Live tracker of exploited and high-impact vulnerabilities
New vulnerabilities from CERTs, vendors, researchers and newsrooms in 180+ countries, checked automatically, with how widely each one is being exploited, warned about and covered.
Panic meter
Connecting- Researchers talking
- –
- News outlets covering
- –
- CERTs and agencies warning
- –
Distinct people and organisations discussing new vulnerabilities in the past 24 hours.
Trending now
Outbreak map
- Countries in the news
- –
- Agencies warning
- –
- Countries warned
- –
- Patient zero
- –
Daily panic
Vulnerabilities
Apache vulnerabilities
Every Apache vulnerability Vulnocalypse is tracking, newest first: whether it’s being exploited, which CERTs have warned about it and how widely it’s covered. Subscribe with the RSS feed for Apache alerts.
- 81impact
Path Traversal and Remote Code Execution in Apache HTTP Server 2.4.49 and 2.4.50 (incomplete fix of CVE-2021-41773)
Known exploited (KEV) (CISA)0 news outlets1 CERTs0 researchersCVSS 9.8 - 76impact
Apache Struts 2.3.19 to 2.3.20.2, 2.3.21 to 2.3.24.1, and 2.3.25 to 2.3.28, when Dynamic Method Invocation is enabled, allow remote attackers to execute arbitra
Known exploited (KEV) (CISA)0 news outlets0 CERTs0 researchersCVSS 8.1 - 73impact
Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Authenticated users could perform RCE via Jolokia MBeans
Known exploited (KEV) (CISA)0 news outlets1 CERTs0 researchersCVSS 8.8 - 42impact
Apache Tomcat: Security constraints for default servlet ignored method
0 news outlets0 CERTs0 researchersCVSS 6.5 - 40impact
Apache Tomcat: OCSP checks sometimes soft-fail with FFM even when soft-fail is disabled
0 news outlets0 CERTs0 researchersCVSS 6.5 - 43impact
Apache Tomcat: Cloud membership for clustering component exposed the Kubernetes bearer token
0 news outlets0 CERTs0 researchersCVSS 7.5 - 44impact
Apache Log4j 1 to Log4j 2 bridge: Silent log event loss in Log4j1XmlLayout due to unescaped XML 1.0 forbidden characters
0 news outlets0 CERTs0 researchersCVSS 6.9 - 48impact
Apache Tomcat: Authentication bypass with JNDIRealm and GSSAPI authenticated bind
0 news outlets0 CERTs0 researchersCVSS 7.3 - 42impact
Apache HTTP Server: ProxyPassReverseCookieMap buffer overflow
0 news outlets0 CERTs0 researchersCVSS 7.5 - 31impact
inets, httpd: Authentication Bypass via Directory Namespace Collapse in httpd mod_auth
0 news outlets0 CERTs0 researchersCVSS 6.0 - 43impact
Apache Tomcat: Incomplete escaping of JSON access logs
0 news outlets0 CERTs0 researchersCVSS 7.5 - 44impact
Apache Tomcat: DoS via WebSocket chat example
0 news outlets0 CERTs0 researchersCVSS 7.5 - 74impact
Apache Tomcat: Fix for CVE-2026-29146 allowed bypass of EncryptInterceptor
Known exploited (KEV) (CISA)0 news outlets0 CERTs0 researchersCVSS 7.5 - 41impact
Apache HTTP Server: Loop in `proxy_ftp_handler` in mod_proxy_ftp
0 news outlets0 CERTs0 researchersCVSS 7.3 - 56impact
Apache Tomcat: Authentication bypass when using Jakarta Authentication API
0 news outlets0 CERTs0 researchersCVSS 9.8 - 54impact
Apache Tomcat: Digest authenticator will authenticate any unknown user
0 news outlets0 CERTs0 researchersCVSS 9.8 - 32impact
Apache Tomcat: AJP secret compared in non-constant time
0 news outlets0 CERTs0 researchersCVSS 3.7 - 33impact
Apache HTTP Server: mod_proxy_ftp XSS
0 news outlets0 CERTs0 researchersCVSS 6.1 - 51impact
Apache Tomcat: Security constraints not correctly applied
0 news outlets0 CERTs0 researchersCVSS 9.1 - 82impact
Apache Tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT
Known exploited (KEV) (CISA)0 news outlets0 CERTs0 researchersCVSS 10.0 - 49impact
Apache Tomcat: Invalid CRL configuration doesn't trigger failure for FFM Connector
0 news outlets0 CERTs0 researchersCVSS 9.1 - 41impact
Apache Log4j Core: Missing TLS hostname verification in Socket appender
0 news outlets0 CERTs0 researchersCVSS 6.3 - 44impact
Apache Tomcat: Bad ornext processing in RewriteValve
0 news outlets0 CERTs0 researchersCVSS 7.3 - 42impact
Apache HTTP Server: mod_proxy_html buffer overflow
0 news outlets0 CERTs0 researchersCVSS 7.5 - 40impact
curl curl: This flaw allows a malicious HTTP server to set "super cookies" in curl that are then passed back to more origins than w
0 news outlets0 CERTs0 researchersCVSS 6.5 - 41impact
Apache HTTP Server: mod_http2 memory corruption when file handles exhausted
0 news outlets0 CERTs0 researchersCVSS 7.3 - 39impact
Apache Tomcat: XSS in number guess example
0 news outlets0 CERTs0 researchersCVSS 6.1 - 49impact
Apache Tomcat: Logged effective web.xml is incomplete
0 news outlets0 CERTs0 researchersCVSS 9.1 - 44impact
Apache Tomcat: WebSocket authentication header exposure
0 news outlets0 CERTs0 researchersCVSS 7.3 - 49impact
Apache HTTP Server: mod_http2 denial of service
0 news outlets1 CERTs0 researchersCVSS 7.5 - 44impact
Apache Tomcat: LockOutRealm treats user names as case-sensitive
0 news outlets0 CERTs0 researchersCVSS 7.5 - 40impact
Apache Tomcat: EncryptInterceptor not protected against replay attacks
0 news outlets0 CERTs0 researchersCVSS 6.5 - 41impact
Apache Tomcat: Security constraint bypass with HTTP/0.9
0 news outlets0 CERTs0 researchersCVSS 6.5 - 42impact
inets, httpd: HTTP Request Smuggling via Transfer-Encoding and Content-Length
0 news outlets0 CERTs0 researchersCVSS 8.3 - 45impact
Apache Tomcat: Unbounded read in WebDAV LOCK and PROPFIND handling
0 news outlets0 CERTs0 researchersCVSS 7.5 - 43impact
inets,httpd:HTTP Request Smuggling via obs-fold Header Continuation
0 news outlets0 CERTs0 researchersCVSS 8.3 - 47impact
Apache Struts: File leak in multipart request processing causes disk exhaustion (DoS)
0 news outlets0 CERTs0 researchersCVSS 7.5 - 44impact
inets,httpd: Memory Exhaustion via Unenforced max_body_size During Chunked Body Reception
0 news outlets0 CERTs0 researchersCVSS 8.7 - 50impact
Apache Tomcat: Fix for CVE-2026-34500 was incomplete. OCSP checks sometimes soft-fail with FFM even when soft-fail is disabled
0 news outlets0 CERTs0 researchersCVSS 9.8 - 48impact
Apache HTTP Server: Heap Underflow in `ap_regname` via Signed Char Overflow
0 news outlets0 CERTs0 researchersCVSS 9.8 - 39impact
Apache HTTP Server: OOB Read in `merge_response_headers` can cause crash
0 news outlets0 CERTs0 researchersCVSS 6.5 - 27impact
Apache HTTP Server: escalation of privilege through expressions in .htaccess in multiple modules
0 news outlets0 CERTs0 researchersCVSS 5.5 - 26impact
- 44impact
Apache Log4j Core: Silent log event loss in XmlLayout due to unescaped XML 1.0 forbidden characters
0 news outlets0 CERTs0 researchersCVSS 6.9 - 46impact
Apache HTTP Server: mod_dav_fs protected directory access
0 news outlets0 CERTs0 researchersCVSS 9.1 - 45impact
Apache Tomcat: Request smuggling via invalid chunk extension
0 news outlets0 CERTs0 researchersCVSS 7.5 - 27impact
Local privilege escalation with FileStore
0 news outlets0 CERTs0 researchers - 44impact
Apache Log4j Core: Log injection in Rfc5424Layout due to silent configuration incompatibility
0 news outlets0 CERTs0 researchersCVSS 6.9 - 44impact
Apache HTTP Server: mod_xml2enc heap overflow
0 news outlets0 CERTs0 researchersCVSS 7.5 - 42impact
Apache ActiveMQ Client, Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Incorrect handling of TLSv1.3 KeyUpdate can be exploited to cause DoS via OOM
0 news outlets0 CERTs0 researchersCVSS 7.5 - 40impact
Apache HTTP Server: Stack Buffer Over-Read in mod_ssl OCSP `send_request`
0 news outlets0 CERTs0 researchersCVSS 7.3 - 78impact
Apache ActiveMQ, Apache ActiveMQ Legacy OpenWire Module: Unbounded deserialization causes ActiveMQ to be vulnerable to a remote code execution (RCE) attack
Known exploited (KEV) (CISA)0 news outlets0 CERTs0 researchersCVSS 10.0 - 32impact
Apache Tomcat: Fix for CVE-2023-24998 is incomplete
0 news outlets0 CERTs0 researchers - 49impact
Apache Tomcat: DoS via malformed HTTP/2 PRIORITY_UPDATE frame
0 news outlets0 CERTs0 researchersCVSS 7.5 - 36impact
Apache HTTP Server: HTTP Response Splitting in multiple modules
0 news outlets0 CERTs0 researchersCVSS 6.3 - 46impact
Apache HTTP Server: HTTP/2 DoS by memory exhaustion on endless continuation frames
0 news outlets0 CERTs0 researchersCVSS 7.5 - 44impact
Apache HTTP Server: HTTP response splitting
0 news outlets0 CERTs0 researchersCVSS 7.3 - 52impact
Apache HTTP Server may use exploitable/malicious backend application output to run local handlers via internal redirect
0 news outlets0 CERTs0 researchersCVSS 9.8 - 44impact
Apache HTTP Server: Crash resulting in Denial of Service in mod_proxy via a malicious request
0 news outlets0 CERTs0 researchersCVSS 7.5 - 45impact
Apache HTTP Server: mod_rewrite proxy handler substitution
0 news outlets0 CERTs0 researchersCVSS 7.5 - 41impact
Apache HTTP Server: NTLM Leakage on Windows through UNC SSRF
0 news outlets0 CERTs0 researchersCVSS 7.5 - 29impact
Apache HTTP Server: mod_userdir+suexec bypass via AllowOverride FileInfo
0 news outlets0 CERTs0 researchersCVSS 5.4 - 40impact
Apache HTTP Server: Server Side Includes adds query string to #exec cmd=...
0 news outlets0 CERTs0 researchersCVSS 8.3 - 39impact
Apache HTTP Server: mod_md (ACME), unintended retry intervals
0 news outlets0 CERTs0 researchersCVSS 7.5 - 38impact
Apache HTTP Server: CGI environment variable override
0 news outlets0 CERTs0 researchersCVSS 6.5 - 48impact
Apache HTTP Server: http2: double free and possible RCE on early reset
0 news outlets1 CERTs0 researchersCVSS 8.8 - 32impact
Oracle Corporation Oracle HTTP Server: Vulnerability in the Oracle HTTP Server product of Oracle Fusion Middleware (component: Web Listener). The supported v
0 news outlets0 CERTs0 researchersCVSS 7.8 - 42impact
Oracle E-Business Suite: Vulnerability in the Oracle HTTP Server product of Oracle Fusion Middleware (component: Oracle Weblogic Server Proxy Plu
0 news outlets0 CERTs0 researchersCVSS 8.7 - 40impact
Apache Log4j Core: verifyHostName attribute silently ignored in TLS configuration, allowing hostname verification bypass
0 news outlets0 CERTs0 researchersCVSS 6.3 - 32impact
Oracle Corporation Oracle HTTP Server: Vulnerability in the Oracle HTTP Server product of Oracle Fusion Middleware (component: OSSL Module). The supported ve
0 news outlets0 CERTs0 researchersCVSS 7.8 - 40impact
Oracle Corporation Oracle HTTP Server: Vulnerability in the Oracle HTTP Server product of Oracle Fusion Middleware (component: OSSL Module). Supported version
0 news outlets0 CERTs0 researchersCVSS 9.6 - 48impact
Apache HTTP Server: mod_ldap per-dir use-after-free
0 news outlets0 CERTs0 researchersCVSS 9.8 - 30impact
Apache Tomcat: Jasper JSTL <c:redirect> plug-in implementation omits page abort (SKIP_PAGE)
0 news outlets2 CERTs0 researchers - 30impact
Apache Tomcat: OpenSSL-FFM FIPS failure does not prevent start-up
0 news outlets2 CERTs0 researchers - 29impact
Apache Tomcat: TOCTOU when setting specific permissions for Unix Domain Sockets - Fix for CVE-2026-65183 did not address APR connector
0 news outlets2 CERTs0 researchers - 57impact
Apache Tomcat: HTTP/2 request/response mix-up after error during async processing
0 news outlets3 CERTs0 researchersCVSS 9.1 - 57impact
Apache Tomcat: AJP response mix-up
0 news outlets3 CERTs0 researchersCVSS 9.1 - 30impact
Apache Tomcat: HTTP/2 trailer header cross-contamination
0 news outlets2 CERTs0 researchers - 57impact
Apache Tomcat: JNDIRealm bind credential validation fails open for non-GSSAPI SASL mechanisms
0 news outlets3 CERTs0 researchersCVSS 9.1 - 45impact
trailing dot domain super cookie
0 news outlets0 CERTs0 researchersCVSS 9.1 - 32impact
Apache HTTP Server: DoS in HTTP/2 with initial windows size 0
0 news outlets1 CERTs0 researchers - 30impact
Apache Tomcat: Possible TLS 1.3 connection failures
0 news outlets2 CERTs0 researchers - 64impact
SQL injection in JDBC Appender in Apache Log4j V1
Public exploit code0 news outlets0 CERTs0 researchersCVSS 9.8 - 42impact
Apache Tomcat: WebSocket DoS due to lost asynchronous write timeout
0 news outlets0 CERTs0 researchersCVSS 7.5 - 45impact
Apache Tomcat: DoS via allocation leak in HTTP/2 backlog tracking when a stream is reset
0 news outlets0 CERTs0 researchersCVSS 7.5 - 42impact
Apache Tomcat: AJP DoS via missing request body
0 news outlets0 CERTs0 researchersCVSS 7.5 - 48impact
A deserialization flaw in the Chainsaw component of Log4j 1 can lead to malicious code execution.
0 news outlets0 CERTs0 researchersCVSS 8.8 - 40impact
Apache Tomcat: Cross-context authentication mix-up with Jakarta Authentication configured
0 news outlets0 CERTs0 researchersCVSS 7.3 - 40impact
Apache Tomcat: Principal lookup can fail open in some cases
0 news outlets0 CERTs0 researchersCVSS 8.1 - 38impact
Apache Log4j: Improper validation of certificate with host mismatch in Apache Log4j SMTP appender. This could allow an SMTPS connectio
0 news outlets0 CERTs0 researchersCVSS 3.7 - 41impact
Apache Log4j API: Improper serialization of non-finite floating-point values in MapMessage.asJson()
0 news outlets0 CERTs0 researchersCVSS 6.3 - 42impact
Apache Log4j JSON Template Layout: Improper serialization of non-finite floating-point values in JsonTemplateLayout
0 news outlets0 CERTs0 researchersCVSS 6.3 - 44impact
Deserialization of untrusted data in JMSAppender in Apache Log4j 1.2
0 news outlets0 CERTs0 researchersCVSS 7.5 - 85impact
Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints
Known exploited (KEV) (CISA)0 news outlets0 CERTs1 researchersCVSS 10.0 - 48impact
Apache Tomcat: Redirect after FORM auth may bypass method specific constraints
0 news outlets0 CERTs0 researchersCVSS 9.1 - 56impact
Apache Log4j: Included in Log4j 1.2 is a SocketServer class that is vulnerable to deserialization of untrusted data which can be explo
0 news outlets0 CERTs0 researchersCVSS 9.8 - 48impact
Apache Tomcat: EncryptInterceptor requirements not clearly documented
0 news outlets0 CERTs0 researchersCVSS 9.1 - 44impact
Apache Tomcat: DoS via busy wait during WebSocket close
0 news outlets0 CERTs0 researchersCVSS 7.5 - 47impact
Apache Tomcat: Incorrect URL decoding in RewriteValve may allow security control bypass
0 news outlets0 CERTs0 researchersCVSS 9.1 - 49impact
Apache Tomcat: Bypass longest prefix security constraint
0 news outlets0 CERTs0 researchersCVSS 9.1
Sources
CERTs and cyber security agencies, national news outlets in every country we could find, vendor advisories, research blogs and the security press. Every source is polled on its own schedule, by RSS where possible and by headless browser where not. Broken feeds are repaired automatically; anything still failing is listed here.
Sources admin
Enter the admin token from your server’s .env file (ADMIN_TOKEN). It’s sent once to start a session and isn’t stored in this browser.
Recent sign-in activity
Pipeline, last 24 hours
How many articles each type of source produced, how many were read in full, and how many were linked to a vulnerability. “Unmatched” are articles that look like vulnerability news but couldn’t be linked; the reasons and examples show what to improve.
Add a source
Coverage
All sources
How it works
Vulnocalypse reads vulnerability registries, government CERTs, vendor advisories, research blogs and newsrooms around the clock, links everything that refers to the same vulnerability, and only shows what passes automated validation.
What gets into the feed
A vulnerability is admitted when it is corroborated, either through a published CVE record or through at least two independent organisations, and its impact score reaches 60 out of 100. Anything listed in a known-exploited catalogue is admitted regardless of score. Once admitted, an entry stays, so the feed never flickers.
Impact score
Up to 30 points for severity (CVSS, or inferred from the description when no score exists), 25 for exploitation, 15 for blast radius by product category (edge devices and identity systems score highest), 15 for attention from news, CERTs and researchers, 10 for EPSS exploitation probability, and 5 for pre-authentication. Every entry shows its breakdown.
Exploitation status
We only mark something exploited when there is a citable source: a KEV listing (CISA, VulnCheck or ENISA), a statement from the vendor or a government agency, CISA’s SSVC assessment, or at least two independent organisations reporting attacks with no later denial from the vendor. Phrases like “no evidence of exploitation” are detected and count against a claim.
Validation, without humans
Identifiers are checked against the CVE List; rejected or non-existent CVEs are dropped. Titles, vendors, products and CVSS come from the official record rather than from headlines. Wire stories syndicated across outlets are counted once. Roundups that list dozens of CVEs only count the ones they actually discuss. Reports without an identifier wait for corroboration and are merged into the right CVE once one is assigned. Every decision is logged and shown on each vulnerability’s page.
The Panic meter
Three numbers over the past 24 hours, counting only vulnerabilities first seen in the last 14 days: distinct researchers posting about them, distinct news organisations covering them, and distinct CERTs and agencies warning about them. Each is ranked against its own 90-day history, weighted 35% CERTs, 35% news and 30% researchers, and stretched so the top levels stay rare. Each day’s score is split across the vulnerabilities that caused it.
The outbreak map
The map shows two things for every country: how many national news outlets are covering new vulnerabilities, and whether the national CERT or cyber security agency has issued a warning. National outlets are read directly, through local-language Google News editions, and through GDELT, which attributes coverage in over 100 languages to its source country. International security press is left off the map so it shows national attention, not trade coverage. Replay the spread to watch a vulnerability travel from patient zero across the world.
Subscribe
- Everything (RSS), also as Atom and JSON Feed
- Exploited only and KEV-listed only
- Updates: new KEV listings, exploitation changes and public exploits for tracked vulnerabilities
- Per vendor:
/feed.xml?vendor=Fortinet, or by score:/feed.xml?min_score=80
Use it from an AI agent
Vulnocalypse runs a read-only MCP server. Add it to any MCP client as a remote server:
https://vulnocalypse.com/mcpTools: get_feed, search_vulnerabilities, get_vulnerability, check_exposure (send the products you run and get back anything that affects them), get_panic and explain_panic_day. The JSON API is documented at /api/docs.