Live tracker of exploited and high-impact vulnerabilities
New vulnerabilities from CERTs, vendors, researchers and newsrooms in 180+ countries, checked automatically, with how widely each one is being exploited, warned about and covered.
Panic meter
Connecting- Researchers talking
- –
- News outlets covering
- –
- CERTs and agencies warning
- –
Distinct people and organisations discussing new vulnerabilities in the past 24 hours. Get alerts when it changes
Trending now
Outbreak map
- Countries in the news
- –
- Agencies warning
- –
- Countries warned
- –
- Patient zero
- –
Daily panic
Vulnerabilities
Alerts
Get told when the Panic meter changes level or surges, and when new vulnerabilities are confirmed exploited or warned about by CERTs in several countries. Every alert says what’s driving it, who’s warning, how widely it’s covered and where the fix is.
Browser notifications
Notifications on this device, even when the site isn’t open. On iPhone and iPad, add Vulnocalypse to your Home Screen first.
Slack, Teams, Discord or webhook
Paste an incoming webhook URL. We send a test message first and only connect it if it arrives.
Where do I get a webhook URL?
Slack: create an app with Incoming Webhooks enabled, add it to a channel and copy the URL. Microsoft Teams: in the channel, use Workflows → “Post to a channel when a webhook request is received”. Discord: channel settings → Integrations → Webhooks → New webhook → Copy URL. Anything else: any HTTPS endpoint that accepts JSON; you’ll get a secret to verify our signature.
RSS
No sign-up and nothing stored: subscribe to /alerts.xml in any feed reader.
Your alerts on this browser
Recent alerts
Privacy
We store only what’s needed to deliver alerts: your browser’s push address and encryption keys (random values your browser creates, with no name or email) or the webhook URL you enter, plus your choices above. No accounts, no IP addresses and no tracking. Removing an alert here, or using the manage link in any message, deletes it immediately.
Brocade vulnerabilities
Every Brocade vulnerability Vulnocalypse is tracking, newest first: whether it’s being exploited, which CERTs have warned about it and how widely it’s covered. Subscribe with the RSS feed for Brocade alerts.
- 29impact
Brocade Fabric OS: An OS command injection vulnerability exists in the PAM (Pluggable Authentication Module) session cleanup routines durin
0 news outlets0 CERTs0 researchersCVSS 5.4 - 26impact
Brocade Fabric OS: An input validation and output encoding vulnerability exists in the web management interface of Brocade Fabric OS versio
0 news outlets0 CERTs0 researchersCVSS 6.9 - 30impact
Brocade Fabric OS: A session context forgery vulnerability exists in the web management daemon of Brocade Fabric OS versions 9.2.2d and 10.
0 news outlets0 CERTs0 researchersCVSS 8.5 - 33impact
Brocade Fabric OS: A stack-based buffer overflow vulnerability exists in the Internet Key Exchange (IKEv2) protocol handler on Brocade Fabr
0 news outlets0 CERTs0 researchersCVSS 6.0 - 25impact
Brocade Fabric OS: An improper file permission and missing authorization vulnerability exists in the diagnostic kernel module subsystem of
0 news outlets0 CERTs0 researchersCVSS 7.0 - 35impact
Brocade Fabric OS: An authentication bypass and command injection vulnerability exists in the inter-switch remote execution service of Broc
0 news outlets0 CERTs0 researchersCVSS 7.1 - 27impact
Brocade Fabric OS: A critical authorization bypass vulnerability exists in the Management Server handling of Brocade Fabric OS versions bef
0 news outlets0 CERTs0 researchersCVSS 7.1 - 11impact
Brocade Fabric OS: A race condition and thread-safety vulnerability exists in the web management daemon of Brocade Fabric OS versions befor
0 news outlets0 CERTs0 researchersCVSS 2.1 - 20impact
Brocade Fabric OS: An authorization logic vulnerability exists in the Brocade Fabric OS versions before 10.0.1 REST API gateway. The intern
0 news outlets0 CERTs0 researchersCVSS 5.1 - 25impact
Brocade Fabric OS: A logic vulnerability in Brocade Fabric OS versions before 10.0.1 web management framework allows an authenticated, low-
0 news outlets0 CERTs0 researchersCVSS 6.9 - 33impact
Brocade Fabric OS: An OS command injection vulnerability exists in maintenance command-line diagnostic utilities on Brocade Fabric OS versi
0 news outlets0 CERTs0 researchersCVSS 7.0 - 26impact
Brocade Fabric OS: A privilege escalation vulnerability exists in the internal Command-Line Interface (CLI) authorization handling mechanis
0 news outlets0 CERTs0 researchersCVSS 7.3 - 25impact
Brocade Fabric OS: Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1 directly accepts Apache configuration file data dur
0 news outlets0 CERTs0 researchersCVSS 6.8 - 10impact
Brocade Fabric OS: A race condition vulnerability exists in the request processing logic of the REST management interface on Brocade Fabric
0 news outlets0 CERTs0 researchersCVSS 2.1 - 20impact
Brocade Fabric OS: A missing authorization check in Brocade Fabric OS versions before 10.0.1 REST API interface of affected platform releas
0 news outlets0 CERTs0 researchersCVSS 5.1 - 37impact
Brocade Fabric OS: A command injection vulnerability exists in the WebTools administrative interface handling configuration download or fil
0 news outlets0 CERTs0 researchersCVSS 8.5 - 24impact
Brocade Fabric OS: An information disclosure vulnerability exists in the SupportLink diagnostic collection utilities of Brocade Fabric OS v
0 news outlets0 CERTs0 researchersCVSS 6.8 - 28impact
Brocade Fabric OS: A stack-based buffer overflow vulnerability exists in the diagnostic execution utility of Brocade Fabric OS versions bef
0 news outlets0 CERTs0 researchersCVSS 6.9 - 30impact
Brocade Fabric OS: Brocade Fabric OS versions before 10.0.1 contain an authorization logic vulnerability in the AAA (Authentication, Author
0 news outlets0 CERTs0 researchersCVSS 7.5 - 33impact
Brocade Fabric OS: An authentication bypass vulnerability exists in the web management interface of Brocade Fabric OS versions before 9.2.2
0 news outlets0 CERTs0 researchersCVSS 7.7 - 25impact
Brocade Fabric OS: A stack-based buffer overflow vulnerability exists in the security library component of Brocade Fabric OS versions befor
0 news outlets0 CERTs0 researchersCVSS 6.9 - 25impact
Brocade Fabric OS: A memory buffer overflow vulnerability exists in the internal diagnostic and route validation routines used by the Fabri
0 news outlets0 CERTs0 researchersCVSS 6.8 - 30impact
Brocade Fabric OS: A local privilege escalation vulnerability exists in the system logging daemon of Brocade Fabric OS versions before 9.2.
0 news outlets0 CERTs0 researchersCVSS 8.5 - 30impact
Brocade Fabric OS: An argument injection vulnerability exists in the configuration management command-line utility of Brocade Fabric OS ver
0 news outlets0 CERTs0 researchersCVSS 8.4 - 22impact
Brocade Fabric OS: An arbitrary file and directory deletion vulnerability exists in the REST API management interface handling USB storage
0 news outlets0 CERTs0 researchersCVSS 5.7 - 25impact
Brocade Fabric OS: An authentication logic and privilege escalation vulnerability exists in the account management interface of Brocade Fab
0 news outlets0 CERTs0 researchersCVSS 5.9 - 31impact
Brocade Fabric OS: An OS command injection vulnerability exists in the configuration management subsystem of Brocade Fabric OS versions bef
0 news outlets0 CERTs0 researchersCVSS 7.3 - 38impact
Brocade Fabric OS: An OS command injection vulnerability exists in the time and zone management subsystem of Brocade Fabric OS versions bef
0 news outlets0 CERTs0 researchersCVSS 8.6 - 34impact
Brocade Fabric OS: An out-of-bounds memory read vulnerability exists in the web management daemon of Brocade Fabric OS versions before 10.0
0 news outlets0 CERTs0 researchersCVSS 7.1 - 30impact
Brocade Fabric OS: An input validation vulnerability exists in the security certificate management component of the Brocade Fabric OS admin
0 news outlets0 CERTs0 researchersCVSS 8.5 - 26impact
Brocade Fabric OS: A buffer overflow vulnerability exists in the WebTools administrative interface handling configuration download or file
0 news outlets0 CERTs0 researchersCVSS 6.9 - 32impact
Brocade Fabric OS: When Brocade Fabric OS versions before 10.0.1 processes trunk configuration operations, the application parses user-supp
0 news outlets0 CERTs0 researchersCVSS 8.5 - 25impact
Brocade Fabric OS: An OS command injection vulnerability exists in the account management subsystem of Brocade Fabric OS versions before 9.
0 news outlets0 CERTs0 researchersCVSS 5.4 - 37impact
Brocade Fabric OS: An OS command injection vulnerability exists in the REST API management interface of Brocade Fabric OS versions before 9
0 news outlets0 CERTs0 researchersCVSS 8.5
Sources
CERTs and cyber security agencies, national news outlets in every country we could find, vendor advisories, research blogs and the security press. Every source is polled on its own schedule, by RSS where possible and by headless browser where not. Broken feeds are repaired automatically; anything still failing is listed here.
Sources admin
Enter the admin token from your server’s .env file (ADMIN_TOKEN). It’s sent once to start a session and isn’t stored in this browser.
Recent sign-in activity
Coverage and speed audit
Checked against ground truth: every recent CISA KEV listing must be tracked and marked exploited; exploitation levels must match their evidence; and how fast each kind of source reaches us after it publishes.
Pipeline, last 24 hours
How many articles each type of source produced, how many were read in full, and how many were linked to a vulnerability. “Unmatched” are articles that look like vulnerability news but couldn’t be linked; the reasons and examples show what to improve.
Add a source
Coverage
All sources
How it works
Vulnocalypse reads vulnerability registries, government CERTs, vendor advisories, research blogs and newsrooms around the clock, links everything that refers to the same vulnerability, and only shows what passes automated validation.
What gets into the feed
A vulnerability is admitted when it is corroborated, either through a published CVE record or through at least two independent organisations, and its impact score reaches 60 out of 100. Anything listed in a known-exploited catalogue is admitted regardless of score. Once admitted, an entry stays, so the feed never flickers.
Impact score
Up to 30 points for severity (CVSS, or inferred from the description when no score exists), 25 for exploitation, 15 for blast radius by product category (edge devices and identity systems score highest), 15 for attention from news, CERTs and researchers, 10 for EPSS exploitation probability, and 5 for pre-authentication. Every entry shows its breakdown.
Exploitation status
We only mark something exploited when there is a citable source: a KEV listing (CISA, VulnCheck or ENISA), a statement from the vendor or a government agency, CISA’s SSVC assessment, or at least two independent organisations reporting attacks with no later denial from the vendor. Phrases like “no evidence of exploitation” are detected and count against a claim.
Validation, without humans
Identifiers are checked against the CVE List; rejected or non-existent CVEs are dropped. Titles, vendors, products and CVSS come from the official record rather than from headlines. Wire stories syndicated across outlets are counted once. Roundups that list dozens of CVEs only count the ones they actually discuss. Reports without an identifier wait for corroboration and are merged into the right CVE once one is assigned. Every decision is logged and shown on each vulnerability’s page.
The Panic meter
Three numbers over the past 24 hours, counting only vulnerabilities first seen in the last 14 days: distinct researchers posting about them, distinct news organisations covering them, and distinct CERTs and agencies warning about them. Each is ranked against its own 90-day history, weighted 35% CERTs, 35% news and 30% researchers, and stretched so the top levels stay rare. Each day’s score is split across the vulnerabilities that caused it.
The outbreak map
The map shows two things for every country: how many national news outlets are covering new vulnerabilities, and whether the national CERT or cyber security agency has issued a warning. National outlets are read directly, through local-language Google News editions, and through GDELT, which attributes coverage in over 100 languages to its source country. International security press is left off the map so it shows national attention, not trade coverage. Replay the spread to watch a vulnerability travel from patient zero across the world.
Subscribe
- Everything (RSS), also as Atom and JSON Feed
- Exploited only and KEV-listed only
- Updates: new KEV listings, exploitation changes and public exploits for tracked vulnerabilities
- Per vendor:
/feed.xml?vendor=Fortinet, or by score:/feed.xml?min_score=80
Use it from an AI agent
Vulnocalypse runs a read-only MCP server. Add it to any MCP client as a remote server:
https://vulnocalypse.com/mcpTools: get_feed, search_vulnerabilities, get_vulnerability, check_exposure (send the products you run and get back anything that affects them), get_panic and explain_panic_day. The JSON API is documented at /api/docs.