Live tracker of exploited and high-impact vulnerabilities
New vulnerabilities from CERTs, vendors, researchers and newsrooms in 180+ countries, checked automatically, with how widely each one is being exploited, warned about and covered.
Panic meter
Connecting- Researchers talking
- –
- News outlets covering
- –
- CERTs and agencies warning
- –
Distinct people and organisations discussing new vulnerabilities in the past 24 hours.
Trending now
Outbreak map
- Countries in the news
- –
- Agencies warning
- –
- Countries warned
- –
- Patient zero
- –
Daily panic
Vulnerabilities
Actively exploited vulnerabilities
Vulnerabilities with recent evidence of exploitation in the wild: a known-exploited catalogue listing in the last 90 days, a vendor or government statement, or independent reports from at least two organisations in the last 30 days. Most recent evidence first.
RSS feed of exploited vulnerabilities
- 52impact
Active Exploitation Confirmed for Critical SharePoint RCE CVE-2026-50522 Following Public PoC
Exploited in the wild0 news outlets1 CERTs0 researchersCVSS 5.3 - 89impact
RCE via stale global state
Exploited in the wild40 news outlets in 25 countries40 CERTs29 researchersCVSS 9.2 - 81impact
Remote code execution vulnerability in BeyondTrust Remote Support (RS) and Privileged Remote Access (PRA)
Known exploited (KEV) (CISA)0 news outlets0 CERTs1 researchersCVSS 9.9 - 73impact
Apple iOS/macOS: The issue was addressed with improved checks. This issue is fixed in Safari 18.1.1, iOS 17.7.2 and iPadOS 17.7.2, iOS 18
Known exploited (KEV) (CISA)0 news outlets0 CERTs0 researchersCVSS 8.8 - 66impact
Apple iOS/macOS: A cookie management issue was addressed with improved state management. This issue is fixed in Safari 18.1.1, iOS 17.7.2
Known exploited (KEV) (CISA)0 news outlets0 CERTs0 researchersCVSS 6.3 - 70impact
May 2026 EPMM Security Update
Known exploited (KEV) (CISA)0 news outlets0 CERTs0 researchersCVSS 7.2 - 88impact
Cisco Identity Services Engine Authentication Bypass Vulnerability
Known exploited (KEV) (CISA)0 news outlets1 CERTs0 researchersCVSS 10.0 - 77impact
Potential authentication bypass leading to administrative access in Artifactory
Known exploited (KEV) (CISA)0 news outlets1 CERTs0 researchersCVSS 9.8 - 88impact
Cisco Secure Email Gateway SQL Injection Vulnerability
Known exploited (KEV) (CISA)0 news outlets1 CERTs0 researchersCVSS 9.8 - 73impact
ScreenConnect Client: Guest-to-Host File Execution via File-Transfer Actions
Known exploited (KEV) (CISA)0 news outlets1 CERTs0 researchersCVSS 9.9 - 70impact
Anonymous user token generation exposure in JFrog Artifactory
Known exploited (KEV) (CISA)0 news outlets1 CERTs0 researchersCVSS 7.5 - 67impact
Incorrect authorization validation of user token in JFrog Artifactory allows Privilege Escalation
Known exploited (KEV) (CISA)0 news outlets1 CERTs0 researchersCVSS 8.1 - 71impact
Cisco Secure Firewall Management Center Software Static Credential Vulnerability
Known exploited (KEV) (CISA)0 news outlets0 CERTs0 researchersCVSS 5.3 - 74impact
pre-authentication remote code execution
Known exploited (KEV) (CISA)0 news outlets0 CERTs0 researchersCVSS 10.0 - 79impact
Google Chrome: Out of bounds write in V8 in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to execute arbitrary code in
Known exploited (KEV) (CISA)0 news outlets1 CERTs1 researchersCVSS 8.8 - 80impact
Google Chrome: Type confusion in V8 in Google Chrome prior to 152.0.7977.82 allowed a remote attacker to execute arbitrary code inside
Known exploited (KEV) (CISA)0 news outlets1 CERTs1 researchersCVSS 8.8 - 85impact
Cisco Secure Firewall Management Center Authentication Bypass Remote Code Execution Vulnerability
Known exploited (KEV) (CISA)0 news outlets0 CERTs0 researchersCVSS 10.0 - 72impact
Windows Advanced Local Procedure Call (ALPC) Elevation of Privilege Vulnerability
Known exploited (KEV) (CISA)0 news outlets0 CERTs1 researchersCVSS 7.8 - 76impact
Fortinet FortiOS: A heap-based buffer overflow vulnerability in Fortinet FortiOS 7.6.0 through 7.6.3, FortiOS 7.4.0 through 7.4.8, FortiOS
Known exploited (KEV) (CISA)0 news outlets0 CERTs0 researchersCVSS 7.4 - 64impact
Windows Update Stack Elevation of Privilege Vulnerability
Known exploited (KEV) (CISA)0 news outlets0 CERTs0 researchersCVSS 7.8 - 83impact
NetScaler ADC and NetScaler Gateway Security Bulletin for CVE-2026-19490
Known exploited (KEV) (CISA)0 news outlets0 CERTs0 researchersCVSS 9.3 - 68impact
Incomplete patch leads to administrative account takeover
Known exploited (KEV) (CISA)0 news outlets0 CERTs0 researchersCVSS 8.2 - 60impact
Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability
Known exploited (KEV) (CISA)0 news outlets0 CERTs0 researchersCVSS 7.0 - 74impact
Metabase SQL injection via password reset endpoint
Known exploited (KEV) (CISA)0 news outlets0 CERTs0 researchersCVSS 10.0 - 77impact
Cisco Secure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense Software Remote Access SSL VPN Denial of Service Vulnerability
Known exploited (KEV) (CISA)0 news outlets0 CERTs0 researchersCVSS 8.6 - 81impact
OS Command Injection Remote Code Execution Vulnerability in Progress LoadMaster, ECS Connection Manager, Object Scale Connection Manager & MOVEit WAF
Known exploited (KEV) (CISA)0 news outlets1 CERTs0 researchersCVSS 9.6 - 70impact
Bricksforge <= 3.1.8.9 - Unauthenticated Arbitrary File Upload via 'temporaryFileUploads' Parameter
Exploited in the wild0 news outlets1 CERTs0 researchersCVSS 9.8 - 77impact
Cisco SD-WAN Software Privilege Escalation Vulnerability
Known exploited (KEV) (CISA)0 news outlets1 CERTs0 researchersCVSS 7.8 - 83impact
Kernel memory disclosure and denial of service in MikroTik RouterOS btest service
Known exploited (KEV) (CISA)0 news outlets1 CERTs0 researchersCVSS 8.8 - 74impact
Apache Tomcat: Fix for CVE-2026-29146 allowed bypass of EncryptInterceptor
Known exploited (KEV) (CISA)0 news outlets0 CERTs0 researchersCVSS 7.5 - 90impact
SSH session privilege manipulation via a crafted username in Mikrotik RouterOS
Known exploited (KEV) (CISA)0 news outlets3 CERTs0 researchersCVSS 9.2 - 80impact
MetInfo CMS Unauthenticated PHP Code Injection RCE
Exploited in the wild0 news outlets1 CERTs0 researchersCVSS 9.8 - 81impact
Cisco Catalyst SD-WAN Manager Information Disclosure Vulnerability
Known exploited (KEV) (CISA)0 news outlets1 CERTs0 researchersCVSS 7.5 - 71impact
Microsoft SharePoint Server Spoofing Vulnerability
Known exploited (KEV) (CISA)0 news outlets1 CERTs0 researchersCVSS 6.5 - 64impact
Microsoft SharePoint Server Elevation of Privilege Vulnerability
Known exploited (KEV) (CISA)0 news outlets1 CERTs0 researchersCVSS 5.3 - 81impact
Microsoft SharePoint Remote Code Execution Vulnerability
Known exploited (KEV) (CISA)0 news outlets1 CERTs0 researchersCVSS 9.8 - 72impact
Microsoft SharePoint Remote Code Execution Vulnerability
Known exploited (KEV) (CISA)0 news outlets1 CERTs0 researchersCVSS 8.8 - 80impact
Active Exploitation Confirmed for Critical SharePoint RCE CVE-2026-50522 Following Public PoC
Known exploited (KEV) (CISA)0 news outlets1 CERTs0 researchersCVSS 9.8 - 73impact
Active Exploitation of Windows Defender Privilege Escalation Vulnerabilities Enables SYSTEM-Level Compromise
Known exploited (KEV) (CISA)0 news outlets2 CERTs1 researchersCVSS 7.8 - 81impact
vCenter directory-traversal vulnerability
Known exploited (KEV) (CISA)0 news outlets0 CERTs0 researchersCVSS 9.8 - 79impact
26/08/2026 Vulnerabilidad de ejecución remota de código en Zimbra con…
Known exploited (KEV) (CISA)0 news outlets1 CERTs0 researchersCVSS 8.9 - 82impact
Broadcom VMware ESXi/vCenter: The vCenter Server contains an arbitrary file upload vulnerability in the Analytics service. A malicious actor with netw
Known exploited (KEV) (CISA)0 news outlets0 CERTs0 researchersCVSS 9.8 - 70impact
Arista EOS Unexpected Tunnel Protocol Decapsulation and Forwarding Bypass
Known exploited (KEV) (CISA)1 news outlets0 CERTs0 researchersCVSS 5.8 - 87impact
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in GitLab
Known exploited (KEV) (CISA)1 news outlets2 CERTs0 researchersCVSS 10.0 - 81impact
VeloCloud Orchestrator OS Command Injection
Known exploited (KEV) (CISA)0 news outlets0 CERTs0 researchersCVSS 10.0 - 79impact
Apple iOS/macOS: An authentication issue was addressed with improved state management. This issue is fixed in macOS Golden Gate 27, macOS
Known exploited (KEV) (CISA)0 news outlets0 CERTs0 researchersCVSS 9.8 - 89impact
RCE via OOM corruption
Exploited in the wild25 news outlets in 14 countries41 CERTs25 researchersCVSS 9.2 - 82impact
Adobe Commerce | Improper Neutralization of Special Elements Used in a Template Engine (CWE-1336)
Known exploited (KEV) (CISA)0 news outlets1 CERTs0 researchersCVSS 10.0 - 66impact
Redis security advisory (AV26-423) - Update 1
Exploited in the wild0 news outlets2 CERTs0 researchersCVSS 7.7 - 62impact
Ivanti Connect Secure: Ivanti Connect Secure 22.8R2.4 mishandles the manner in which the dsinvoked broker trusts DSCache configuration data, le
Exploited in the wild0 news outlets1 CERTs0 researchersCVSS 7.0 - 81impact
Gitea Gitea: Gitea before 1.27.1 allows remote code execution via the diffpatch API through Git hook installation.
Known exploited (KEV) (CISA)0 news outlets1 CERTs0 researchersCVSS 9.8 - 75impact
Gitea Docker image trusts spoofable reverse-proxy headers by default
Exploited in the wild0 news outlets1 CERTs0 researchersCVSS 9.8 - 57impact
Plex Media Server SSRF
Known exploited (KEV) (CISA, EUVD)1 news outlets1 CERTs0 researchersCVSS 4.3 - 57impact
Plex Media Server arbitrary-host SSRF
Known exploited (KEV) (CISA, EUVD)1 news outlets1 CERTs0 researchersCVSS 4.3 - 68impact
Plex Media Server URL injection
Known exploited (KEV) (CISA, EUVD)1 news outlets1 CERTs0 researchersCVSS 6.5 - 67impact
Plex Media Server arbitrary file write
Known exploited (KEV) (CISA, EUVD)1 news outlets1 CERTs0 researchersCVSS 7.2 - 68impact
crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg
Known exploited (KEV) (CISA)0 news outlets0 CERTs0 researchersCVSS 7.8 - 80impact
An unauthenticated attacker can make `get_page_template()` page-template resolution include a chosen readable local `.php` file outside the active theme directo
Known exploited (KEV) (CISA)0 news outlets1 CERTs0 researchersCVSS 8.1 - 66impact
named in ISC BIND 9.x before 9.9.7-P2 and 9.10.x before 9.10.2-P3 allows remote attackers to cause a denial of service (REQUIRE assertion failure and daemon exi
Known exploited (KEV) (CISA)0 news outlets0 CERTs0 researchersCVSS 7.5 - 81impact
PAN-OS: Authenticated Remote Code Execution (RCE) in the Management Interface
Known exploited (KEV) (CISA)0 news outlets3 CERTs0 researchersCVSS 8.6 - 82impact
This is a vulnerability in Bitbucket Data Center, Confluence Data Center, Jira Service Management Data Center, Jira Software Data Center, Bamboo Data Center. Cr
Known exploited (KEV) (CISA)0 news outlets2 CERTs0 researchersCVSS 9.3 - 74impact
An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 26.7.1 and iPadOS 26.7.1, macOS Sequoia 15.8.1, macOS Tahoe
Known exploited (KEV) (CISA)0 news outlets1 CERTs0 researchersCVSS 8.8 - 84impact
Security Advisory 0183
Known exploited (KEV) (CISA)1 news outlets0 CERTs0 researchersCVSS 10.0 - 77impact
Directory Traversal and File upload allows execution of arbitrary script on the Management Server
Known exploited (KEV) (CISA)0 news outlets1 CERTs0 researchersCVSS 9.8 - 70impact
A vulnerability has been identified in Siemens Software Center (All versions < V4.0.9.8). The affected application loads dynamic-link libraries (DLLs) from an u
Known exploited (KEV) (CISA)3 news outlets3 CERTs0 researchersCVSS 6.7 - 71impact
An Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') [CWE-22] vulnerability in Fortinet FortiOS 7.6.0 through 7.6.4, FortiOS 7.4.0
Known exploited (KEV) (CISA)0 news outlets3 CERTs0 researchersCVSS 5.4 - 89impact
Cisco Catalyst SD-WAN Manager System Account Authorization Bypass Vulnerability
Known exploited (KEV) (CISA)0 news outlets2 CERTs0 researchersCVSS 9.8 - 87impact
BIG-IP APM OAuth vulnerability
Known exploited (KEV) (CISA)0 news outlets1 CERTs0 researchersCVSS 9.8 - 82impact
Memory overflow vulnerability leading to Denial of Service
Known exploited (KEV) (CISA)0 news outlets0 CERTs5 researchersCVSS 8.7 - 95impact
A remote code execution vulnerability exists due to improper input validation, which can allow an unauthenticated attacker to execute arbitrary commands
Known exploited (KEV) (CISA)0 news outlets5 CERTs6 researchersCVSS 9.5 - 59impact
Local privilege escalation in Zammad v1.5.0 to v7.2.2 installed via DEB or RPM package
Known exploited (KEV) (CISA)0 news outlets0 CERTs0 researchersCVSS 8.5 - 60impact
Strapi through 4.5.5 allows attackers (with access to the admin panel) to discover sensitive user details by exploiting the query filter. The attacker can filte
Known exploited (KEV) (CISA)0 news outlets0 CERTs0 researchersCVSS 7.2 - 73impact
Directory traversal with remote code execution can occur in /upload in ONLYOFFICE Document Server before 5.6.3, when JWT is used, via a /.. sequence in an image
Known exploited (KEV) (CISA)0 news outlets0 CERTs0 researchersCVSS 9.8 - 78impact
SSH Pre-Authentication Rekey State Bypass in MikroTik RouterOS
Known exploited (KEV) (CISA)0 news outlets2 CERTs0 researchersCVSS 6.9 - 84impact
Improper Certificate Validation in Quantum Security Gateway
Known exploited (KEV) (CISA)0 news outlets0 CERTs0 researchersCVSS 9.8 - 68impact
Microsoft SharePoint Server Remote Code Execution Vulnerability
Known exploited (KEV) (CISA)0 news outlets0 CERTs0 researchersCVSS 8.8 - 86impact
Cisco Secure Email Gateway Arbitrary File Write Vulnerability
Known exploited (KEV) (CISA)0 news outlets1 CERTs0 researchersCVSS 9.8 - 95impact
Memory overflow vulnerability leading to Remote Code Execution or Denial of Service
Known exploited (KEV) (CISA)0 news outlets5 CERTs2 researchersCVSS 9.5 - 69impact
Authentication Bypass via JWT Algorithm Mismatch in Multiple WSO2 Products Allows Account Takeover
Known exploited (KEV) (CISA)0 news outlets0 CERTs0 researchersCVSS 10.0 - 80impact
Windows Shell Security Feature Bypass Vulnerability
Known exploited (KEV) (CISA)0 news outlets2 CERTs1 researchersCVSS 8.8 - 88impact
Improper Origin Validation in Internal Messaging Components of BeyondTrust Remote Support
Known exploited (KEV) (CISA)3 news outlets in 1 country6 CERTs6 researchersCVSS 9.3 - 74impact
The mod_copy module in ProFTPD 1.3.5 allows remote attackers to read and write to arbitrary files via the site cpfr and site cpto commands.
Known exploited (KEV) (CISA)0 news outlets0 CERTs0 researchersCVSS 10.0 - 83impact
An improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, FortiMail 7.6.0 throu
Known exploited (KEV) (CISA)0 news outlets0 CERTs0 researchersCVSS 9.8 - 76impact
Apache Struts 2.3.19 to 2.3.20.2, 2.3.21 to 2.3.24.1, and 2.3.25 to 2.3.28, when Dynamic Method Invocation is enabled, allow remote attackers to execute arbitra
Known exploited (KEV) (CISA)0 news outlets0 CERTs0 researchersCVSS 8.1 - 62impact
Undisclosed RCE in Zammad v6.3 and higher
Known exploited (KEV) (CISA)0 news outlets0 CERTs0 researchersCVSS 8.7 - 66impact
ipv6: account for fraggap on the paged allocation path
Known exploited (KEV) (CISA)0 news outlets0 CERTs0 researchersCVSS 7.8 - 93impact
Authentication bypass by spoofing in ICS before version 25.1.3.0 allows a remote unauthenticated attacker to execute arbitrary commands. This does not impact IC
Known exploited (KEV) (CISA)0 news outlets2 CERTs4 researchersCVSS 8.6 - 66impact
SiteGuard Server Edition contains an OS command injection vulnerability, which may allow an attacker to execute arbitrary OS commands with root or SYSTEM privil
Known exploited (KEV) (CISA)2 news outlets0 CERTs0 researchersCVSS 8.5 - 75impact
Ahsay AhsayCBS API ApiStructsAction.java checkSysPwd improper authentication
Known exploited (KEV) (CISA)0 news outlets2 CERTs1 researchersCVSS 7.3 - 83impact
Ahsay AhsayCBS Replication Receiver UpdateReceivers.do os command injection
Known exploited (KEV) (CISA)0 news outlets2 CERTs1 researchersCVSS 10.0 - 76impact
Adobe Commerce | Incorrect Authorization (CWE-863)
Known exploited (KEV) (CISA)0 news outlets0 CERTs0 researchersCVSS 9.1 - 69impact
netfilter: bridge: make ebt_snat ARP rewrite writable
Known exploited (KEV) (CISA)0 news outlets0 CERTs0 researchersCVSS 8.8
Sources
CERTs and cyber security agencies, national news outlets in every country we could find, vendor advisories, research blogs and the security press. Every source is polled on its own schedule, by RSS where possible and by headless browser where not. Broken feeds are repaired automatically; anything still failing is listed here.
Sources admin
Enter the admin token from your server’s .env file (ADMIN_TOKEN). It’s sent once to start a session and isn’t stored in this browser.
Recent sign-in activity
Pipeline, last 24 hours
How many articles each type of source produced, how many were read in full, and how many were linked to a vulnerability. “Unmatched” are articles that look like vulnerability news but couldn’t be linked; the reasons and examples show what to improve.
Add a source
Coverage
All sources
How it works
Vulnocalypse reads vulnerability registries, government CERTs, vendor advisories, research blogs and newsrooms around the clock, links everything that refers to the same vulnerability, and only shows what passes automated validation.
What gets into the feed
A vulnerability is admitted when it is corroborated, either through a published CVE record or through at least two independent organisations, and its impact score reaches 60 out of 100. Anything listed in a known-exploited catalogue is admitted regardless of score. Once admitted, an entry stays, so the feed never flickers.
Impact score
Up to 30 points for severity (CVSS, or inferred from the description when no score exists), 25 for exploitation, 15 for blast radius by product category (edge devices and identity systems score highest), 15 for attention from news, CERTs and researchers, 10 for EPSS exploitation probability, and 5 for pre-authentication. Every entry shows its breakdown.
Exploitation status
We only mark something exploited when there is a citable source: a KEV listing (CISA, VulnCheck or ENISA), a statement from the vendor or a government agency, CISA’s SSVC assessment, or at least two independent organisations reporting attacks with no later denial from the vendor. Phrases like “no evidence of exploitation” are detected and count against a claim.
Validation, without humans
Identifiers are checked against the CVE List; rejected or non-existent CVEs are dropped. Titles, vendors, products and CVSS come from the official record rather than from headlines. Wire stories syndicated across outlets are counted once. Roundups that list dozens of CVEs only count the ones they actually discuss. Reports without an identifier wait for corroboration and are merged into the right CVE once one is assigned. Every decision is logged and shown on each vulnerability’s page.
The Panic meter
Three numbers over the past 24 hours, counting only vulnerabilities first seen in the last 14 days: distinct researchers posting about them, distinct news organisations covering them, and distinct CERTs and agencies warning about them. Each is ranked against its own 90-day history, weighted 35% CERTs, 35% news and 30% researchers, and stretched so the top levels stay rare. Each day’s score is split across the vulnerabilities that caused it.
The outbreak map
The map shows two things for every country: how many national news outlets are covering new vulnerabilities, and whether the national CERT or cyber security agency has issued a warning. National outlets are read directly, through local-language Google News editions, and through GDELT, which attributes coverage in over 100 languages to its source country. International security press is left off the map so it shows national attention, not trade coverage. Replay the spread to watch a vulnerability travel from patient zero across the world.
Subscribe
- Everything (RSS), also as Atom and JSON Feed
- Exploited only and KEV-listed only
- Updates: new KEV listings, exploitation changes and public exploits for tracked vulnerabilities
- Per vendor:
/feed.xml?vendor=Fortinet, or by score:/feed.xml?min_score=80
Use it from an AI agent
Vulnocalypse runs a read-only MCP server. Add it to any MCP client as a remote server:
https://vulnocalypse.com/mcpTools: get_feed, search_vulnerabilities, get_vulnerability, check_exposure (send the products you run and get back anything that affects them), get_panic and explain_panic_day. The JSON API is documented at /api/docs.