Live tracker of exploited and high-impact vulnerabilities
New vulnerabilities from CERTs, vendors, researchers and newsrooms in 180+ countries, checked automatically, with how widely each one is being exploited, warned about and covered.
Panic meter
Connecting- Researchers talking
- –
- News outlets covering
- –
- CERTs and agencies warning
- –
Distinct people and organisations discussing new vulnerabilities in the past 24 hours.
Trending now
Outbreak map
- Countries in the news
- –
- Agencies warning
- –
- Countries warned
- –
- Patient zero
- –
Daily panic
Vulnerabilities
Apache Software Foundation vulnerabilities
Every Apache Software Foundation vulnerability Vulnocalypse is tracking, newest first: whether it’s being exploited, which CERTs have warned about it and how widely it’s covered. Subscribe with the RSS feed for Apache Software Foundation alerts.
Apache Software Foundation RSS feed
- 8impact
Apache Shiro: Brute force attack possible to determine valid user names
0 news outlets0 CERTs0 researchersCVSS 1.0 - 37impact
Apache CXF: No restriction on attachment headers per message
0 news outlets0 CERTs0 researchersCVSS 7.5 - 30impact
Apache ZooKeeper: Operational log forgery via newline injection in EnsembleAuthenticationProvider
0 news outlets0 CERTs0 researchersCVSS 5.3 - 21impact
Apache Portable Runtime Utility (APR-util): out-of-bounds writes in the apr_base64 family of functions
0 news outlets0 CERTs0 researchers - 37impact
Apache Neethi: Policy Normalization Unbounded Resource Allocation DoS
0 news outlets0 CERTs0 researchersCVSS 7.5 - 34impact
Apache Ignite: REST HTTP arbitrary file read vulnerability
0 news outlets0 CERTs0 researchersCVSS 8.5 - 37impact
Apache Neethi: Remote PolicyReference fetch lacks resource bounds
0 news outlets0 CERTs0 researchersCVSS 7.5 - 38impact
Apache Thrift: Ruby THeaderTransport ZLIB Decompression Bomb
0 news outlets0 CERTs0 researchersCVSS 7.5 - 36impact
Apache Thrift: c_glib heap out-of-bounds read in transport leftover-bytes path
0 news outlets0 CERTs0 researchersCVSS 6.9 - 24impact
Apache Commons IO: Possible denial of service attack on untrusted input to XmlStreamReader
0 news outlets0 CERTs0 researchersCVSS 4.3 - 43impact
Apache Thrift: C++ ZLIB heap buffer overflow (write) in THeaderTransport::untransform()
0 news outlets0 CERTs0 researchersCVSS 9.3 - 39impact
Apache Shiro: Authentication bypass in Guice-Web integration
0 news outlets0 CERTs0 researchersCVSS 8.2 - 41impact
Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift: TZlibTransport Decompression Size Limit
0 news outlets0 CERTs0 researchersCVSS 8.7 - 36impact
Apache ZooKeeper: Missing ACL check on deleteContainer opcode allows unauthorized deletion of any empty persistent/container znode
0 news outlets0 CERTs0 researchersCVSS 7.5 - 33impact
Apache Commons Lang, Apache Commons Lang: ClassUtils.getClass(...) can throw a StackOverflowError on very long inputs
0 news outlets0 CERTs0 researchersCVSS 5.3 - 41impact
Apache Shiro: LDAP DN Injection in DefaultLdapRealm
0 news outlets0 CERTs0 researchersCVSS 8.8 - 36impact
Apache ZooKeeper: Information disclosure via SetWatches reconnect replay
0 news outlets0 CERTs0 researchersCVSS 7.5 - 23impact
Apache Shiro Jakarta EE module: Open redirect and SSRF (requires valid credentials)
0 news outlets0 CERTs0 researchersCVSS 5.1 - 44impact
Apache MINA: CWE-502 Deserialization of Untrusted Data
0 news outlets0 CERTs0 researchersCVSS 9.8 - 38impact
Apache Thrift: Unbounded Zlib Decompression in Python THeaderTransport
0 news outlets0 CERTs0 researchersCVSS 7.5 - 25impact
Apache MINA SSHD: Remote execution of JGit commands can write files on the server
0 news outlets0 CERTs0 researchersCVSS 5.4 - 36impact
Apache Portable Runtime Utility: Heap buffer overflow in APR memcached client
0 news outlets0 CERTs0 researchersCVSS 7.5 - 44impact
Apache MINA: CWE-502 Deserialization of Untrusted Data (take 2)
0 news outlets0 CERTs0 researchersCVSS 9.8 - 24impact
Apache Shiro: Shiro's native session and rememberMe cookies do not have secure flag set by default
0 news outlets0 CERTs0 researchersCVSS 5.9 - 34impact
Apache ZooKeeper: Improper validation of certificate with host mismatch in FIPS mode
0 news outlets0 CERTs0 researchersCVSS 7.5 - 37impact
Apache Neethi: Circular Policy Reference Infinite Loop
0 news outlets0 CERTs0 researchersCVSS 7.5 - 37impact
Apache Neethi: Uncontrolled recursion in policy processing
0 news outlets0 CERTs0 researchersCVSS 7.5 - 37impact
Apache MINA SSHD: Path traversal in SCP file reception
0 news outlets0 CERTs0 researchersCVSS 7.5 - 37impact
Apache Neethi: Missing global alternative-output budget across policy computation paths
0 news outlets0 CERTs0 researchersCVSS 7.5 - 8impact
Apache Shiro: Jakarta EE open redirect via untrusted Referer in post-login redirect flow
0 news outlets0 CERTs0 researchers - 26impact
Apache Shiro: Session fixation: new session is not created after login by default
0 news outlets0 CERTs0 researchersCVSS 5.9 - 37impact
Apache Neethi: Uncontrolled recursion while parsing crafted WS-Policy documents allows denial of service
0 news outlets0 CERTs0 researchersCVSS 7.5 - 41impact
Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift: integer overflow in TProtocol::checkReadBytesAvailable()
0 news outlets0 CERTs0 researchersCVSS 8.7 - 23impact
Apache Portable Runtime (APR): Unexpected lax shared memory permissions
0 news outlets0 CERTs0 researchersCVSS 5.5 - 30impact
Apache ZooKeeper: Audit log injection via unsanitized output from multiple sources
0 news outlets0 CERTs0 researchersCVSS 5.3 - 40impact
Apache Kafka Connect API: Possible RCE/Denial of service attack via SASL JAAS JndiLoginModule configuration using Kafka Connect
0 news outlets0 CERTs0 researchersCVSS 8.8 - 35impact
Apache Abdera: XML external entity expansion in Atom document parsing
0 news outlets0 CERTs1 researchersCVSS 7.5 - 29impact
Apache HttpComponents Client: Connection Leak on Content-Encoding Decode Error Leads to Pool Exhaustion DoS
0 news outlets0 CERTs0 researchersCVSS 5.3 - 33impact
Apache Neethi: Unrestricted HTTP Redirect Following in Policy References
0 news outlets0 CERTs0 researchersCVSS 6.5 - 44impact
Apache MINA: AbstractIoBuffer.resolveClass() null-clazz Branch Skips acceptMatchers Filter — Full Object Deserialization RCE (take 2)
0 news outlets0 CERTs0 researchersCVSS 9.8 - 44impact
Apache MINA: AbstractIoBuffer.resolveClass() null-clazz Branch Skips acceptMatchers Filter — Full Object Deserialization RCE
0 news outlets0 CERTs0 researchersCVSS 9.8 - 47impact
Apache SOAP allows unauthenticated users to potentially invoke arbitrary code
0 news outlets0 CERTs0 researchersCVSS 9.8 - 36impact
Apache Traffic Server: tsmemcache plugin exposes the shared proxy cache over the network with no authentication
0 news outlets0 CERTs0 researchersCVSS 9.0 - 39impact
Apache Traffic Server: TLS session ticket resumption bypasses per-SNI verify_client STRICT enforcement
0 news outlets0 CERTs0 researchersCVSS 10.0 - 39impact
Apache Traffic Server: Default server_session_sharing.match omits MASK_CERT, allowing pooled mTLS identity confusion at the origin
0 news outlets0 CERTs0 researchersCVSS 10.0 - 39impact
Apache Traffic Server: magick plugin passes client query strings unfiltered to ImageMagick convert in the default configuration
0 news outlets0 CERTs0 researchersCVSS 10.0 - 12impact
Apache Shiro: Remember-me cookie isn't checked for expiry on the server
0 news outlets0 CERTs0 researchersCVSS 2.0 - 41impact
Apache Thrift: Rust binary protocol non-strict path missing string size limit
0 news outlets0 CERTs0 researchersCVSS 8.7 - 40impact
Apache Portable Runtime Utility: apr-util XML stack recursion crash
0 news outlets0 CERTs0 researchersCVSS 9.1 - 37impact
Apache HttpComponents Core: Unbounded HTTP Header/Line Length in Default Configuration
0 news outlets0 CERTs0 researchersCVSS 7.5 - 36impact
Apache HttpClient: SCRAM-SHA-256 mutual authentication bypass may cause the client to accept authentication without proper mutual authentication verification
0 news outlets0 CERTs0 researchersCVSS 7.3 - 37impact
Apache HttpComponents Core: HPackDecoder Unlimited Header List Size Before SETTINGS ACK
0 news outlets0 CERTs0 researchersCVSS 7.5 - 38impact
Apache HttpComponents: PSL (Public Suffix List) validation bypass
0 news outlets0 CERTs0 researchersCVSS 7.5 - 45impact
Apache Commons BeanUtils: PropertyUtilsBean does not suppresses an enum's declaredClass property by default
0 news outlets2 CERTs0 researchersCVSS 8.8 - 37impact
Apache Thrift: C++ TSSLSocket matchName() RFC 6125 Wildcard Bypass
0 news outlets0 CERTs0 researchersCVSS 8.2 - 42impact
Apache Thrift: C++ THeaderTransport::readString() info-header length bounds bypass
0 news outlets0 CERTs0 researchersCVSS 8.7 - 40impact
Apache Thrift: c_glib TLS Client Missing Hostname Verification
0 news outlets0 CERTs0 researchersCVSS 9.1 - 32impact
Apache Thrift: Rust implementation vulnerable to CVE-2020-13949 pattern
0 news outlets0 CERTs0 researchersCVSS 5.3 - 34impact
Apache Thrift: C++ JSON OOB read
0 news outlets0 CERTs0 researchersCVSS 6.5 - 35impact
Apache Thrift: C++ heap out-of-bounds read in THeaderTransport::readHeaderFormat()
0 news outlets0 CERTs0 researchersCVSS 6.9 - 31impact
Apache Thrift: c_glib dispatch stack overflow
0 news outlets0 CERTs0 researchersCVSS 5.3 - 42impact
Apache Xalan Java XSLT library is vulnerable to an integer truncation issue when processing malicious XSLT stylesheets
0 news outlets0 CERTs0 researchersCVSS 7.5 - 29impact
Apache CXF: XML External Entity (XXE) Injection in W3CMultiSchemaFactory and EndpointReferenceUtils
0 news outlets0 CERTs0 researchersCVSS 6.5 - 38impact
Apache Thrift: Swift Compact Protocol integer overflow
0 news outlets0 CERTs0 researchersCVSS 7.3 - 42impact
Apache FreeMarker, Apache FreeMarker: A malformed locale may be exploitable for path traversal attacks
0 news outlets0 CERTs0 researchersCVSS 9.1 - 24impact
Infinite loop within Apache XercesJ xml parser
0 news outlets0 CERTs0 researchers - 40impact
Apache Thrift: Swift Range crash in skip()
0 news outlets0 CERTs0 researchersCVSS 8.2 - 48impact
Java deserialization in Chainsaw
0 news outlets0 CERTs0 researchersCVSS 9.8 - 23impact
Apache Hive: SQL injection vulnerability when processing delete column statistics requests via the HMS Thrift APIs
0 news outlets0 CERTs0 researchersCVSS 5.4 - 40impact
Apache CXF: JNDI Injection vulnerability in DispatchMDBMessageListenerImpl
0 news outlets0 CERTs0 researchersCVSS 8.1 - 40impact
Apache MINA SSHD: Asynchronous authentication can bypass signature verification
0 news outlets0 CERTs0 researchersCVSS 9.1 - 42impact
Apache MyFaces: Server-Side Request Forgery / Local File Inclusion Vulnerability
0 news outlets0 CERTs0 researchersCVSS 9.8 - 28impact
Apache CXF: Authentication Bypass in OAuth2 TokenIntrospectionService
0 news outlets0 CERTs0 researchersCVSS 4.8 - 36impact
Apache Thrift: TSSLTransportFactory.java hostname verification
0 news outlets0 CERTs0 researchersCVSS 7.3 - 29impact
Apache Thrift: Python TSSLSocket Hostname Matcher Import
0 news outlets0 CERTs0 researchersCVSS 5.9 - 31impact
Apache Commons Configuration: StackOverflowError for YAML input with cycles
0 news outlets0 CERTs0 researchersCVSS 5.3 - 36impact
Apache MyFaces: Denial of Service via Unbounded Request Parsing
0 news outlets0 CERTs0 researchersCVSS 7.5 - 30impact
Apache ZooKeeper: Sensitive information disclosure in client configuration handling
0 news outlets0 CERTs0 researchersCVSS 6.5 - 36impact
Apache Ant: Path traversal in ftp and scp tasks allows arbitrary file write
0 news outlets0 CERTs0 researchersCVSS 7.4 - 38impact
Apache Thrift: Go TFramedTransport uint32 overflow
0 news outlets0 CERTs0 researchersCVSS 7.5 - 31impact
Apache CXF: WS JSON request filter trusts metadata from an unvalidated first signature entry
0 news outlets0 CERTs0 researchersCVSS 6.5 - 32impact
Apache ZooKeeper: Reverse-DNS fallback enables hostname verification bypass in ZooKeeper ZKTrustManager
0 news outlets0 CERTs0 researchersCVSS 5.9 - 24impact
block repositories using http by default
0 news outlets0 CERTs0 researchers - 38impact
Apache Thrift: Specially crafted input can crash a c_glib Thrift server with invalid pointer error.
0 news outlets0 CERTs0 researchersCVSS 7.5
Sources
CERTs and cyber security agencies, national news outlets in every country we could find, vendor advisories, research blogs and the security press. Every source is polled on its own schedule, by RSS where possible and by headless browser where not. Broken feeds are repaired automatically; anything still failing is listed here.
Sources admin
Enter the admin token from your server’s .env file (ADMIN_TOKEN). It’s sent once to start a session and isn’t stored in this browser.
Recent sign-in activity
Pipeline, last 24 hours
How many articles each type of source produced, how many were read in full, and how many were linked to a vulnerability. “Unmatched” are articles that look like vulnerability news but couldn’t be linked; the reasons and examples show what to improve.
Add a source
Coverage
All sources
How it works
Vulnocalypse reads vulnerability registries, government CERTs, vendor advisories, research blogs and newsrooms around the clock, links everything that refers to the same vulnerability, and only shows what passes automated validation.
What gets into the feed
A vulnerability is admitted when it is corroborated, either through a published CVE record or through at least two independent organisations, and its impact score reaches 60 out of 100. Anything listed in a known-exploited catalogue is admitted regardless of score. Once admitted, an entry stays, so the feed never flickers.
Impact score
Up to 30 points for severity (CVSS, or inferred from the description when no score exists), 25 for exploitation, 15 for blast radius by product category (edge devices and identity systems score highest), 15 for attention from news, CERTs and researchers, 10 for EPSS exploitation probability, and 5 for pre-authentication. Every entry shows its breakdown.
Exploitation status
We only mark something exploited when there is a citable source: a KEV listing (CISA, VulnCheck or ENISA), a statement from the vendor or a government agency, CISA’s SSVC assessment, or at least two independent organisations reporting attacks with no later denial from the vendor. Phrases like “no evidence of exploitation” are detected and count against a claim.
Validation, without humans
Identifiers are checked against the CVE List; rejected or non-existent CVEs are dropped. Titles, vendors, products and CVSS come from the official record rather than from headlines. Wire stories syndicated across outlets are counted once. Roundups that list dozens of CVEs only count the ones they actually discuss. Reports without an identifier wait for corroboration and are merged into the right CVE once one is assigned. Every decision is logged and shown on each vulnerability’s page.
The Panic meter
Three numbers over the past 24 hours, counting only vulnerabilities first seen in the last 14 days: distinct researchers posting about them, distinct news organisations covering them, and distinct CERTs and agencies warning about them. Each is ranked against its own 90-day history, weighted 35% CERTs, 35% news and 30% researchers, and stretched so the top levels stay rare. Each day’s score is split across the vulnerabilities that caused it.
The outbreak map
The map shows two things for every country: how many national news outlets are covering new vulnerabilities, and whether the national CERT or cyber security agency has issued a warning. National outlets are read directly, through local-language Google News editions, and through GDELT, which attributes coverage in over 100 languages to its source country. International security press is left off the map so it shows national attention, not trade coverage. Replay the spread to watch a vulnerability travel from patient zero across the world.
Subscribe
- Everything (RSS), also as Atom and JSON Feed
- Exploited only and KEV-listed only
- Updates: new KEV listings, exploitation changes and public exploits for tracked vulnerabilities
- Per vendor:
/feed.xml?vendor=Fortinet, or by score:/feed.xml?min_score=80
Use it from an AI agent
Vulnocalypse runs a read-only MCP server. Add it to any MCP client as a remote server:
https://vulnocalypse.com/mcpTools: get_feed, search_vulnerabilities, get_vulnerability, check_exposure (send the products you run and get back anything that affects them), get_panic and explain_panic_day. The JSON API is documented at /api/docs.