Live CVE & 0day intelligence

Sound the depths of every vulnerability.

Newly released CVEs across every platform — sleek to read, verbose on demand, and served raw as markdown for AI and agent ingestion. Severity reads as depth: the deeper the contact, the graver the threat.

Browse the feed For agents → /llms.txt

Depth = severity + exploitation

HadalCritical and actively exploited (CISA KEV / 0day)
AbyssalCritical with a public exploit or in-the-wild use
MidnightCritical, or high with PoC / in-the-wild
TwilightHigh severity, or a signal on a lesser flaw
SunlitLow / medium · no exploitation signal

34757

Tracked CVEs

3387

Critical

421

Exploited in wild

4825

Last 7 days

Trending now

Bluesky + Hacker News mentions, last 7 days

1CVE-2026-58704High· 8.8In Cellular Modem, there is a possible permission bypass due to a logic error in the code374
2CVE-2026-69836Critical· 10.0Microsoft Entra ID Remote Code Execution Vulnerability267
3CVE-2026-66747Critical· 9.8Zbtlink router firmware ships an embedded remote-control implant, ENDLESSDOORS, present in every published build across the product line266
4CVE-2026-18963Critical· 9.1A flaw was found in the reset-credentials flow of the keycloak-services component, which is the core engine for identity and access management in Red Hat Build of Keycloak263

This week's digest →All digests

Feed

14 matches

CVE-2026-83805Medium· 6.4

5d ago

Nautobot is a Network Source of Truth and Network Automation Platform

Nautobot is a Network Source of Truth and Network Automation Platform. From 3.0.0 until 3.1.8, the generic ApprovalWorkflowStageResponse create endpoint does not enforce approver-group membership, change permission on the object under re…

▾ Sunlitnautobot · nautobotEPSS 0.22%via NVD

CVE-2026-83801Medium· 5.4

5d ago

Nautobot is a Network Source of Truth and Network Automation Platform

Nautobot is a Network Source of Truth and Network Automation Platform. Prior to 2.4.37 and 3.1.8, a user with extras.add_relationship or extras.change_relationship permission can store HTML or JavaScript in a Relationship description, an…

▾ Sunlitnautobot · nautobotEPSS 0.22%via NVD

CVE-2026-44794Medium· 5.4

4mo ago

Nautobot: REST API permits creation of GenericForeignKey references to objects that the user should not be able to reference

▾ Sunlitnautobot · nautobotEPSS 0.30%via OSV

CVE-2026-44796Medium· 6.5

4mo ago

Nautobot: Object bulk rename UI actions vulnerable to denial of service by crafted regular expression (REDoS)

▾ Sunlitnautobot · nautobotEPSS 0.56%via OSV

CVE-2026-44798High· 7.1

4mo ago

Nautobot: GitRepository.current_head field should not be writable through REST API

▾ Twilightnautobot · nautobotEPSS 0.50%via OSV

CVE-2026-44797High· 8.5

4mo ago

Nautobot: Webhook definitions could be used for server-side request forgery (SSRF)

▾ Twilightnautobot · nautobotEPSS 0.40%via OSV

CVE-2026-34203Low· 2.7

6mo ago

Nautobot: Management of users via REST API does not apply configured password validators

▾ Sunlitnautobot · nautobotEPSS 0.34%via OSV

CVE-2025-49143Medium

1y ago

Nautobot may allows uploaded media files to be accessible without authentication

▾ Sunlitnautobot · nautobotEPSS 0.44%via OSV

CVE-2024-34707High· 7.5

2y ago

Nautobot's BANNER_* configuration can be used to inject arbitrary HTML content into Nautobot pages

▾ Twilightnautobot · nautobotEPSS 0.61%via OSV

CVE-2024-32979High· 7.5

2y ago

From the blog

All posts →

Sep 8, 2026

Sound the depths of every vulnerability.

Trending now

Feed

Nautobot is a Network Source of Truth and Network Automation Platform

Nautobot is a Network Source of Truth and Network Automation Platform

Nautobot: REST API permits creation of GenericForeignKey references to objects that the user should not be able to reference

Nautobot: Object bulk rename UI actions vulnerable to denial of service by crafted regular expression (REDoS)

Nautobot: GitRepository.current_head field should not be writable through REST API

Nautobot: Webhook definitions could be used for server-side request forgery (SSRF)

Nautobot: Management of users via REST API does not apply configured password validators

Nautobot may allows uploaded media files to be accessible without authentication

Nautobot's BANNER_* configuration can be used to inject arbitrary HTML content into Nautobot pages

nautobot has reflected Cross-site Scripting potential in all object list views

Unauthenticated views may expose information to anonymous users

XSS potential in rendered Markdown fields (comments, description, notes, etc.)

Unauthenticated db-file-storage views

Nautobot vulnerable to exposure of hashed user passwords via REST API

From the blog

What's new: open corpus, three new MCP tools, vendor advisories, package pages

Wiring VulnSea into an agent: a hands-on tutorial

VulnSea is live

Sound the depths of every vulnerability.

Trending now

Feed

Nautobot is a Network Source of Truth and Network Automation Platform

Nautobot is a Network Source of Truth and Network Automation Platform

Nautobot: REST API permits creation of GenericForeignKey references to objects that the user should not be able to reference

Nautobot: Object bulk rename UI actions vulnerable to denial of service by crafted regular expression (REDoS)

Nautobot: GitRepository.current_head field should not be writable through REST API

Nautobot: Webhook definitions could be used for server-side request forgery (SSRF)

Nautobot: Management of users via REST API does not apply configured password validators

Nautobot may allows uploaded media files to be accessible without authentication

Nautobot's BANNER_* configuration can be used to inject arbitrary HTML content into Nautobot pages

nautobot has reflected Cross-site Scripting potential in all object list views

Unauthenticated views may expose information to anonymous users

XSS potential in rendered Markdown fields (comments, description, notes, etc.)

Unauthenticated db-file-storage views

Nautobot vulnerable to exposure of hashed user passwords via REST API

From the blog

What's new: open corpus, three new MCP tools, vendor advisories, package pages

Wiring VulnSea into an agent: a hands-on tutorial

VulnSea is live