Live CVE & 0day intelligence

Sound the depths of every vulnerability.

Newly released CVEs across every platform — sleek to read, verbose on demand, and served raw as markdown for AI and agent ingestion. Severity reads as depth: the deeper the contact, the graver the threat.

Browse the feed For agents → /llms.txt

Depth = severity + exploitation

HadalCritical and actively exploited (CISA KEV / 0day)
AbyssalCritical with a public exploit or in-the-wild use
MidnightCritical, or high with PoC / in-the-wild
TwilightHigh severity, or a signal on a lesser flaw
SunlitLow / medium · no exploitation signal

30318

Tracked CVEs

2974

Critical

376

Exploited in wild

5300

Last 7 days

Trending now

Bluesky + Hacker News mentions, last 7 days

1CVE-2026-85046High· 8.8Type confusion in V8 in Google Chrome prior to 152.0.7977.82 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page874
2CVE-2026-58704High· 8.8In Cellular Modem, there is a possible permission bypass due to a logic error in the code373
3CVE-2026-69836Critical· 10.0Microsoft Entra ID Remote Code Execution Vulnerability267
4CVE-2026-66747Critical· 9.8Zbtlink router firmware ships an embedded remote-control implant, ENDLESSDOORS, present in every published build across the product line266
5CVE-2026-18963Critical· 9.1A flaw was found in the reset-credentials flow of the keycloak-services component, which is the core engine for identity and access management in Red Hat Build of Keycloak263

This week's digest →All digests

Feed

128 matches

CVE-2026-91836Low· 2.8PoC

6d ago

A flaw has been found in OpenClaw ClawScan up to 0.1.6

A flaw has been found in OpenClaw ClawScan up to 0.1.6. This affects an unknown function of the file internal/runner/static_scanner.go of the component Static Scanner. This manipulation causes incomplete comparison with missing factors. …

▾ TwilightOpenClaw · ClawScanEPSS 0.31%via NVD

CVE-2026-91835Low· 2.8PoC

6d ago

A vulnerability was detected in OpenClaw ClawScan up to 0.1.6

A vulnerability was detected in OpenClaw ClawScan up to 0.1.6. The impacted element is the function IsBinaryFile of the file internal/runner/static_scanner.go of the component File Classifier. The manipulation results in interpretation c…

▾ TwilightOpenClaw · ClawScanEPSS 0.11%via NVD

GHSA-2q7j-2vhx-56g8High· 8.1

2w ago

OpenClaw Feishu tools could ignore per-account disablement

▾ Twilightopenclaw · @openclaw/feishuvia GHSA

GHSA-w8wf-3qvj-6xqfHigh· 8.1

Sound the depths of every vulnerability.

Trending now

Feed

A flaw has been found in OpenClaw ClawScan up to 0.1.6

A vulnerability was detected in OpenClaw ClawScan up to 0.1.6

OpenClaw Feishu tools could ignore per-account disablement

OpenClaw Feishu permission tools could ignore per-account disablement

OpenClaw versions 2026.3.22 before 2026.6.6 contain an authorization bypass vulnerability where WhatsApp group IDs can satisfy elevated sender allowlists

OpenClaw: QQBot native approval buttons did not enforce configured approver identity

OpenClaw: Slack allowFrom could bind to mutable display names

OpenClaw: Trusted-proxy Control UI WebSocket accepted client-declared scopes before pairing

OpenClaw: Mattermost handlers could fall open when channel type was missing

OpenClaw: QQBot admin commands could skip DM-only and allowFrom policy

OpenClaw: message.action forwarding could send Gateway credentials to model-supplied loopback URLs

OpenClaw: Browser debug/export routes could reuse already-open blocked tabs

OpenClaw: Non-owner chat senders could issue device-pairing bootstrap codes

OpenClaw: QQBot pre-dispatch slash commands could skip allowFrom checks

OpenClaw: Workspace .env could override Homebrew executable selection for skill install flows

OpenClaw: Fake package roots could influence memory-core artifact loading

OpenClaw: Embedded runner policy could be confused by provider aliases

OpenClaw: Sandboxed session spawn could expose the real workspace path to child prompts

OpenClaw: Feishu dynamic-agent bindings could miss configWrites enforcement

OpenClaw: Slack and Zalo webhook secrets could remain active after secrets.reload

OpenClaw: MCP loopback could skip owner-only tool policy for non-owner callers

OpenClaw: Combined POSIX shell options could confuse exec revalidation

OpenClaw: Paired nodes could forge exec lifecycle events without system.run provenance

OpenClaw: Mattermost slash token revocation could lag until monitor refresh

OpenClaw: Matrix allowFrom could bind to mutable display names

From the blog

What's new: open corpus, three new MCP tools, vendor advisories, package pages

Wiring VulnSea into an agent: a hands-on tutorial

VulnSea is live

Sound the depths of every vulnerability.

Trending now

Feed

A flaw has been found in OpenClaw ClawScan up to 0.1.6

A vulnerability was detected in OpenClaw ClawScan up to 0.1.6

OpenClaw Feishu tools could ignore per-account disablement

OpenClaw Feishu permission tools could ignore per-account disablement

OpenClaw versions 2026.3.22 before 2026.6.6 contain an authorization bypass vulnerability where WhatsApp group IDs can satisfy elevated sender allowlists

OpenClaw: QQBot native approval buttons did not enforce configured approver identity

OpenClaw: Slack allowFrom could bind to mutable display names

OpenClaw: Trusted-proxy Control UI WebSocket accepted client-declared scopes before pairing

OpenClaw: Mattermost handlers could fall open when channel type was missing

OpenClaw: QQBot admin commands could skip DM-only and allowFrom policy

OpenClaw: message.action forwarding could send Gateway credentials to model-supplied loopback URLs

OpenClaw: Browser debug/export routes could reuse already-open blocked tabs

OpenClaw: Non-owner chat senders could issue device-pairing bootstrap codes

OpenClaw: QQBot pre-dispatch slash commands could skip allowFrom checks

OpenClaw: Workspace .env could override Homebrew executable selection for skill install flows

OpenClaw: Fake package roots could influence memory-core artifact loading

OpenClaw: Embedded runner policy could be confused by provider aliases

OpenClaw: Sandboxed session spawn could expose the real workspace path to child prompts

OpenClaw: Feishu dynamic-agent bindings could miss configWrites enforcement

OpenClaw: Slack and Zalo webhook secrets could remain active after secrets.reload

OpenClaw: MCP loopback could skip owner-only tool policy for non-owner callers

OpenClaw: Combined POSIX shell options could confuse exec revalidation

OpenClaw: Paired nodes could forge exec lifecycle events without system.run provenance

OpenClaw: Mattermost slash token revocation could lag until monitor refresh

OpenClaw: Matrix allowFrom could bind to mutable display names

From the blog

What's new: open corpus, three new MCP tools, vendor advisories, package pages

Wiring VulnSea into an agent: a hands-on tutorial

VulnSea is live