Live CVE & 0day intelligence

Sound the depths of every vulnerability.

Newly released CVEs across every platform — sleek to read, verbose on demand, and served raw as markdown for AI and agent ingestion. Severity reads as depth: the deeper the contact, the graver the threat.

Browse the feed For agents → /llms.txt

Depth = severity + exploitation

HadalCritical and actively exploited (CISA KEV / 0day)
AbyssalCritical with a public exploit or in-the-wild use
MidnightCritical, or high with PoC / in-the-wild
TwilightHigh severity, or a signal on a lesser flaw
SunlitLow / medium · no exploitation signal

59244

Tracked CVEs

5447

Critical

561

Exploited in wild

12476

Last 7 days

Trending now

Bluesky + Hacker News mentions, last 7 days

1CVE-2026-88771Critical· 9.8Improper input validation vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway. This issue affects ADC: before 14.1-73.37, before 13.1-64.23, before 14.1-73.37 FIPS, and before 13.1.37.279 FIPS and NDcPP; Gateway: before 1…479

This week's digest →All digests

Feed

9 matches

CVE-2026-103525High· 7.5

today

FluentCart A New Era of eCommerce <= 1.7.0 - Insecure Direct Object Reference to Unauthenticated Sensitive Information Disclosure via 'order_id' and 'billing_address_id' Parameters

The FluentCart A New Era of eCommerce – Faster, Lighter, and Simpler plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.7.0 via the 'order_id + billing_address_id (also shipping…

▾ Twilightwpmanageninja · FluentCart A New Era of eCommerce – Faster, Lighter, and Simplervia CVEORG

CVE-2026-103518Medium· 4.9

today

FluentCart A New Era of eCommerce <= 1.7.0 - Authenticated (Administrator+) SQL Injection via 'products.variants' Array Keys

The FluentCart A New Era of eCommerce – Faster, Lighter, and Simpler plugin for WordPress is vulnerable to generic SQL Injection via the 'products[*].variants[*].<attacker-chosen key>' parameter in all versions up to, and including, 1.7.…

▾ Sunlitwpmanageninja · FluentCart A New Era of eCommerce – Faster, Lighter, and Simplervia CVEORG

CVE-2026-109695High· 7.5

yesterday

Insertion of Sensitive Information Into Sent Data vulnerability in WPManageNinja FluentCart fluent-cart allows Retrieve Embedded Sensitive Data.This issue affects FluentCart: from n/a through 1.7.1.

▾ TwilightWPManageNinja · fluent-cartvia NVD

CVE-2026-108484High· 7.1

2d ago

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPManageNinja Best Payments Plugin for WP wp-payment-form allows Stored XSS.This issue affects Best Payments Plugin for WP: from n/a th…

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPManageNinja Best Payments Plugin for WP wp-payment-form allows Stored XSS.This issue affects Best Payments Plugin for WP: from n/a th…

▾ TwilightWPManageNinja · wp-payment-formvia NVD

CVE-2026-15178Medium· 5.4

6d ago

The Fluent Forms plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 6.2.5

The Fluent Forms plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 6.2.5. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possi…

▾ Sunlitwpmanageninja · Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form BuilderEPSS 0.15%via NVD

CVE-2026-101324Medium· 4.7

6d ago

The Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'any attacker-chosen name matching the {get.NAME} placeholder (PoC us…

The Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'any attacker-chosen name matching the {get.NAME} placeholder (PoC us…

▾ Sunlitwpmanageninja · Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form BuilderEPSS 0.20%via NVD

CVE-2026-94679Medium· 5.4

3w ago

Subscriber Broken Access Control in Fluent Support <= 2.3.2 versions.

▾ SunlitWPManageNinja · fluent-supportEPSS 0.23%via NVD

CVE-2026-73533Critical· 9.8

2mo ago

Ninja Tables Pro 5.2.11 contains an embedded malicious code vulnerability introduced via a tampered plugin build served through a decommissioned update server

Ninja Tables Pro 5.2.11 contains an embedded malicious code vulnerability introduced via a tampered plugin build served through a decommissioned update server. The tampered build introduced a rogue PHP file (app/Library/updater/NinjaTabl…

▾ MidnightWPManageNinja · Ninja Tables ProEPSS 0.65%via NVD

CVE-2026-73532Critical· 9.8

2mo ago

Fluent Forms Pro 6.2.7 contains an embedded malicious code vulnerability introduced via a tampered plugin build served through a decommissioned update server

Fluent Forms Pro 6.2.7 contains an embedded malicious code vulnerability introduced via a tampered plugin build served through a decommissioned update server. The tampered build introduced a rogue PHP file (libs/class-license-sync.php), …

▾ MidnightWPManageNinja · Fluent Forms ProEPSS 0.67%via NVD

From the blog

All posts →

Sep 8, 2026

Sound the depths of every vulnerability.

Trending now

Feed

FluentCart A New Era of eCommerce <= 1.7.0 - Insecure Direct Object Reference to Unauthenticated Sensitive Information Disclosure via 'order_id' and 'billing_address_id' Parameters

FluentCart A New Era of eCommerce <= 1.7.0 - Authenticated (Administrator+) SQL Injection via 'products.variants' Array Keys

Insertion of Sensitive Information Into Sent Data vulnerability in WPManageNinja FluentCart fluent-cart allows Retrieve Embedded Sensitive Data.This issue affects FluentCart: from n/a through 1.7.1.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPManageNinja Best Payments Plugin for WP wp-payment-form allows Stored XSS.This issue affects Best Payments Plugin for WP: from n/a th…

The Fluent Forms plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 6.2.5

The Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'any attacker-chosen name matching the {get.NAME} placeholder (PoC us…

Subscriber Broken Access Control in Fluent Support <= 2.3.2 versions.

Ninja Tables Pro 5.2.11 contains an embedded malicious code vulnerability introduced via a tampered plugin build served through a decommissioned update server

Fluent Forms Pro 6.2.7 contains an embedded malicious code vulnerability introduced via a tampered plugin build served through a decommissioned update server

From the blog

What's new: open corpus, three new MCP tools, vendor advisories, package pages

Wiring VulnSea into an agent: a hands-on tutorial

VulnSea is live

Sound the depths of every vulnerability.

Trending now

Feed

FluentCart A New Era of eCommerce <= 1.7.0 - Insecure Direct Object Reference to Unauthenticated Sensitive Information Disclosure via 'order_id' and 'billing_address_id' Parameters

FluentCart A New Era of eCommerce <= 1.7.0 - Authenticated (Administrator+) SQL Injection via 'products.variants' Array Keys

Insertion of Sensitive Information Into Sent Data vulnerability in WPManageNinja FluentCart fluent-cart allows Retrieve Embedded Sensitive Data.This issue affects FluentCart: from n/a through 1.7.1.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPManageNinja Best Payments Plugin for WP wp-payment-form allows Stored XSS.This issue affects Best Payments Plugin for WP: from n/a th…

The Fluent Forms plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 6.2.5

The Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'any attacker-chosen name matching the {get.NAME} placeholder (PoC us…

Subscriber Broken Access Control in Fluent Support <= 2.3.2 versions.

Ninja Tables Pro 5.2.11 contains an embedded malicious code vulnerability introduced via a tampered plugin build served through a decommissioned update server

Fluent Forms Pro 6.2.7 contains an embedded malicious code vulnerability introduced via a tampered plugin build served through a decommissioned update server

From the blog

What's new: open corpus, three new MCP tools, vendor advisories, package pages

Wiring VulnSea into an agent: a hands-on tutorial

VulnSea is live