Live CVE & 0day intelligence

Sound the depths of every vulnerability.

Newly released CVEs across every platform — sleek to read, verbose on demand, and served raw as markdown for AI and agent ingestion. Severity reads as depth: the deeper the contact, the graver the threat.

Browse the feed For agents → /llms.txt

Depth = severity + exploitation

HadalCritical and actively exploited (CISA KEV / 0day)
AbyssalCritical with a public exploit or in-the-wild use
MidnightCritical, or high with PoC / in-the-wild
TwilightHigh severity, or a signal on a lesser flaw
SunlitLow / medium · no exploitation signal

30281

Tracked CVEs

2970

Critical

375

Exploited in wild

5263

Last 7 days

Trending now

Bluesky + Hacker News mentions, last 7 days

1CVE-2026-85046High· 8.8Type confusion in V8 in Google Chrome prior to 152.0.7977.82 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page874
2CVE-2026-58704High· 8.8In Cellular Modem, there is a possible permission bypass due to a logic error in the code373
3CVE-2026-69836Critical· 10.0Microsoft Entra ID Remote Code Execution Vulnerability267
4CVE-2026-66747Critical· 9.8Zbtlink router firmware ships an embedded remote-control implant, ENDLESSDOORS, present in every published build across the product line266
5CVE-2026-18963Critical· 9.1A flaw was found in the reset-credentials flow of the keycloak-services component, which is the core engine for identity and access management in Red Hat Build of Keycloak263

This week's digest →All digests

Feed

16 matches

CVE-2026-44432High· 7.5

4mo ago

urllib3 is an HTTP client library for Python

urllib3 is an HTTP client library for Python. From 2.6.0 to before 2.7.0, urllib3 could decompress the whole response instead of the requested portion (1) during the second HTTPResponse.read(amt=N) call when the response was decompressed…

▾ Twilightpython · urllib3EPSS 0.68%via NVD

CVE-2026-7210High· 7.5⚖ disputed

4mo ago

`xml.parsers.expat` and `xml.etree.ElementTree` use insufficient entropy for Expat hash-flooding protection, which allows a crafted XML document to trigger hash flooding.\r\n\r\nFully mitigating this vulnerability requires both updating …

`xml.parsers.expat` and `xml.etree.ElementTree` use insufficient entropy for Expat hash-flooding protection, which allows a crafted XML document to trigger hash flooding.\r\n\r\nFully mitigating this vulnerability requires both updating …

▾ Twilightpython · pythonEPSS 0.67%via NVD

CVE-2026-3087High· 7.5

4mo ago

If `shutil.unpack_archive()` is given a ZIP archive with an absolute Windows path containing a drive (`C:\\...`) then the archive will be extracted outside the target directory which is different than other operating systems

If `shutil.unpack_archive()` is given a ZIP archive with an absolute Windows path containing a drive (`C:\\...`) then the archive will be extracted outside the target directory which is different than other operating systems. Only Window…

▾ Twilightpython · pythonEPSS 0.55%via NVD

CVE-2026-6019Medium· 6.1

5mo ago

http.cookies.Morsel.js_output() returns an inline <script> snippet and only escapes " for JavaScript string context

http.cookies.Morsel.js_output() returns an inline <script> snippet and only escapes " for JavaScript string context. It does not neutralize the HTML parser-sensitive sequence </script> inside the generated script element. Mitigation base…

▾ Sunlitpython · pythonEPSS 0.21%via NVD

CVE-2026-40192High· 7.5

5mo ago

Pillow is a Python imaging library

Pillow is a Python imaging library. Versions 10.3.0 through 12.1.1 did not limit the amount of GZIP-compressed data read when decoding a FITS image, making them vulnerable to decompression bomb attacks. A specially crafted FITS file coul…

▾ Twilightpython · pillowEPSS 0.67%via NVD

CVE-2026-4519Low· 3.3

6mo ago

The webbrowser.open() API would accept leading dashes in the URL which could be handled as command line options for certain web browsers

The webbrowser.open() API would accept leading dashes in the URL which could be handled as command line options for certain web browsers. New behavior rejects leading dashes. Users are recommended to sanitize URLs prior to passing to …

▾ Sunlitpython · pythonEPSS 0.31%via NVD

CVE-2026-4224High· 7.5

6mo ago

When an Expat parser with a registered ElementDeclHandler parses an inline document type definition containing a deeply nested content model a C stack overflow occurs.

▾ Twilightpython · pythonEPSS 0.69%via NVD

CVE-2026-3644High· 7.5

6mo ago

The fix for CVE-2026-0672, which rejected control characters in http.cookies.Morsel, was incomplete

The fix for CVE-2026-0672, which rejected control characters in http.cookies.Morsel, was incomplete. The Morsel.update(), |= operator, and unpickling paths were not patched, allowing control characters to bypass input validation. Additio…

▾ Twilightpython · pythonEPSS 0.48%via NVD

CVE-2025-13462Low· 3.3

6mo ago

The "tarfile" module would still apply normalization of AREGTYPE (\x00) blocks to DIRTYPE, even while processing a multi-block member such as GNUTYPE_LONGNAME or GNUTYPE_LONGLINK

The "tarfile" module would still apply normalization of AREGTYPE (\x00) blocks to DIRTYPE, even while processing a multi-block member such as GNUTYPE_LONGNAME or GNUTYPE_LONGLINK. This could result in a crafted tar archive being misinter…

▾ Sunlitpython · pythonEPSS 0.16%via NVD

CVE-2026-25990High· 7.5

7mo ago

Pillow is a Python imaging library

Pillow is a Python imaging library. From 10.3.0 to before 12.1.1, an out-of-bounds write may be triggered when loading a specially crafted PSD image. This vulnerability is fixed in 12.1.1.

▾ Twilightpython · pillowEPSS 0.37%via NVD

CVE-2026-21441High· 7.5

8mo ago

urllib3 is an HTTP client library for Python

urllib3 is an HTTP client library for Python. urllib3's streaming API is designed for the efficient handling of large HTTP responses by reading the content in chunks, rather than loading the entire response body into memory at once. urll…

▾ Twilightpython · urllib3EPSS 3.0%via NVD

CVE-2025-13837Medium· 5.5

9mo ago

When loading a plist file, the plistlib module reads data in size specified by the file itself, meaning a malicious file can cause OOM and DoS issues

▾ Sunlitpython · pythonEPSS 0.22%via NVD

CVE-2025-13836High· 7.5

9mo ago

When reading an HTTP response from a server, if no read amount is specified, the default behavior will be to use Content-Length

When reading an HTTP response from a server, if no read amount is specified, the default behavior will be to use Content-Length. This allows a malicious server to cause the client to read large amounts of data into memory, potentially ca…

▾ Twilightpython · pythonEPSS 1.6%via NVD

CVE-2025-6075Medium· 5.5

10mo ago

If the value passed to os.path.expandvars() is user-controlled a performance degradation is possible when expanding environment variables.

▾ Sunlitpython · pythonEPSS 0.14%via NVD

CVE-2025-48379High· 7.1

1y ago

Pillow is a Python imaging library

Pillow is a Python imaging library. In versions 11.2.0 to before 11.3.0, there is a heap buffer overflow when writing a sufficiently large (>64k encoded with default settings) image in the DDS format due to writing into a buffer without …

▾ Twilightpython · pillowEPSS 0.30%via NVD

CVE-2023-6507Medium· 6.1

2y ago

An issue was found in CPython 3.12.0 `subprocess` module on POSIX platforms

An issue was found in CPython 3.12.0 `subprocess` module on POSIX platforms. The issue was fixed in CPython 3.12.1 and does not affect other stable releases. When using the `extra_groups=` parameter with an empty list as a value (ie `ex…

▾ Sunlitpython · pythonEPSS 1.3%via NVD

From the blog

All posts →

Sep 8, 2026

Sound the depths of every vulnerability.

Trending now

Feed

urllib3 is an HTTP client library for Python

`xml.parsers.expat` and `xml.etree.ElementTree` use insufficient entropy for Expat hash-flooding protection, which allows a crafted XML document to trigger hash flooding.\r\n\r\nFully mitigating this vulnerability requires both updating …

If `shutil.unpack_archive()` is given a ZIP archive with an absolute Windows path containing a drive (`C:\\...`) then the archive will be extracted outside the target directory which is different than other operating systems

http.cookies.Morsel.js_output() returns an inline <script> snippet and only escapes " for JavaScript string context

Pillow is a Python imaging library

The webbrowser.open() API would accept leading dashes in the URL which could be handled as command line options for certain web browsers

When an Expat parser with a registered ElementDeclHandler parses an inline document type definition containing a deeply nested content model a C stack overflow occurs.

The fix for CVE-2026-0672, which rejected control characters in http.cookies.Morsel, was incomplete

The "tarfile" module would still apply normalization of AREGTYPE (\x00) blocks to DIRTYPE, even while processing a multi-block member such as GNUTYPE_LONGNAME or GNUTYPE_LONGLINK

Pillow is a Python imaging library

urllib3 is an HTTP client library for Python

When loading a plist file, the plistlib module reads data in size specified by the file itself, meaning a malicious file can cause OOM and DoS issues

When reading an HTTP response from a server, if no read amount is specified, the default behavior will be to use Content-Length

If the value passed to os.path.expandvars() is user-controlled a performance degradation is possible when expanding environment variables.

Pillow is a Python imaging library

An issue was found in CPython 3.12.0 `subprocess` module on POSIX platforms

From the blog

What's new: open corpus, three new MCP tools, vendor advisories, package pages

Wiring VulnSea into an agent: a hands-on tutorial

VulnSea is live

Sound the depths of every vulnerability.

Trending now

Feed

urllib3 is an HTTP client library for Python

`xml.parsers.expat` and `xml.etree.ElementTree` use insufficient entropy for Expat hash-flooding protection, which allows a crafted XML document to trigger hash flooding.\r\n\r\nFully mitigating this vulnerability requires both updating …

If `shutil.unpack_archive()` is given a ZIP archive with an absolute Windows path containing a drive (`C:\\...`) then the archive will be extracted outside the target directory which is different than other operating systems

http.cookies.Morsel.js_output() returns an inline <script> snippet and only escapes " for JavaScript string context

Pillow is a Python imaging library

The webbrowser.open() API would accept leading dashes in the URL which could be handled as command line options for certain web browsers

When an Expat parser with a registered ElementDeclHandler parses an inline document type definition containing a deeply nested content model a C stack overflow occurs.

The fix for CVE-2026-0672, which rejected control characters in http.cookies.Morsel, was incomplete

The "tarfile" module would still apply normalization of AREGTYPE (\x00) blocks to DIRTYPE, even while processing a multi-block member such as GNUTYPE_LONGNAME or GNUTYPE_LONGLINK

Pillow is a Python imaging library

urllib3 is an HTTP client library for Python

When loading a plist file, the plistlib module reads data in size specified by the file itself, meaning a malicious file can cause OOM and DoS issues

When reading an HTTP response from a server, if no read amount is specified, the default behavior will be to use Content-Length

If the value passed to os.path.expandvars() is user-controlled a performance degradation is possible when expanding environment variables.

Pillow is a Python imaging library

An issue was found in CPython 3.12.0 `subprocess` module on POSIX platforms

From the blog

What's new: open corpus, three new MCP tools, vendor advisories, package pages

Wiring VulnSea into an agent: a hands-on tutorial

VulnSea is live