Live CVE & 0day intelligence

Sound the depths of every vulnerability.

Newly released CVEs across every platform — sleek to read, verbose on demand, and served raw as markdown for AI and agent ingestion. Severity reads as depth: the deeper the contact, the graver the threat.

Browse the feed For agents → /llms.txt

Depth = severity + exploitation

HadalCritical and actively exploited (CISA KEV / 0day)
AbyssalCritical with a public exploit or in-the-wild use
MidnightCritical, or high with PoC / in-the-wild
TwilightHigh severity, or a signal on a lesser flaw
SunlitLow / medium · no exploitation signal

34463

Tracked CVEs

3360

Critical

418

Exploited in wild

4619

Last 7 days

Trending now

Bluesky + Hacker News mentions, last 7 days

1CVE-2026-85046High· 8.8Type confusion in V8 in Google Chrome prior to 152.0.7977.82 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page883
2CVE-2026-58704High· 8.8In Cellular Modem, there is a possible permission bypass due to a logic error in the code373
3CVE-2026-69836Critical· 10.0Microsoft Entra ID Remote Code Execution Vulnerability267
4CVE-2026-66747Critical· 9.8Zbtlink router firmware ships an embedded remote-control implant, ENDLESSDOORS, present in every published build across the product line266
5CVE-2026-18963Critical· 9.1A flaw was found in the reset-credentials flow of the keycloak-services component, which is the core engine for identity and access management in Red Hat Build of Keycloak263

This week's digest →All digests

Feed

10 matches

CVE-2025-55124Medium· 6.1

10mo ago

Improper neutralisation of input in Revive Adserver 6.0.0+ causes a reflected XSS attack in the banner-zone.php script.

▾ Sunlitrevive-adserver · revive_adserverEPSS 0.41%via NVD

CVE-2025-55123Medium· 5.4

10mo ago

Improper neutralization of input in Revive Adserver 5.5.2 and 6.0.1 and earlier versions causes manager accounts to be able to craft XSS attacks to their own advertiser users.

▾ Sunlitrevive-adserver · revive_adserverEPSS 0.45%via NVD

CVE-2025-52671Medium· 4.3

10mo ago

Debug information disclosure in the SQL error message to in Revive Adserver 5.5.2 and 6.0.1 and earlier versions causes non-admin users to acquire information about the software, PHP and database versions currently in use.

Debug information disclosure in the SQL error message to in Revive Adserver 5.5.2 and 6.0.1 and earlier versions causes non-admin users to acquire information about the software, PHP and database versions currently in use.

▾ Sunlitrevive-adserver · revive_adserverEPSS 0.35%via NVD

CVE-2025-52670Medium· 6.5

10mo ago

Missing authorization check in Revive Adserver 5.5.2 and 6.0.1 and earlier versions causes users on the system to delete banners owned by other accounts

▾ Sunlitrevive-adserver · revive_adserverEPSS 0.32%via NVD

CVE-2025-52669Medium· 4.3

10mo ago

Insecure design policies in the user management system of Revive Adserver 5.5.2 and 6.0.1 and earlier versions causes non-admin users to have access to the contact name and email address of other users on the system.

Insecure design policies in the user management system of Revive Adserver 5.5.2 and 6.0.1 and earlier versions causes non-admin users to have access to the contact name and email address of other users on the system.

▾ Sunlitrevive-adserver · revive_adserverEPSS 0.29%via NVD

CVE-2025-52668Medium· 5.4

10mo ago

Improper input neutralization in the stats-conversions.php script in Revive Adserver 5.5.2 and 6.0.1 and earlier versions causes potential information disclosure and session hijacking via a stored XSS attack.

Improper input neutralization in the stats-conversions.php script in Revive Adserver 5.5.2 and 6.0.1 and earlier versions causes potential information disclosure and session hijacking via a stored XSS attack.

▾ Sunlitrevive-adserver · revive_adserverEPSS 0.53%via NVD

CVE-2025-52667Medium· 5.4

10mo ago

Missing JSON Content-Type header in a script in Revive Adserver 6.0.1 and 5.5.2 and earlier versions causes a stored XSS attack to be possible for a logged in manager user.

▾ Sunlitrevive-adserver · revive_adserverEPSS 0.37%via NVD

CVE-2025-52666Low· 2.7

10mo ago

Improper neutralisation of format characters in the settings of Revive Adserver 5.5.2 and 6.0.1 and earlier versions causes an administrator user to disable the admin user console due to a fatal PHP error.

Improper neutralisation of format characters in the settings of Revive Adserver 5.5.2 and 6.0.1 and earlier versions causes an administrator user to disable the admin user console due to a fatal PHP error.

▾ Sunlitrevive-adserver · revive_adserverEPSS 0.42%via NVD

CVE-2025-48987Medium· 6.1

10mo ago

Improper Neutralization of Input in Revive Adserver 5.5.2 and 6.0.1 and earlier versions causes a potential reflected XSS attack.

▾ Sunlitrevive-adserver · revive_adserverEPSS 0.51%via NVD

CVE-2025-48986High· 8.8

10mo ago

Authorization bypass in Revive Adserver 5.5.2 and 6.0.1 and earlier versions causes an logged in attacker to change other users' email address and potentialy take over their accounts using the forgot password functionality.

Authorization bypass in Revive Adserver 5.5.2 and 6.0.1 and earlier versions causes an logged in attacker to change other users' email address and potentialy take over their accounts using the forgot password functionality.

▾ Twilightrevive-adserver · revive_adserverEPSS 0.62%via NVD

From the blog

All posts →

Sep 8, 2026

Sound the depths of every vulnerability.

Trending now

Feed

Improper neutralisation of input in Revive Adserver 6.0.0+ causes a reflected XSS attack in the banner-zone.php script.

Improper neutralization of input in Revive Adserver 5.5.2 and 6.0.1 and earlier versions causes manager accounts to be able to craft XSS attacks to their own advertiser users.

Debug information disclosure in the SQL error message to in Revive Adserver 5.5.2 and 6.0.1 and earlier versions causes non-admin users to acquire information about the software, PHP and database versions currently in use.

Missing authorization check in Revive Adserver 5.5.2 and 6.0.1 and earlier versions causes users on the system to delete banners owned by other accounts

Insecure design policies in the user management system of Revive Adserver 5.5.2 and 6.0.1 and earlier versions causes non-admin users to have access to the contact name and email address of other users on the system.

Improper input neutralization in the stats-conversions.php script in Revive Adserver 5.5.2 and 6.0.1 and earlier versions causes potential information disclosure and session hijacking via a stored XSS attack.

Missing JSON Content-Type header in a script in Revive Adserver 6.0.1 and 5.5.2 and earlier versions causes a stored XSS attack to be possible for a logged in manager user.

Improper neutralisation of format characters in the settings of Revive Adserver 5.5.2 and 6.0.1 and earlier versions causes an administrator user to disable the admin user console due to a fatal PHP error.

Improper Neutralization of Input in Revive Adserver 5.5.2 and 6.0.1 and earlier versions causes a potential reflected XSS attack.

Authorization bypass in Revive Adserver 5.5.2 and 6.0.1 and earlier versions causes an logged in attacker to change other users' email address and potentialy take over their accounts using the forgot password functionality.

From the blog

What's new: open corpus, three new MCP tools, vendor advisories, package pages

Wiring VulnSea into an agent: a hands-on tutorial

VulnSea is live

Sound the depths of every vulnerability.

Trending now

Feed

Improper neutralisation of input in Revive Adserver 6.0.0+ causes a reflected XSS attack in the banner-zone.php script.

Improper neutralization of input in Revive Adserver 5.5.2 and 6.0.1 and earlier versions causes manager accounts to be able to craft XSS attacks to their own advertiser users.

Debug information disclosure in the SQL error message to in Revive Adserver 5.5.2 and 6.0.1 and earlier versions causes non-admin users to acquire information about the software, PHP and database versions currently in use.

Missing authorization check in Revive Adserver 5.5.2 and 6.0.1 and earlier versions causes users on the system to delete banners owned by other accounts

Insecure design policies in the user management system of Revive Adserver 5.5.2 and 6.0.1 and earlier versions causes non-admin users to have access to the contact name and email address of other users on the system.

Improper input neutralization in the stats-conversions.php script in Revive Adserver 5.5.2 and 6.0.1 and earlier versions causes potential information disclosure and session hijacking via a stored XSS attack.

Missing JSON Content-Type header in a script in Revive Adserver 6.0.1 and 5.5.2 and earlier versions causes a stored XSS attack to be possible for a logged in manager user.

Improper neutralisation of format characters in the settings of Revive Adserver 5.5.2 and 6.0.1 and earlier versions causes an administrator user to disable the admin user console due to a fatal PHP error.

Improper Neutralization of Input in Revive Adserver 5.5.2 and 6.0.1 and earlier versions causes a potential reflected XSS attack.

Authorization bypass in Revive Adserver 5.5.2 and 6.0.1 and earlier versions causes an logged in attacker to change other users' email address and potentialy take over their accounts using the forgot password functionality.

From the blog

What's new: open corpus, three new MCP tools, vendor advisories, package pages

Wiring VulnSea into an agent: a hands-on tutorial

VulnSea is live