Live CVE & 0day intelligence

Sound the depths of every vulnerability.

Newly released CVEs across every platform — sleek to read, verbose on demand, and served raw as markdown for AI and agent ingestion. Severity reads as depth: the deeper the contact, the graver the threat.

Browse the feed For agents → /llms.txt

Depth = severity + exploitation

HadalCritical and actively exploited (CISA KEV / 0day)
AbyssalCritical with a public exploit or in-the-wild use
MidnightCritical, or high with PoC / in-the-wild
TwilightHigh severity, or a signal on a lesser flaw
SunlitLow / medium · no exploitation signal

34757

Tracked CVEs

3387

Critical

421

Exploited in wild

4825

Last 7 days

Trending now

Bluesky + Hacker News mentions, last 7 days

1CVE-2026-58704High· 8.8In Cellular Modem, there is a possible permission bypass due to a logic error in the code374
2CVE-2026-69836Critical· 10.0Microsoft Entra ID Remote Code Execution Vulnerability267
3CVE-2026-66747Critical· 9.8Zbtlink router firmware ships an embedded remote-control implant, ENDLESSDOORS, present in every published build across the product line266
4CVE-2026-18963Critical· 9.1A flaw was found in the reset-credentials flow of the keycloak-services component, which is the core engine for identity and access management in Red Hat Build of Keycloak263

This week's digest →All digests

Feed

19 matches

CVE-2026-48169High· 8.8

1mo ago

PraisonAI is a multi-agent teams system

PraisonAI is a multi-agent teams system. Versions prior to 0.1.4 of the PraisonAI Platform API have two authorization failures that together break workspace isolation. The service layer for issues and projects performs global primary-key…

▾ Twilightpraisonai-platform · praisonai-platformEPSS 0.44%via NVD

CVE-2026-57121High· 8.1

3mo ago

PraisonAI: Missing ownership check on DELETE endpoints allows members to delete others' content in Platform API

▾ Twilightpraisonai-platform · praisonai-platformvia OSV

CVE-2026-58653Medium· 4.3

3mo ago

praisonai-platform: Authorization Bypass Through User-Controlled Key

▾ Sunlitpraisonai-platform · praisonai-platformEPSS 0.26%via OSV

GHSA-rh39-9c67-59mhHigh· 8.1

3mo ago

PraisonAI: Missing ownership check on DELETE endpoints allows members to delete others' content in Platform API

▾ Twilightpraisonai-platform · praisonai-platformvia GHSA

GHSA-f38v-77qj-h4jqCritical· 9.8

3mo ago

praisonai-platform 0.1.4 still boots on the hardcoded JWT secret dev-secret-change-me (default-open production guard)

▾ Midnightpraisonai-platform · praisonai-platformvia GHSA

GHSA-cwj8-7gp2-ggcwCritical· 9.8

3mo ago

praisonai-platform: default JWT signing secret 'dev-secret-change-me' enables token forgery

▾ Midnightpraisonai-platform · praisonai-platformvia GHSA

GHSA-2fjj-qqg8-fg7xMedium· 4.3

3mo ago

praisonai-platform: Authorization Bypass Through User-Controlled Key

▾ Sunlitpraisonai-platform · praisonai-platformvia GHSA

CVE-2026-47419High· 8.3

3mo ago

praisonai-platform: Agent endpoints accept any agent_id without workspace ownership check, cross-workspace read/update/delete IDOR

▾ Twilightpraisonai-platform · praisonai-platformEPSS 0.39%via OSV

CVE-2026-47415High· 8.3

3mo ago

praisonai-platform: Issue endpoints accept any issue_id without workspace ownership check, cross-workspace read/update/delete IDOR

▾ Twilightpraisonai-platform · praisonai-platformEPSS 0.39%via OSV

CVE-2026-47411Medium· 6.5

3mo ago

praisonai-platform: Any workspace member can rewrite workspace name, description, and settings via PATCH /workspaces/{id}

▾ Sunlitpraisonai-platform · praisonai-platformEPSS 0.34%via OSV

CVE-2026-47412High· 8.1

3mo ago

praisonai-platform: Any workspace member can delete the entire workspace via DELETE /workspaces/{id}

▾ Twilightpraisonai-platform · praisonai-platformEPSS 0.53%via OSV

CVE-2026-47417High· 8.1

3mo ago

praisonai-platform: Comment endpoints accept any issue_id without workspace ownership check, cross-workspace comment read and post IDOR

▾ Twilightpraisonai-platform · praisonai-platformEPSS 0.36%via OSV

CVE-2026-47418High· 8.1

3mo ago

praisonai-platform: Project endpoints accept any project_id without workspace ownership check, cross-workspace read/update/delete IDOR

▾ Twilightpraisonai-platform · praisonai-platformEPSS 0.41%via OSV

CVE-2026-47409High· 8.1

4mo ago

praisonai-platform: Missing authorization on member removal enables full workspace takeover by any user regardless of role

▾ Twilightpraisonai-platform · praisonai-platformEPSS 0.53%via OSV

CVE-2026-47405High· 8.8

4mo ago

PraisonAI Platform: Missing role checks let any workspace member become owner and control workspace membership

▾ Twilightpraisonai-platform · praisonai-platformEPSS 0.51%via OSV

CVE-2026-47399High· 8.8

4mo ago

PraisonAI Platform workspace-scoped routes allow cross-workspace object access by global object ID

▾ Twilightpraisonai-platform · praisonai-platformEPSS 0.51%via OSV

CVE-2026-47414High· 7.6

4mo ago

praisonai-platform: Label endpoints' unchecked label_id/issue_id enable cross-workspace label IDOR (edit, delete, link)

▾ Twilightpraisonai-platform · praisonai-platformEPSS 0.38%via OSV

CVE-2026-47406High· 8.1

4mo ago

praisonai-platform: IDOR in dependency endpoints allows cross-workspace issue linking, reading, and deletion due to missing ownership checks

▾ Twilightpraisonai-platform · praisonai-platformEPSS 0.41%via OSV

CVE-2026-47408Medium· 6.5

4mo ago

praisonai-platform: list_issue_activity returns activity log for any issue regardless of workspace ownership

▾ Sunlitpraisonai-platform · praisonai-platformEPSS 0.40%via OSV

From the blog

All posts →

Sep 8, 2026

What's new: open corpus, three new MCP tools, vendor advisories, package pages

A summary of everything that shipped over the last two weeks — the whole corpus is open, agents get change feeds, alias resolution and EPSS movers, and the data now includes CVE.org, vendor CSAF, aggregated exploits and per-source scores.

Jul 1, 2026

Wiring VulnSea into an agent: a hands-on tutorial

A step-by-step guide to plugging VulnSea into automated and agentic workflows — poll the delta, triage without burning tokens, match an SBOM, and let an MCP-native model do the reasoning.

Jun 29, 2026

VulnSea is live

CVE and 0day intelligence that reads like an instrument — built for analysts and AI agents alike. Here's what it does and where it's going.