Live CVE & 0day intelligence

Sound the depths of every vulnerability.

Newly released CVEs across every platform — sleek to read, verbose on demand, and served raw as markdown for AI and agent ingestion. Severity reads as depth: the deeper the contact, the graver the threat.

Browse the feed For agents → /llms.txt

Depth = severity + exploitation

HadalCritical and actively exploited (CISA KEV / 0day)
AbyssalCritical with a public exploit or in-the-wild use
MidnightCritical, or high with PoC / in-the-wild
TwilightHigh severity, or a signal on a lesser flaw
SunlitLow / medium · no exploitation signal

30424

Tracked CVEs

2984

Critical

377

Exploited in wild

4940

Last 7 days

Trending now

Bluesky + Hacker News mentions, last 7 days

1CVE-2026-85046High· 8.8Type confusion in V8 in Google Chrome prior to 152.0.7977.82 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page874
2CVE-2026-58704High· 8.8In Cellular Modem, there is a possible permission bypass due to a logic error in the code373
3CVE-2026-69836Critical· 10.0Microsoft Entra ID Remote Code Execution Vulnerability267
4CVE-2026-66747Critical· 9.8Zbtlink router firmware ships an embedded remote-control implant, ENDLESSDOORS, present in every published build across the product line266
5CVE-2026-18963Critical· 9.1A flaw was found in the reset-credentials flow of the keycloak-services component, which is the core engine for identity and access management in Red Hat Build of Keycloak263

This week's digest →All digests

Feed

15 matches

CVE-2026-56668High· 8.1

1w ago

ZITADEL: Unauthorized Token Privilege Escalation in OAuth2 Token Exchange

▾ Twilightzitadel · github.com/zitadel/zitadelEPSS 0.41%via OSV

CVE-2026-76081Medium· 5.5

1w ago

ZITADEL is an open source identity management platform

ZITADEL is an open source identity management platform. Prior to version 4.16.0, a bug in how ZITADEL updates permissions when multiple project roles are deleted at the same time can cause some user permissions to be missed. This issue s…

▾ Sunlitzitadel · github.com/zitadel/zitadelEPSS 0.23%via NVD

CVE-2026-56665Medium· 4.2

1w ago

ZITADEL: Missing Token Expiration (`exp`) Validation in JWT IdP Provider

▾ Sunlitzitadel · github.com/zitadel/zitadelEPSS 0.27%via OSV

CVE-2026-54693High

1mo ago

ZITADEL Users Can Self-Verify Email/Phone via API

▾ Twilightzitadel · github.com/zitadel/zitadelEPSS 0.34%via GHSA

CVE-2026-56666Medium· 4.8

2mo ago

ZITADEL is an open source identity management platform

ZITADEL is an open source identity management platform. Prior to 4.15.3, ZITADEL's external identity provider handler checks that the local user's email is verified but does not verify that the external IdP confirmed ownership of the sam…

▾ Sunlitzitadel · zitadelEPSS 0.29%via NVD

CVE-2026-56664Medium· 4.2

3mo ago

ZITADEL: Missing Token Lifecyle Validation (`exp` and `iat`) in JWT IdP Provider

▾ Sunlitzitadel · github.com/zitadel/zitadelEPSS 0.32%via OSV

CVE-2026-55671Low

3mo ago

ZITADEL: Server-Side Request Forgery (SSRF) and Denylist Bypass in Outgoing HTTP Components

▾ Sunlitzitadel · github.com/zitadel/zitadelEPSS 0.41%via GHSA

CVE-2026-55670Low

3mo ago

ZITADEL: Cross-Tenant User Leakage via Recycled Identifiers

▾ Sunlitzitadel · github.com/zitadel/zitadelEPSS 0.36%via GHSA

CVE-2026-55672High· 7.4

3mo ago

ZITADEL: Missing client_id binding in OIDC authorization code exchange and refresh token flows (RFC 6749 Section 4.1.3 violation)

▾ Twilightzitadel · github.com/zitadel/zitadelEPSS 0.43%via GHSA

GHSA-wxg7-w2v3-w38gMedium· 4.2

3mo ago

ZITADEL: Missing Token Lifecyle Validation (`exp` and `iat`) in JWT IdP Provider

▾ Sunlitzitadel · github.com/zitadel/zitadelvia GHSA

CVE-2026-55669Medium· 4.2

3mo ago

ZITADEL: Missing Token Audience Validation (`aud`) in JWT IdP Provider

▾ Sunlitzitadel · github.com/zitadel/zitadelEPSS 0.15%via GHSA

CVE-2024-32868Medium· 6.5

2y ago

ZITADEL provides users the possibility to use Time-based One-Time-Password (TOTP) and One-Time-Password (OTP) through SMS and Email

ZITADEL provides users the possibility to use Time-based One-Time-Password (TOTP) and One-Time-Password (OTP) through SMS and Email. While ZITADEL already gives administrators the option to define a `Lockout Policy` with a maximum amount…

▾ Sunlitzitadel · zitadelEPSS 0.46%via NVD

CVE-2023-49097High· 8.1

2y ago

From the blog

All posts →

Sep 8, 2026

Sound the depths of every vulnerability.

Trending now

Feed

ZITADEL: Unauthorized Token Privilege Escalation in OAuth2 Token Exchange

ZITADEL is an open source identity management platform

ZITADEL: Missing Token Expiration (`exp`) Validation in JWT IdP Provider

ZITADEL Users Can Self-Verify Email/Phone via API

ZITADEL is an open source identity management platform

ZITADEL: Missing Token Lifecyle Validation (`exp` and `iat`) in JWT IdP Provider

ZITADEL: Server-Side Request Forgery (SSRF) and Denylist Bypass in Outgoing HTTP Components

ZITADEL: Cross-Tenant User Leakage via Recycled Identifiers

ZITADEL: Missing client_id binding in OIDC authorization code exchange and refresh token flows (RFC 6749 Section 4.1.3 violation)

ZITADEL: Missing Token Lifecyle Validation (`exp` and `iat`) in JWT IdP Provider

ZITADEL: Missing Token Audience Validation (`aud`) in JWT IdP Provider

ZITADEL provides users the possibility to use Time-based One-Time-Password (TOTP) and One-Time-Password (OTP) through SMS and Email

ZITADEL Account Takeover via Malicious Host Header Injection

ZITADEL race condition in lockout policy execution

Zitadel RefreshToken invalidation vulnerability

From the blog

What's new: open corpus, three new MCP tools, vendor advisories, package pages

Wiring VulnSea into an agent: a hands-on tutorial

VulnSea is live

Sound the depths of every vulnerability.

Trending now

Feed

ZITADEL: Unauthorized Token Privilege Escalation in OAuth2 Token Exchange

ZITADEL is an open source identity management platform

ZITADEL: Missing Token Expiration (`exp`) Validation in JWT IdP Provider

ZITADEL Users Can Self-Verify Email/Phone via API

ZITADEL is an open source identity management platform

ZITADEL: Missing Token Lifecyle Validation (`exp` and `iat`) in JWT IdP Provider

ZITADEL: Server-Side Request Forgery (SSRF) and Denylist Bypass in Outgoing HTTP Components

ZITADEL: Cross-Tenant User Leakage via Recycled Identifiers

ZITADEL: Missing client_id binding in OIDC authorization code exchange and refresh token flows (RFC 6749 Section 4.1.3 violation)

ZITADEL: Missing Token Lifecyle Validation (`exp` and `iat`) in JWT IdP Provider

ZITADEL: Missing Token Audience Validation (`aud`) in JWT IdP Provider

ZITADEL provides users the possibility to use Time-based One-Time-Password (TOTP) and One-Time-Password (OTP) through SMS and Email

ZITADEL Account Takeover via Malicious Host Header Injection

ZITADEL race condition in lockout policy execution

Zitadel RefreshToken invalidation vulnerability

From the blog

What's new: open corpus, three new MCP tools, vendor advisories, package pages

Wiring VulnSea into an agent: a hands-on tutorial

VulnSea is live