Live tracker of exploited and high-impact vulnerabilities
New vulnerabilities from CERTs, vendors, researchers and newsrooms in 180+ countries, checked automatically, with how widely each one is being exploited, warned about and covered.
Panic meter
Connecting- Researchers talking
- –
- News outlets covering
- –
- CERTs and agencies warning
- –
Distinct people and organisations discussing new vulnerabilities in the past 24 hours. Get alerts when it changes
Trending now
Outbreak map
- Countries in the news
- –
- Agencies warning
- –
- Countries warned
- –
- Patient zero
- –
Daily panic
Vulnerabilities
Alerts
Get told when the Panic meter changes level or surges, and when new vulnerabilities are confirmed exploited or warned about by CERTs in several countries. Every alert says what’s driving it, who’s warning, how widely it’s covered and where the fix is.
Browser notifications
Notifications on this device, even when the site isn’t open. On iPhone and iPad, add Vulnocalypse to your Home Screen first.
Slack, Teams, Discord or webhook
Paste an incoming webhook URL. We send a test message first and only connect it if it arrives.
Where do I get a webhook URL?
Slack: create an app with Incoming Webhooks enabled, add it to a channel and copy the URL. Microsoft Teams: in the channel, use Workflows → “Post to a channel when a webhook request is received”. Discord: channel settings → Integrations → Webhooks → New webhook → Copy URL. Anything else: any HTTPS endpoint that accepts JSON; you’ll get a secret to verify our signature.
RSS
No sign-up and nothing stored: subscribe to /alerts.xml in any feed reader.
Your alerts on this browser
Recent alerts
Privacy
We store only what’s needed to deliver alerts: your browser’s push address and encryption keys (random values your browser creates, with no name or email) or the webhook URL you enter, plus your choices above. No accounts, no IP addresses and no tracking. Removing an alert here, or using the manage link in any message, deletes it immediately.
Cisco vulnerabilities
Every Cisco vulnerability Vulnocalypse is tracking, newest first: whether it’s being exploited, which CERTs have warned about it and how widely it’s covered. Subscribe with the RSS feed for Cisco alerts.
- 88impact
Cisco Identity Services Engine Authentication Bypass Vulnerability
Known exploited (KEV) (CISA)0 news outlets1 CERTs0 researchersCVSS 10.0 - 88impact
Cisco Secure Email Gateway SQL Injection Vulnerability
Known exploited (KEV) (CISA)0 news outlets1 CERTs0 researchersCVSS 9.8 - 53impact
Multiple Cisco Products Snort 3 Software Hardening Release: October 2026
0 news outlets1 CERTs0 researchersCVSS 9.0 - 77impact
Cisco SD-WAN Software Privilege Escalation Vulnerability
Known exploited (KEV) (CISA)0 news outlets1 CERTs0 researchersCVSS 7.8 - 81impact
Cisco Catalyst SD-WAN Manager Information Disclosure Vulnerability
Known exploited (KEV) (CISA)0 news outlets1 CERTs0 researchersCVSS 7.5 - 52impact
Cisco Unified Communications Products Hardening Release: October 2026 - Improper control of a resource through its lifetime.
0 news outlets0 CERTs0 researchersCVSS 9.8 - 56impact
Cisco Expressway Series Remote Code Execution Vulnerability
1 news outlets0 CERTs0 researchersCVSS 9.8 - 52impact
Cisco Unified Communications Products Hardening Release: October 2026 - Improper Authentication Vulnerabilities
0 news outlets0 CERTs0 researchersCVSS 9.8 - 89impact
Cisco Catalyst SD-WAN Manager System Account Authorization Bypass Vulnerability
Known exploited (KEV) (CISA)0 news outlets2 CERTs0 researchersCVSS 9.8 - 86impact
Cisco Secure Email Gateway Arbitrary File Write Vulnerability
Known exploited (KEV) (CISA)0 news outlets1 CERTs0 researchersCVSS 9.8 - 57impact
Cisco Identity Services Engine Multiple Remote Code Execution Vulnerability
0 news outlets1 CERTs0 researchersCVSS 9.9 - 57impact
Cisco Identity Services Engine Multiple Authenticated Remote Code Execution Vulnerability
0 news outlets1 CERTs0 researchersCVSS 9.9 - 51impact
Cisco Webex Meetings Certificate Validation Vulnerability
0 news outlets1 CERTs0 researchersCVSS 9.8 - 57impact
Cisco Identity Services Engine Remote Code Execution Vulnerability
0 news outlets1 CERTs0 researchersCVSS 9.9 - 89impact
Cisco IOS XE: Cisco is providing an update for the ongoing investigation into observed exploitation of the web UI feature in Cisco IOS
Known exploited (KEV) (CISA)0 news outlets1 CERTs0 researchersCVSS 10.0 - 35impact
Cisco Unity Connection Open Redirect Vulnerability
0 news outlets0 CERTs0 researchersCVSS 4.7 - 89impact
Cisco Catalyst SD-WAN Controller Authentication Bypass Vulnerability
Known exploited (KEV) (CISA)0 news outlets1 CERTs0 researchersCVSS 10.0 - 80impact
Cisco Secure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense Software Remote Access SSL VPN Denial of Service Vulnerability
Known exploited (KEV) (CISA)0 news outlets0 CERTs1 researchersCVSS 8.6 - 71impact
Cisco Secure Firewall Management Center Software Static Credential Vulnerability
Known exploited (KEV) (CISA)0 news outlets0 CERTs0 researchersCVSS 5.3 - 88impact
Cisco Secure Firewall Management Center Authentication Bypass Remote Code Execution Vulnerability
Known exploited (KEV) (CISA)0 news outlets0 CERTs1 researchersCVSS 10.0 - 38impact
Cisco Expressway Series Information Disclosure Vulnerability
0 news outlets0 CERTs0 researchersCVSS 5.3 - 40impact
Cisco Unified Communications Manager Improper Access Control Vulnerability
0 news outlets0 CERTs0 researchersCVSS 5.3 - 41impact
Multiple Cisco Products Snort 3 SMTP MIME Denial of Service Vulnerability
0 news outlets0 CERTs0 researchersCVSS 5.8 - 41impact
Multiple Cisco Products Snort 3 Netflow Denial of Service Vulnerabilities
0 news outlets0 CERTs0 researchersCVSS 5.8 - 39impact
Multiple Cisco Products Snort 3 Denial of Service Vulnerability
0 news outlets0 CERTs0 researchersCVSS 5.3 - 43impact
Cisco Secure Firewall Threat Defense Snort 3 Visual Basic for Applications Buffer Overflow Denial of Service Vulnerability
0 news outlets0 CERTs0 researchersCVSS 5.8 - 40impact
Multiple Cisco Products Snort 3 Generic File Processing Memory Exhaustion Denial of Service Vulnerability
0 news outlets0 CERTs0 researchersCVSS 5.8 - 41impact
Multiple Cisco Products Snort 3 Teredo Protocol Denial of Service Vulnerability
0 news outlets0 CERTs0 researchersCVSS 5.8 - 41impact
Multiple Cisco Products Snort 3 Generic Routing Encapsulation Denial of Service Vulnerabilities
0 news outlets0 CERTs0 researchersCVSS 5.8 - 41impact
Multiple Cisco Products Snort 3 Generic Routing Encapsulation Denial of Service Vulnerabilities
0 news outlets0 CERTs0 researchersCVSS 5.8 - 49impact
Multiple Cisco Products Snort 3 Software Hardening Release: October 2026
0 news outlets1 CERTs0 researchersCVSS 7.5 - 46impact
Cisco Unified Communications Products Hardening Release: October 2026 - Improper Check or Handling of Exceptional Conditions Vulnerabilities
0 news outlets0 CERTs0 researchersCVSS 7.5 - 36impact
Cisco Expressway Series Software Hardening Release: October 2026 - Improper Link Resolution Vulnerabilities
0 news outlets0 CERTs0 researchersCVSS 7.0 - 44impact
Cisco Unified Communications Products Hardening Release: October 2026 - Improper Input Validation Vulnerabilities
0 news outlets0 CERTs0 researchersCVSS 8.8 - 42impact
Cisco Unified Communications Products Hardening Release: October 2026 - Improper Access Control Vulnerabilities
0 news outlets0 CERTs0 researchersCVSS 8.8 - 44impact
Cisco Expressway Series Software Hardening Release: October 2026 - Uncaught Exception Vulnerabilities
0 news outlets0 CERTs0 researchersCVSS 7.5 - 44impact
Cisco Unified Communications Products Hardening Release: October 2026 - Injection Vulnerabilities
0 news outlets0 CERTs0 researchersCVSS 8.8 - 39impact
Cisco Expressway Series Software Hardening Release: October 2026 - Code Injection Vulnerabilities
0 news outlets0 CERTs0 researchersCVSS 7.8 - 38impact
Cisco Expressway Series Software Hardening Release: October 2026 - Incorrect Permission Assignment Vulnerabilities
0 news outlets0 CERTs0 researchersCVSS 7.8 - 48impact
Cisco Expressway Series Software Hardening Release: October 2026 - Out-of-bounds Write Vulnerabilities
0 news outlets0 CERTs0 researchersCVSS 8.6 - 32impact
Cisco Secure Client Privilege Escalation Vulnerability
0 news outlets0 CERTs0 researchersCVSS 5.5 - 39impact
Cisco Unified Communications Products Hardening Release: October 2026 - Path Traversal Vulnerabilities
0 news outlets0 CERTs0 researchersCVSS 7.8 - 51impact
Cisco IOS XR Software for ASR 9000 Series Routers IPv4 Unicast Packets Denial of Service Vulnerability
0 news outlets2 CERTs0 researchersCVSS 7.5 - 44impact
Cisco Expressway Series Software Hardening Release: October 2026 - Denial of Service Vulnerabilities
0 news outlets0 CERTs0 researchersCVSS 7.5 - 43impact
Multiple Cisco Products Snort 3 Software Hardening Release: October 2026
0 news outlets1 CERTs0 researchersCVSS 7.8 - 44impact
Cisco Unified Communications Products Hardening Release: October 2026 - Cross-site Scripting Vulnerabilities
0 news outlets0 CERTs0 researchersCVSS 9.3 - 44impact
Cisco Expressway Series Software Hardening Release: October 2026 - NULL Pointer Vulnerabilities
0 news outlets0 CERTs0 researchersCVSS 7.5 - 35impact
Cisco Expressway Series Software Hardening Release: October 2026 - Insecure Temporary File Vulnerabilities
0 news outlets0 CERTs0 researchersCVSS 6.6 - 49impact
Multiple Cisco Products Snort 3 Software Hardening Release: October 2026
0 news outlets1 CERTs0 researchersCVSS 7.5 - 39impact
Open Source Snort 3 Control Channel Socket Aribitrary Command Execution Vulnerability
0 news outlets0 CERTs0 researchersCVSS 7.8
Sources
CERTs and cyber security agencies, national news outlets in every country we could find, vendor advisories, research blogs and the security press. Every source is polled on its own schedule, by RSS where possible and by headless browser where not. Broken feeds are repaired automatically; anything still failing is listed here.
Sources admin
Enter the admin token from your server’s .env file (ADMIN_TOKEN). It’s sent once to start a session and isn’t stored in this browser.
Recent sign-in activity
Coverage and speed audit
Checked against ground truth: every recent CISA KEV listing must be tracked and marked exploited; exploitation levels must match their evidence; and how fast each kind of source reaches us after it publishes.
Pipeline, last 24 hours
How many articles each type of source produced, how many were read in full, and how many were linked to a vulnerability. “Unmatched” are articles that look like vulnerability news but couldn’t be linked; the reasons and examples show what to improve.
Add a source
Coverage
All sources
How it works
Vulnocalypse reads vulnerability registries, government CERTs, vendor advisories, research blogs and newsrooms around the clock, links everything that refers to the same vulnerability, and only shows what passes automated validation.
What gets into the feed
A vulnerability is admitted when it is corroborated, either through a published CVE record or through at least two independent organisations, and its impact score reaches 60 out of 100. Anything listed in a known-exploited catalogue is admitted regardless of score. Once admitted, an entry stays, so the feed never flickers.
Impact score
Up to 30 points for severity (CVSS, or inferred from the description when no score exists), 25 for exploitation, 15 for blast radius by product category (edge devices and identity systems score highest), 15 for attention from news, CERTs and researchers, 10 for EPSS exploitation probability, and 5 for pre-authentication. Every entry shows its breakdown.
Exploitation status
We only mark something exploited when there is a citable source: a KEV listing (CISA, VulnCheck or ENISA), a statement from the vendor or a government agency, CISA’s SSVC assessment, or at least two independent organisations reporting attacks with no later denial from the vendor. Phrases like “no evidence of exploitation” are detected and count against a claim.
Validation, without humans
Identifiers are checked against the CVE List; rejected or non-existent CVEs are dropped. Titles, vendors, products and CVSS come from the official record rather than from headlines. Wire stories syndicated across outlets are counted once. Roundups that list dozens of CVEs only count the ones they actually discuss. Reports without an identifier wait for corroboration and are merged into the right CVE once one is assigned. Every decision is logged and shown on each vulnerability’s page.
The Panic meter
Three numbers over the past 24 hours, counting only vulnerabilities first seen in the last 14 days: distinct researchers posting about them, distinct news organisations covering them, and distinct CERTs and agencies warning about them. Each is ranked against its own 90-day history, weighted 35% CERTs, 35% news and 30% researchers, and stretched so the top levels stay rare. Each day’s score is split across the vulnerabilities that caused it.
The outbreak map
The map shows two things for every country: how many national news outlets are covering new vulnerabilities, and whether the national CERT or cyber security agency has issued a warning. National outlets are read directly, through local-language Google News editions, and through GDELT, which attributes coverage in over 100 languages to its source country. International security press is left off the map so it shows national attention, not trade coverage. Replay the spread to watch a vulnerability travel from patient zero across the world.
Subscribe
- Everything (RSS), also as Atom and JSON Feed
- Exploited only and KEV-listed only
- Updates: new KEV listings, exploitation changes and public exploits for tracked vulnerabilities
- Per vendor:
/feed.xml?vendor=Fortinet, or by score:/feed.xml?min_score=80
Use it from an AI agent
Vulnocalypse runs a read-only MCP server. Add it to any MCP client as a remote server:
https://vulnocalypse.com/mcpTools: get_feed, search_vulnerabilities, get_vulnerability, check_exposure (send the products you run and get back anything that affects them), get_panic and explain_panic_day. The JSON API is documented at /api/docs.