Live CVE & 0day intelligence

Sound the depths of every vulnerability.

Newly released CVEs across every platform — sleek to read, verbose on demand, and served raw as markdown for AI and agent ingestion. Severity reads as depth: the deeper the contact, the graver the threat.

Browse the feed For agents → /llms.txt

Depth = severity + exploitation

HadalCritical and actively exploited (CISA KEV / 0day)
AbyssalCritical with a public exploit or in-the-wild use
MidnightCritical, or high with PoC / in-the-wild
TwilightHigh severity, or a signal on a lesser flaw
SunlitLow / medium · no exploitation signal

32792

Tracked CVEs

3257

Critical

405

Exploited in wild

3614

Last 7 days

Trending now

Bluesky + Hacker News mentions, last 7 days

1CVE-2026-85046High· 8.8Type confusion in V8 in Google Chrome prior to 152.0.7977.82 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page874
2CVE-2026-58704High· 8.8In Cellular Modem, there is a possible permission bypass due to a logic error in the code373
3CVE-2026-69836Critical· 10.0Microsoft Entra ID Remote Code Execution Vulnerability267
4CVE-2026-66747Critical· 9.8Zbtlink router firmware ships an embedded remote-control implant, ENDLESSDOORS, present in every published build across the product line266
5CVE-2026-18963Critical· 9.1A flaw was found in the reset-credentials flow of the keycloak-services component, which is the core engine for identity and access management in Red Hat Build of Keycloak263

This week's digest →All digests

Feed

63 matches

CVE-2026-90555Medium· 6.5

1w ago

vLLM versions before 0.28.0 fail to validate audio sample rate headers in the transcription endpoint, allowing authenticated clients to bypass duration checks

vLLM versions before 0.28.0 fail to validate audio sample rate headers in the transcription endpoint, allowing authenticated clients to bypass duration checks. Attackers can submit forged FLAC headers with inflated sample rates to trigge…

▾ Sunlitvllm · vllmEPSS 0.29%via NVD

CVE-2026-90554Medium· 6.2

1w ago

vLLM versions >=0.10.2 and <0.28.0 do not apply any audio decode-size or duration limit when extracting audio from video input for NanoNemotronVL models

vLLM versions >=0.10.2 and <0.28.0 do not apply any audio decode-size or duration limit when extracting audio from video input for NanoNemotronVL models. In nano_nemotron_vl.py, _extract_audio_from_videos calls load_audio_pyav(BytesIO(vi…

▾ Sunlitvllm · vllmEPSS 0.16%via NVD

CVE-2026-90553High· 7.8

1w ago

vLLM before 0.28.0 contains a remote code execution vulnerability in the LlavaOnevision2 processor loader that ignores the trust_remote_code parameter when loading remote processor classes

vLLM before 0.28.0 contains a remote code execution vulnerability in the LlavaOnevision2 processor loader that ignores the trust_remote_code parameter when loading remote processor classes. Attackers can craft a malicious model with arbi…

▾ Twilightvllm · vllmEPSS 0.21%via NVD

CVE-2026-73560Medium· 6.5

1mo ago

vLLM is an inference and serving engine for large language models

vLLM is an inference and serving engine for large language models. Prior to 0.26.0, the MiMoV2OmniMultiModalProcessor in vllm/transformers_utils/processors/mimo_v2_omni.py passes attacker-controlled image and audio strings through _fetch…

▾ Sunlitvllm · vllmEPSS 0.32%via NVD

CVE-2026-71486Medium· 4.3

1mo ago

vLLM is an inference and serving engine for large language models

vLLM is an inference and serving engine for large language models. Prior to 0.26.0, the /v1/completions/derender and /v1/chat/completions/derender endpoints accept caller-supplied GenerateResponse objects whose generate_responses, choice…

▾ Sunlitvllm · vllmEPSS 0.34%via NVD

CVE-2026-73558Medium· 5.3

1mo ago

vLLM is an inference and serving engine for large language models

vLLM is an inference and serving engine for large language models. Prior to 0.27.0, an integer overflow in blockIdx.x * 2 * d in activation_kernels.cu can cause act_and_mul_kernel to consume another batched user's input, allowing a reque…

▾ Sunlitvllm · vllmEPSS 0.33%via NVD

CVE-2026-73555Medium· 5.3

1mo ago

vLLM is an inference and serving engine for large language models

vLLM is an inference and serving engine for large language models. Prior to 0.26.0, the validation_exception_handler in vllm/entrypoints/openai/server_utils.py converts FastAPI RequestValidationError objects with str(exc), and sanitize_m…

▾ Sunlitvllm · vllmEPSS 0.26%via NVD

CVE-2026-73556Medium· 5.3⚖ disputed

1mo ago

vLLM is an inference and serving engine for large language models

vLLM is an inference and serving engine for large language models. Prior to 0.26.0, the structured_outputs.regex parameter in vllm/v1/structured_output/backend_lm_format_enforcer.py is passed to lmformatenforcer.RegexParser without compi…

▾ Sunlitvllm · vllmEPSS 0.32%via NVD

CVE-2026-73557Medium

1mo ago

vLLM is an inference and serving engine for large language models

vLLM is an inference and serving engine for large language models. From 0.20.2rc0 until 0.26.0, safe_load_prompt_embeds in vllm/renderers/embed_utils.py uses torch.sparse.check_sparse_tensor_invariants, whose process-global save, enable,…

▾ Sunlitvllm · vllmEPSS 0.25%via NVD

CVE-2026-73559Medium· 6.5

1mo ago

vLLM is an inference and serving engine for large language models

vLLM is an inference and serving engine for large language models. From 0.19.0 until 0.26.0, the /v1/completions CompletionRequest.prompt field in vllm/entrypoints/openai/completion/protocol.py accepts an unbounded list[str] or list[list…

▾ Sunlitvllm · vllmEPSS 0.47%via NVD

CVE-2026-55514High· 6.5

2mo ago

vLLM denial of service via prompt embeds on M-RoPE models

▾ Twilightvllm · vllmEPSS 0.66%via OSV

CVE-2026-55646Medium· 6.5

2mo ago

vLLM is an inference and serving engine for large language models. From 0.22.0 to 0.23.0, the /v1/audio/transcriptions and /v1/audio/tran…

vLLM is an inference and serving engine for large language models. From 0.22.0 to 0.23.0, the /v1/audio/transcriptions and /v1/audio/translations routes call request.file.read() to fully materialize an uploaded audio file into memory bef…

▾ Sunlitvllm · vllmEPSS 0.52%via OSV

CVE-2026-48746Critical· 9.1PoC

3mo ago

vLLM is an inference and serving engine for large language models (LLMs)

vLLM is an inference and serving engine for large language models (LLMs). From 0.3.0 until 0.22.0, a vulnerability in ASGI web servers and starlette's trust on those web servers enables an authentication bypass of the OpenAI API Authenti…

▾ Abyssalvllm · vllmEPSS 1.2%via NVD

CVE-2026-56340High· 8.8

3mo ago

vLLM versions >= 0.10.2 and < 0.13.0 are missing sparse tensor validation in multimodal embeddings processing

vLLM versions >= 0.10.2 and < 0.13.0 are missing sparse tensor validation in multimodal embeddings processing. Because PyTorch disables sparse tensor invariant checks by default, an attacker can submit crafted embedding requests with mal…

▾ Twilightvllm · vllmEPSS 0.64%via NVD

GHSA-78fp-cf4h-g36pHigh· 8.8

3mo ago

Duplicate Advisory: vLLM introduced enhanced protection for CVE-2025-62164

▾ Twilightvllm · vllmvia GHSA

GHSA-vfm7-4h43-gp6mMedium· 4.3

3mo ago

Duplicate Advisory: vLLM Vulnerable to Regular Expression Denial of Service

▾ Sunlitvllm · vllmvia GHSA

CVE-2026-54235Medium· 6.5

3mo ago

vLLM: temperature=NaN and temperature=Infinity bypass validation and propagate to GPU kernels

▾ Sunlitvllm · vllmEPSS 0.45%via OSV

CVE-2026-12491Medium· 4.8

3mo ago

vLLM: image EXIF Rotation & PNG tRNS Transparency Not Normalized, Causing Mismatch Between Model Input and Expectations

▾ Sunlitvllm · vllmEPSS 0.24%via OSV

CVE-2026-53923High· 7.5

3mo ago

vLLM: GGUF dequantize kernel int truncation exposes uninitialized GPU memory in multi-tenant serving

▾ Twilightvllm · vllmEPSS 0.48%via OSV

CVE-2026-54236Medium· 5.3PoC

3mo ago

vLLM: incomplete CVE-2026-22778 fix leaks PIL repr addresses via Anthropic router

▾ Twilightvllm · vllmEPSS 0.93%via OSV

CVE-2026-54233Medium· 6.5

3mo ago

vLLM: OOM Denial of Service via Audio Decompression Bomb

▾ Sunlitvllm · vllmEPSS 0.42%via OSV

GHSA-x8xr-mj9x-6h7wMedium· 4.8

3mo ago

Duplicate Advisory: image EXIF Rotation & PNG tRNS Transparency Not Normalized, Causing Mismatch Between Model Input and Expectations

▾ Sunlitvllm · vllmvia GHSA

CVE-2026-5497High· 7.5

3mo ago

vLLM versions 0.8.0 and later are vulnerable to an Out-of-Memory (OOM) Denial of Service (DoS) attack due to unbounded frame count processing in the `VideoMediaIO.load_base64()` method

vLLM versions 0.8.0 and later are vulnerable to an Out-of-Memory (OOM) Denial of Service (DoS) attack due to unbounded frame count processing in the `VideoMediaIO.load_base64()` method. When processing `video/jpeg` data URLs, the method …

▾ Twilightvllm · vllmEPSS 0.54%via NVD

CVE-2026-9540Medium· 5.3

4mo ago

vllm has Improper Resource Shutdown or Release

▾ Sunlitvllm · vllmEPSS 0.43%via OSV

CVE-2026-44222Medium· 6.5

4mo ago

vLLM Vulnerable to Remote DoS via Special-Token Placeholders

▾ Sunlitvllm · vllmEPSS 0.41%via OSV

From the blog

All posts →

Sep 8, 2026

Sound the depths of every vulnerability.

Trending now

Feed

vLLM versions before 0.28.0 fail to validate audio sample rate headers in the transcription endpoint, allowing authenticated clients to bypass duration checks

vLLM versions >=0.10.2 and <0.28.0 do not apply any audio decode-size or duration limit when extracting audio from video input for NanoNemotronVL models

vLLM before 0.28.0 contains a remote code execution vulnerability in the LlavaOnevision2 processor loader that ignores the trust_remote_code parameter when loading remote processor classes

vLLM is an inference and serving engine for large language models

vLLM is an inference and serving engine for large language models

vLLM is an inference and serving engine for large language models

vLLM is an inference and serving engine for large language models

vLLM is an inference and serving engine for large language models

vLLM is an inference and serving engine for large language models

vLLM is an inference and serving engine for large language models

vLLM denial of service via prompt embeds on M-RoPE models

vLLM is an inference and serving engine for large language models. From 0.22.0 to 0.23.0, the /v1/audio/transcriptions and /v1/audio/tran…

vLLM is an inference and serving engine for large language models (LLMs)

vLLM versions >= 0.10.2 and < 0.13.0 are missing sparse tensor validation in multimodal embeddings processing

Duplicate Advisory: vLLM introduced enhanced protection for CVE-2025-62164

Duplicate Advisory: vLLM Vulnerable to Regular Expression Denial of Service

vLLM: temperature=NaN and temperature=Infinity bypass validation and propagate to GPU kernels

vLLM: image EXIF Rotation & PNG tRNS Transparency Not Normalized, Causing Mismatch Between Model Input and Expectations

vLLM: GGUF dequantize kernel int truncation exposes uninitialized GPU memory in multi-tenant serving

vLLM: incomplete CVE-2026-22778 fix leaks PIL repr addresses via Anthropic router

vLLM: OOM Denial of Service via Audio Decompression Bomb

Duplicate Advisory: image EXIF Rotation & PNG tRNS Transparency Not Normalized, Causing Mismatch Between Model Input and Expectations

vLLM versions 0.8.0 and later are vulnerable to an Out-of-Memory (OOM) Denial of Service (DoS) attack due to unbounded frame count processing in the `VideoMediaIO.load_base64()` method

vllm has Improper Resource Shutdown or Release

vLLM Vulnerable to Remote DoS via Special-Token Placeholders

From the blog

What's new: open corpus, three new MCP tools, vendor advisories, package pages

Wiring VulnSea into an agent: a hands-on tutorial

VulnSea is live

Sound the depths of every vulnerability.

Trending now

Feed

vLLM versions before 0.28.0 fail to validate audio sample rate headers in the transcription endpoint, allowing authenticated clients to bypass duration checks

vLLM versions >=0.10.2 and <0.28.0 do not apply any audio decode-size or duration limit when extracting audio from video input for NanoNemotronVL models

vLLM before 0.28.0 contains a remote code execution vulnerability in the LlavaOnevision2 processor loader that ignores the trust_remote_code parameter when loading remote processor classes

vLLM is an inference and serving engine for large language models

vLLM is an inference and serving engine for large language models

vLLM is an inference and serving engine for large language models

vLLM is an inference and serving engine for large language models

vLLM is an inference and serving engine for large language models

vLLM is an inference and serving engine for large language models

vLLM is an inference and serving engine for large language models

vLLM denial of service via prompt embeds on M-RoPE models

vLLM is an inference and serving engine for large language models. From 0.22.0 to 0.23.0, the /v1/audio/transcriptions and /v1/audio/tran…

vLLM is an inference and serving engine for large language models (LLMs)

vLLM versions >= 0.10.2 and < 0.13.0 are missing sparse tensor validation in multimodal embeddings processing

Duplicate Advisory: vLLM introduced enhanced protection for CVE-2025-62164

Duplicate Advisory: vLLM Vulnerable to Regular Expression Denial of Service

vLLM: temperature=NaN and temperature=Infinity bypass validation and propagate to GPU kernels

vLLM: image EXIF Rotation & PNG tRNS Transparency Not Normalized, Causing Mismatch Between Model Input and Expectations

vLLM: GGUF dequantize kernel int truncation exposes uninitialized GPU memory in multi-tenant serving

vLLM: incomplete CVE-2026-22778 fix leaks PIL repr addresses via Anthropic router

vLLM: OOM Denial of Service via Audio Decompression Bomb

Duplicate Advisory: image EXIF Rotation & PNG tRNS Transparency Not Normalized, Causing Mismatch Between Model Input and Expectations

vLLM versions 0.8.0 and later are vulnerable to an Out-of-Memory (OOM) Denial of Service (DoS) attack due to unbounded frame count processing in the `VideoMediaIO.load_base64()` method

vllm has Improper Resource Shutdown or Release

vLLM Vulnerable to Remote DoS via Special-Token Placeholders

From the blog

What's new: open corpus, three new MCP tools, vendor advisories, package pages

Wiring VulnSea into an agent: a hands-on tutorial

VulnSea is live