Live CVE & 0day intelligence

Sound the depths of every vulnerability.

Newly released CVEs across every platform — sleek to read, verbose on demand, and served raw as markdown for AI and agent ingestion. Severity reads as depth: the deeper the contact, the graver the threat.

Browse the feed For agents → /llms.txt

Depth = severity + exploitation

HadalCritical and actively exploited (CISA KEV / 0day)
AbyssalCritical with a public exploit or in-the-wild use
MidnightCritical, or high with PoC / in-the-wild
TwilightHigh severity, or a signal on a lesser flaw
SunlitLow / medium · no exploitation signal

59219

Tracked CVEs

5445

Critical

561

Exploited in wild

12451

Last 7 days

Trending now

Bluesky + Hacker News mentions, last 7 days

1CVE-2026-88771Critical· 9.8Improper input validation vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway. This issue affects ADC: before 14.1-73.37, before 13.1-64.23, before 14.1-73.37 FIPS, and before 13.1.37.279 FIPS and NDcPP; Gateway: before 1…479

This week's digest →All digests

Feed

16 matches

CVE-2026-13351High· 7.5

3mo ago

net: Maliciously fragmented IPv6 packets can prevent receiving/processing future incoming packets

Zephyr's IPv6 network stack can be prevented from receiving or processing future incoming packets by sending a small number of maliciously fragmented IPv6 packets. When such a packet is handled by the fragment-header processing path, the…

▾ Twilightzephyrproject-rtos · ZephyrEPSS 0.49%via CVEORG

CVE-2026-5068High· 7.6

4mo ago

bt: l2cap le coc: remote oob write via seg counter stored in net_buf user_data

A remote, unauthenticated BLE peer can trigger a 2-byte out-of-bounds write in the Bluetooth host during L2CAP LE CoC SDU reassembly. When the application enables segmentation (via chan_ops.alloc_buf) and the chosen RX pool has a user_da…

▾ Twilightzephyrproject-rtos · ZephyrEPSS 0.32%via CVEORG

CVE-2026-5067Critical· 9.8PoC

4mo ago

Out-of-bounds read/write in HTTP WebSocket upgrade via non-null-terminated Sec-WebSocket-Key

A remote, unauthenticated attacker can trigger memory corruption in Zephyr's HTTP server WebSocket upgrade path by sending a crafted Sec-WebSocket-Key header. The HTTP/1 header parser copies the header into a fixed-size buffer using a bo…

▾ Abyssalzephyrproject-rtos · ZephyrEPSS 0.86%via CVEORG

CVE-2026-5589Medium· 6.3

4mo ago

Out-of-bounds write caused by an integer underflow in the Bluetooth Mesh subsystem.

An integer underflow in bt_mesh_sol_recv() in the Bluetooth Mesh solicitation handling (subsys/bluetooth/mesh/solicitation.c) leads to an out-of-bounds write. When CONFIG_BT_MESH_OD_PRIV_PROXY_SRV is enabled, the function parses solicita…

▾ Sunlitzephyrproject-rtos · ZephyrEPSS 0.36%via CVEORG

CVE-2026-5066Medium· 6.3PoC

4mo ago

net: sockets: tls: Potential out-of-bounds write/read in socket_op_vtable::connect function

A potential out-of-bounds write/read exists in the TLS socket connect path of the network sockets subsystem (subsys/net/lib/sockets/sockets_tls.c). When the TLS session cache is enabled, tls_session_store() and tls_session_restore() memc…

▾ Twilightzephyrproject-rtos · ZephyrEPSS 0.47%via CVEORG

CVE-2026-5071Medium· 6.1

4mo ago

can: Local Denial of Service via SocketCAN Send

The SocketCAN implementation validates the length of a user-provided buffer containing a socketcan_frame object using only a NET_ASSERT statement in zcan_sendto_ctx() before dereferencing it in socketcan_to_can_frame(). In production bui…

▾ Sunlitzephyrproject-rtos · ZephyrEPSS 0.17%via CVEORG

CVE-2026-1679High· 7.3PoC

6mo ago

net: eswifi socket send payload length not bounded

The eswifi socket offload driver copies user-provided payloads into a fixed buffer without checking available space; oversized sends overflow `eswifi->buf`, corrupting kernel memory (CWE-120). Exploit requires local code that can call th…

▾ Midnightzephyrproject-rtos · ZephyrEPSS 0.21%via CVEORG

CVE-2026-4179Medium· 6.1PoC

7mo ago

stm32: usb: Infinite while loop in Interrupt Handler

Issues in stm32 USB device driver (drivers/usb/device/usb_dc_stm32.c) can lead to an infinite while loop.

▾ Twilightzephyrproject-rtos · ZephyrEPSS 0.15%via CVEORG

CVE-2026-0849Low· 3.8PoC

7mo ago

crypto: ATAES132A response length allows stack buffer overflow

Malformed ATAES132A responses with an oversized length field overflow a 52-byte stack buffer in the Zephyr crypto driver, allowing a compromised device or bus attacker to corrupt kernel memory and potentially hijack execution.

▾ Twilightzephyrproject-rtos · ZephyrEPSS 0.24%via CVEORG

CVE-2026-1678Critical· 9.4PoC

7mo ago

dns: memory‑safety issue in the DNS name parser

dns_unpack_name() caches the buffer tailroom once and reuses it while appending DNS labels. As the buffer grows, the cached size becomes incorrect, and the final null terminator can be written past the buffer. With assertions disabled (d…

▾ Abyssalzephyrproject-rtos · ZephyrEPSS 0.39%via CVEORG

CVE-2025-12899Medium· 6.5

8mo ago

A flaw in Zephyr’s network stack allows an IPv4 packet containing ICMP type 128 to be misclassified as an ICMPv6 Echo Request

A flaw in Zephyr’s network stack allows an IPv4 packet containing ICMP type 128 to be misclassified as an ICMPv6 Echo Request. This results in an out-of-bounds memory read and creates a potential information-leak vulnerability in the net…

▾ Sunlitzephyrproject-rtos · ZephyrEPSS 0.34%via NVD

CVE-2025-12035Medium· 6.5

10mo ago

An integer overflow condition exists in Bluetooth Host stack, within the bt_br_acl_recv routine a critical path for processing inbound BR/EDR L2CAP traffic.

▾ Sunlitzephyrproject-rtos · ZephyrEPSS 0.20%via NVD

CVE-2025-9558High· 7.6

10mo ago

There is a potential OOB Write vulnerability in the gen_prov_start function in pb_adv.c

There is a potential OOB Write vulnerability in the gen_prov_start function in pb_adv.c. The full length of the received data is copied into the link.rx.buf receiver buffer without any validation on the data size.

▾ Twilightzephyrproject-rtos · ZephyrEPSS 0.19%via NVD

CVE-2025-9557High· 7.6

10mo ago

‭An out-of-bound write can lead to an arbitrary code execution

‭An out-of-bound write can lead to an arbitrary code execution. Even on devices with some form of memory protection, this can still lead to‬ ‭a crash and a resultant denial of service.‬

▾ Twilightzephyrproject-rtos · ZephyrEPSS 0.21%via NVD

CVE-2025-9408High· 8.1

11mo ago

System call entry on Cortex M (and possibly R and A, but I think not) has a race which allows very practical privilege escalation for malicious userspace processes.

▾ Twilightzephyrproject-rtos · ZephyrEPSS 0.12%via NVD

CVE-2025-12890Medium· 6.5PoC

11mo ago

Improper handling of malformed Connection Request with the interval set to be 1 (which supposed to be illegal) and the chM 0x7CFFFFFFFF triggers a crash

Improper handling of malformed Connection Request with the interval set to be 1 (which supposed to be illegal) and the chM 0x7CFFFFFFFF triggers a crash. The peripheral will not be connectable after it.

▾ Twilightzephyrproject-rtos · ZephyrEPSS 0.20%via NVD

From the blog

All posts →

Sep 8, 2026

Sound the depths of every vulnerability.

Trending now

Feed

net: Maliciously fragmented IPv6 packets can prevent receiving/processing future incoming packets

bt: l2cap le coc: remote oob write via seg counter stored in net_buf user_data

Out-of-bounds read/write in HTTP WebSocket upgrade via non-null-terminated Sec-WebSocket-Key

Out-of-bounds write caused by an integer underflow in the Bluetooth Mesh subsystem.

net: sockets: tls: Potential out-of-bounds write/read in socket_op_vtable::connect function

can: Local Denial of Service via SocketCAN Send

net: eswifi socket send payload length not bounded

stm32: usb: Infinite while loop in Interrupt Handler

crypto: ATAES132A response length allows stack buffer overflow

dns: memory‑safety issue in the DNS name parser

A flaw in Zephyr’s network stack allows an IPv4 packet containing ICMP type 128 to be misclassified as an ICMPv6 Echo Request

An integer overflow condition exists in Bluetooth Host stack, within the bt_br_acl_recv routine a critical path for processing inbound BR/EDR L2CAP traffic.

There is a potential OOB Write vulnerability in the gen_prov_start function in pb_adv.c

‭An out-of-bound write can lead to an arbitrary code execution

System call entry on Cortex M (and possibly R and A, but I think not) has a race which allows very practical privilege escalation for malicious userspace processes.

Improper handling of malformed Connection Request with the interval set to be 1 (which supposed to be illegal) and the chM 0x7CFFFFFFFF triggers a crash

From the blog

What's new: open corpus, three new MCP tools, vendor advisories, package pages

Wiring VulnSea into an agent: a hands-on tutorial

VulnSea is live

Sound the depths of every vulnerability.

Trending now

Feed

net: Maliciously fragmented IPv6 packets can prevent receiving/processing future incoming packets

bt: l2cap le coc: remote oob write via seg counter stored in net_buf user_data

Out-of-bounds read/write in HTTP WebSocket upgrade via non-null-terminated Sec-WebSocket-Key

Out-of-bounds write caused by an integer underflow in the Bluetooth Mesh subsystem.

net: sockets: tls: Potential out-of-bounds write/read in socket_op_vtable::connect function

can: Local Denial of Service via SocketCAN Send

net: eswifi socket send payload length not bounded

stm32: usb: Infinite while loop in Interrupt Handler

crypto: ATAES132A response length allows stack buffer overflow

dns: memory‑safety issue in the DNS name parser

A flaw in Zephyr’s network stack allows an IPv4 packet containing ICMP type 128 to be misclassified as an ICMPv6 Echo Request

An integer overflow condition exists in Bluetooth Host stack, within the bt_br_acl_recv routine a critical path for processing inbound BR/EDR L2CAP traffic.

There is a potential OOB Write vulnerability in the gen_prov_start function in pb_adv.c

‭An out-of-bound write can lead to an arbitrary code execution

System call entry on Cortex M (and possibly R and A, but I think not) has a race which allows very practical privilege escalation for malicious userspace processes.

Improper handling of malformed Connection Request with the interval set to be 1 (which supposed to be illegal) and the chM 0x7CFFFFFFFF triggers a crash

From the blog

What's new: open corpus, three new MCP tools, vendor advisories, package pages

Wiring VulnSea into an agent: a hands-on tutorial

VulnSea is live