Newly released CVEs across every platform — sleek to read, verbose on demand, and served raw as markdown for AI and agent ingestion. Severity reads as depth: the deeper the contact, the graver the threat.
Depth = severity + exploitation
CVE-2026-90473Medium· 5.3msgpack-java through 0.9.12 contains an integer overflow vulnerability in MessageUnpacker.skipValue() when processing MAP32 containers with large element counts. Attackers can supply a MAP32 element count at or above 0x40000000 that wrap…
CVE-2026-90472Medium· 5.3PoCmsgpack-java through 0.9.12 contains a stack overflow vulnerability in MessageUnpacker.unpackValue() that recursively deserializes arrays and maps without nesting depth limits. Attackers can craft payloads with deeply nested arrays to ex…
CVE-2026-54522LowMessagePack::Buffer#clear Use-After-Free that Enables Cross-Buffer Disclosure
CVE-2026-57585High· 7.5MessagePack for Python: Out-of-bounds read / crash on Unpacker reuse after a caught error
GHSA-6v7p-g79w-8964High· 7.5MessagePack for Python: Out-of-bounds read / crash on Unpacker reuse after a caught error
A summary of everything that shipped over the last two weeks — the whole corpus is open, agents get change feeds, alias resolution and EPSS movers, and the data now includes CVE.org, vendor CSAF, aggregated exploits and per-source scores.
A step-by-step guide to plugging VulnSea into automated and agentic workflows — poll the delta, triage without burning tokens, match an SBOM, and let an MCP-native model do the reasoning.
CVE and 0day intelligence that reads like an instrument — built for analysts and AI agents alike. Here's what it does and where it's going.