and Escalate to Unrestricted Session

▾ Sunlitlin-snow · github.com/lin-snow/ech0EPSS 0.43%via OSV

CVE-2026-79672Medium· 5.5

5mo ago

Ech0 Comment Panel Endpoints Missing RequireScopes Middleware — Scoped Access Token Bypass

▾ Sunlitlin-snow · github.com/lin-snow/ech0EPSS 0.32%via OSV

CVE-2026-79666Medium· 6.5

5mo ago

Ech0: Missing authorization on dashboard log endpoints allows low-privilege users to access sensitive system logs

▾ Sunlitlin-snow · github.com/lin-snow/ech0EPSS 0.39%via OSV

CVE-2026-79670Medium· 4.8

5mo ago

Ech0 has Stored XSS via SVG Upload and Content-Type Validation Bypass in File Upload

▾ Sunlitlin-snow · github.com/lin-snow/ech0EPSS 0.25%via OSV

CVE-2026-79667High· 7.6

5mo ago

Ech0: Scoped admin access tokens can bypass least-privilege controls on privileged endpoints, including backup export

▾ Twilightlin-snow · github.com/lin-snow/ech0EPSS 0.32%via OSV

From the blog

All posts →

Sep 8, 2026

Sound the depths of every vulnerability.

Trending now

Feed

Ech0 before 4.4.3 lacks authorization checks on system log endpoints allowing any authenticated non-admin user to read and stream all server logs

Ech0 before 4.7.3 fails to properly revoke access tokens created with never-expire option, allowing attackers to maintain perpetual authenticated access after token theft

Ech0 before 4.7.3 contains a server-side request forgery vulnerability in the fetchPeerConnectInfo function that uses unvalidated HTTP requests instead of safe request methods with URL validation

Ech0: ParseAcceptLanguage `_` separator bypass enables ~70x CPU amplification via Accept-Language header in i18n.Middleware in github.com…

Ech0: ParseAcceptLanguage `_` separator bypass enables ~70x CPU amplification via Accept-Language header in i18n.Middleware

Ech0 comment model's Email field returned on public /api/comments endpoints

Ech0's Unauthenticated Like Endpoint Enables Arbitrary Engagement Metric Inflation

Ech0 allows PUT /api/echo/like/:id unauthenticated: anonymous callers to modify any echo's fav_count

Ech0's OAuth redirect URI validation ignores path component, enables exchange-code theft

Ech0's RSS feed renders unescaped tag names and raw-HTML markdown, stored XSS against subscribers

ech0's acess tokens with expiry=never cannot be revoked: logout panics, delete does not blacklist JTI

Ech0 has SSRF via DNS Resolution Bypass in Webhook URL Validation

Ech0 Scope Bypass: profile:read Access Token Can Change Admin Password and Escalate to Unrestricted Session

Ech0 Comment Panel Endpoints Missing RequireScopes Middleware — Scoped Access Token Bypass

Ech0: Missing authorization on dashboard log endpoints allows low-privilege users to access sensitive system logs

Ech0 has Stored XSS via SVG Upload and Content-Type Validation Bypass in File Upload

Ech0: Scoped admin access tokens can bypass least-privilege controls on privileged endpoints, including backup export

From the blog

What's new: open corpus, three new MCP tools, vendor advisories, package pages

Wiring VulnSea into an agent: a hands-on tutorial

VulnSea is live

Sound the depths of every vulnerability.

Trending now

Feed

Ech0 before 4.4.3 lacks authorization checks on system log endpoints allowing any authenticated non-admin user to read and stream all server logs

Ech0 before 4.7.3 fails to properly revoke access tokens created with never-expire option, allowing attackers to maintain perpetual authenticated access after token theft

Ech0 before 4.7.3 contains a server-side request forgery vulnerability in the fetchPeerConnectInfo function that uses unvalidated HTTP requests instead of safe request methods with URL validation

Ech0: ParseAcceptLanguage `_` separator bypass enables ~70x CPU amplification via Accept-Language header in i18n.Middleware in github.com…

Ech0: ParseAcceptLanguage `_` separator bypass enables ~70x CPU amplification via Accept-Language header in i18n.Middleware

Ech0 comment model's Email field returned on public /api/comments endpoints

Ech0's Unauthenticated Like Endpoint Enables Arbitrary Engagement Metric Inflation

Ech0 allows PUT /api/echo/like/:id unauthenticated: anonymous callers to modify any echo's fav_count

Ech0's OAuth redirect URI validation ignores path component, enables exchange-code theft

Ech0's RSS feed renders unescaped tag names and raw-HTML markdown, stored XSS against subscribers

ech0's acess tokens with expiry=never cannot be revoked: logout panics, delete does not blacklist JTI

Ech0 has SSRF via DNS Resolution Bypass in Webhook URL Validation

Ech0 Scope Bypass: profile:read Access Token Can Change Admin Password and Escalate to Unrestricted Session

Ech0 Comment Panel Endpoints Missing RequireScopes Middleware — Scoped Access Token Bypass

Ech0: Missing authorization on dashboard log endpoints allows low-privilege users to access sensitive system logs

Ech0 has Stored XSS via SVG Upload and Content-Type Validation Bypass in File Upload

Ech0: Scoped admin access tokens can bypass least-privilege controls on privileged endpoints, including backup export

From the blog

What's new: open corpus, three new MCP tools, vendor advisories, package pages

Wiring VulnSea into an agent: a hands-on tutorial

VulnSea is live