Live CVE & 0day intelligence

Sound the depths of every vulnerability.

Newly released CVEs across every platform — sleek to read, verbose on demand, and served raw as markdown for AI and agent ingestion. Severity reads as depth: the deeper the contact, the graver the threat.

Browse the feed For agents → /llms.txt

Depth = severity + exploitation

HadalCritical and actively exploited (CISA KEV / 0day)
AbyssalCritical with a public exploit or in-the-wild use
MidnightCritical, or high with PoC / in-the-wild
TwilightHigh severity, or a signal on a lesser flaw
SunlitLow / medium · no exploitation signal

34763

Tracked CVEs

3390

Critical

423

Exploited in wild

4803

Last 7 days

Trending now

Bluesky + Hacker News mentions, last 7 days

1CVE-2026-58704High· 8.8In Cellular Modem, there is a possible permission bypass due to a logic error in the code374
2CVE-2026-69836Critical· 10.0Microsoft Entra ID Remote Code Execution Vulnerability267
3CVE-2026-66747Critical· 9.8Zbtlink router firmware ships an embedded remote-control implant, ENDLESSDOORS, present in every published build across the product line266
4CVE-2026-18963Critical· 9.1A flaw was found in the reset-credentials flow of the keycloak-services component, which is the core engine for identity and access management in Red Hat Build of Keycloak263

This week's digest →All digests

Feed

15 matches

CVE-2026-19515High· 7.0

1w ago

The WSO2 Integrator MI VS Code extension fails to properly sanitize or validate user-supplied input when processing Micro Integrator projects opened from untrusted sources

The WSO2 Integrator MI VS Code extension fails to properly sanitize or validate user-supplied input when processing Micro Integrator projects opened from untrusted sources. This allows a crafted project to inject and execute arbitrary op…

▾ TwilightWSO2 · WSO2 Integrator: MI for Visual Studio CodeEPSS 0.14%via NVD

CVE-2025-5802Medium· 5.3

1w ago

The self-registration flow accepts user-supplied input for usernames without adequately preventing the disclosure of username existence

The self-registration flow accepts user-supplied input for usernames without adequately preventing the disclosure of username existence. When a user attempts to register with an existing username, the system responds with an error messag…

▾ SunlitWSO2 · WSO2 API ManagerEPSS 0.25%via NVD

CVE-2025-13166Low· 3.7

1w ago

The SMS OTP flow fails to adequately handle error messages, allowing an attacker to infer the existence of registered user accounts based on the responses received during the OTP initiation process. This weakness can be exploited by an …

The SMS OTP flow fails to adequately handle error messages, allowing an attacker to infer the existence of registered user accounts based on the responses received during the OTP initiation process. This weakness can be exploited by an …

▾ SunlitWSO2 · WSO2 Identity ServerEPSS 0.22%via NVD

CVE-2026-4103Medium· 6.4

1w ago

Insufficient HTML sanitization in the Publisher Portal and Developer Portal allows untrusted user input to be rendered without proper encoding or neutralization

Insufficient HTML sanitization in the Publisher Portal and Developer Portal allows untrusted user input to be rendered without proper encoding or neutralization. This enables the injection and execution of malicious JavaScript when affec…

▾ SunlitWSO2 · WSO2 API Control PlaneEPSS 0.30%via NVD

CVE-2026-3096Medium· 4.7

2w ago

The product's web portals allow external links to be opened in a new browser tab

The product's web portals allow external links to be opened in a new browser tab. In certain configurations, the originating window retains access to the newly opened page, allowing interaction between the two browser contexts when navig…

▾ SunlitWSO2 · WSO2 API Control PlaneEPSS 0.29%via NVD

CVE-2026-3416Medium· 5.9

3w ago

The API Publisher component previously used a non-cryptographic pseudorandom number generator (PRNG) to create shared secrets for Webhook HMAC validation

The API Publisher component previously used a non-cryptographic pseudorandom number generator (PRNG) to create shared secrets for Webhook HMAC validation. This PRNG lacks sufficient entropy for security-sensitive operations, allowing a s…

▾ Sunlitwso2 · api_control_planeEPSS 0.36%via NVD

CVE-2025-12737High· 8.4

3w ago

The administrative operations within the Carbon Console do not adequately validate specific user-supplied input

The administrative operations within the Carbon Console do not adequately validate specific user-supplied input. This oversight allows a malicious actor with administrative privileges to inject and execute arbitrary code remotely. Succe…

▾ Twilightwso2 · api_control_planeEPSS 0.22%via NVD

CVE-2026-5430Critical· 10.0CISA KEVPoC

1mo ago

The JWT authentication mechanism accepts tokens signed with algorithms other than those explicitly configured or supported

The JWT authentication mechanism accepts tokens signed with algorithms other than those explicitly configured or supported. This allows an attacker to craft a JWT with an unsupported algorithm, which is then incorrectly validated, leadin…

▾ Hadalwso2 · api_control_planeEPSS 0.58%via NVD

CVE-2026-3418Critical· 9.1

1mo ago

Arbitrary File Upload via System REST API in Multiple WSO2 Products Allows Remote Code Execution

The System REST API accepts user-supplied file uploads without enforcing sufficient validation on the file type or destination, allowing files to be written to arbitrary server-accessible locations. Exploitation requires authenticated ad…

▾ MidnightWSO2 · WSO2 API ManagerEPSS 0.76%via CVEORG

CVE-2026-3415High· 8.7

1mo ago

XML External Entity (XXE) Injection via Schema Validation in Multiple WSO2 Products Allows File Reading and Denial of Service

The XML and schema validation functionalities within the SchemaValidator Mediator process XML input as part of validation flows. Under certain conditions, the XML parser allows the resolution of external entities when handling user-suppl…

▾ TwilightWSO2 · WSO2 API ManagerEPSS 0.49%via CVEORG

CVE-2024-6832Medium· 5.9

1mo ago

The account locking mechanism fails to trigger when secondary user stores are inaccessible

The account locking mechanism fails to trigger when secondary user stores are inaccessible. The software does not maintain a consistent state for account locking if it cannot reach all configured user stores, allowing an attacker to repe…

▾ Sunlitwso2 · api_control_planeEPSS 0.41%via NVD

CVE-2024-10302Medium· 4.0

1mo ago

The user self-signup flow in multiple WSO2 products fails to adequately validate user-supplied input

The user self-signup flow in multiple WSO2 products fails to adequately validate user-supplied input. This weakness allows arbitrary unvalidated data to be included within user claims, which are then used by downstream processes. Allowi…

▾ Sunlitwso2 · api_control_planeEPSS 0.29%via NVD

CVE-2025-13590Critical· 9.1

7mo ago

Authenticated arbitrary file upload via a System REST API requiring administrator permission.

A malicious actor with administrative privileges can upload an arbitrary file to a user-controlled location within the deployment via a system REST API. Successful uploads may lead to remote code execution. By leveraging the vulnerabi…

▾ MidnightWSO2 · WSO2 API ManagerEPSS 0.70%via CVEORG

CVE-2025-12107High· 8.4

7mo ago

The Velocity template engine, utilized by the affected product, accepts and processes template syntax without sufficient sanitization or validation of user-controlled input

The Velocity template engine, utilized by the affected product, accepts and processes template syntax without sufficient sanitization or validation of user-controlled input. This allows an authenticated administrator to inject arbitrary …

▾ Twilightwso2 · identity_serverEPSS 0.65%via NVD

CVE-2025-9804Critical· 9.6

11mo ago

An improper access control vulnerability exists in multiple WSO2 products due to insufficient permission enforcement in certain internal SOAP Admin Services and System REST APIs

An improper access control vulnerability exists in multiple WSO2 products due to insufficient permission enforcement in certain internal SOAP Admin Services and System REST APIs. A low-privileged user may exploit this flaw to perform una…

▾ Midnightwso2 · api_control_planeEPSS 0.56%via NVD

From the blog

All posts →

Sep 8, 2026

Sound the depths of every vulnerability.

Trending now

Feed

The WSO2 Integrator MI VS Code extension fails to properly sanitize or validate user-supplied input when processing Micro Integrator projects opened from untrusted sources

The self-registration flow accepts user-supplied input for usernames without adequately preventing the disclosure of username existence

The SMS OTP flow fails to adequately handle error messages, allowing an attacker to infer the existence of registered user accounts based on the responses received during the OTP initiation process. This weakness can be exploited by an …

Insufficient HTML sanitization in the Publisher Portal and Developer Portal allows untrusted user input to be rendered without proper encoding or neutralization

The product's web portals allow external links to be opened in a new browser tab

The API Publisher component previously used a non-cryptographic pseudorandom number generator (PRNG) to create shared secrets for Webhook HMAC validation

The administrative operations within the Carbon Console do not adequately validate specific user-supplied input

The JWT authentication mechanism accepts tokens signed with algorithms other than those explicitly configured or supported

Arbitrary File Upload via System REST API in Multiple WSO2 Products Allows Remote Code Execution

XML External Entity (XXE) Injection via Schema Validation in Multiple WSO2 Products Allows File Reading and Denial of Service

The account locking mechanism fails to trigger when secondary user stores are inaccessible

The user self-signup flow in multiple WSO2 products fails to adequately validate user-supplied input

Authenticated arbitrary file upload via a System REST API requiring administrator permission.

The Velocity template engine, utilized by the affected product, accepts and processes template syntax without sufficient sanitization or validation of user-controlled input

An improper access control vulnerability exists in multiple WSO2 products due to insufficient permission enforcement in certain internal SOAP Admin Services and System REST APIs

From the blog

What's new: open corpus, three new MCP tools, vendor advisories, package pages

Wiring VulnSea into an agent: a hands-on tutorial

VulnSea is live

Sound the depths of every vulnerability.

Trending now

Feed

The WSO2 Integrator MI VS Code extension fails to properly sanitize or validate user-supplied input when processing Micro Integrator projects opened from untrusted sources

The self-registration flow accepts user-supplied input for usernames without adequately preventing the disclosure of username existence

The SMS OTP flow fails to adequately handle error messages, allowing an attacker to infer the existence of registered user accounts based on the responses received during the OTP initiation process. This weakness can be exploited by an …

Insufficient HTML sanitization in the Publisher Portal and Developer Portal allows untrusted user input to be rendered without proper encoding or neutralization

The product's web portals allow external links to be opened in a new browser tab

The API Publisher component previously used a non-cryptographic pseudorandom number generator (PRNG) to create shared secrets for Webhook HMAC validation

The administrative operations within the Carbon Console do not adequately validate specific user-supplied input

The JWT authentication mechanism accepts tokens signed with algorithms other than those explicitly configured or supported

Arbitrary File Upload via System REST API in Multiple WSO2 Products Allows Remote Code Execution

XML External Entity (XXE) Injection via Schema Validation in Multiple WSO2 Products Allows File Reading and Denial of Service

The account locking mechanism fails to trigger when secondary user stores are inaccessible

The user self-signup flow in multiple WSO2 products fails to adequately validate user-supplied input

Authenticated arbitrary file upload via a System REST API requiring administrator permission.

The Velocity template engine, utilized by the affected product, accepts and processes template syntax without sufficient sanitization or validation of user-controlled input

An improper access control vulnerability exists in multiple WSO2 products due to insufficient permission enforcement in certain internal SOAP Admin Services and System REST APIs

From the blog

What's new: open corpus, three new MCP tools, vendor advisories, package pages

Wiring VulnSea into an agent: a hands-on tutorial

VulnSea is live