Live tracker of exploited and high-impact vulnerabilities
New vulnerabilities from CERTs, vendors, researchers and newsrooms in 180+ countries, checked automatically, with how widely each one is being exploited, warned about and covered.
Panic meter
Connecting- Researchers talking
- –
- News outlets covering
- –
- CERTs and agencies warning
- –
Distinct people and organisations discussing new vulnerabilities in the past 24 hours.
Trending now
Outbreak map
- Countries in the news
- –
- Agencies warning
- –
- Countries warned
- –
- Patient zero
- –
Daily panic
Vulnerabilities
Microsoft vulnerabilities
Every Microsoft vulnerability Vulnocalypse is tracking, newest first: whether it’s being exploited, which CERTs have warned about it and how widely it’s covered. Subscribe with the RSS feed for Microsoft alerts.
- 41impact
Windows 11 sistemlərində BitLocker şifrələməsini hədəf alan yeni “BitUnlocker” hücumu aşkarlanıb
0 news outlets1 CERTs0 researchersCVSS 6.8 - 37impact
Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability
0 news outlets1 CERTs0 researchersCVSS 7.0 - 72impact
Windows Advanced Local Procedure Call (ALPC) Elevation of Privilege Vulnerability
Known exploited (KEV) (CISA)0 news outlets0 CERTs1 researchersCVSS 7.8 - 64impact
Windows Update Stack Elevation of Privilege Vulnerability
Known exploited (KEV) (CISA)0 news outlets0 CERTs0 researchersCVSS 7.8 - 46impact
.NET Framework Security Feature Bypass Vulnerability
0 news outlets1 CERTs0 researchersCVSS 8.8 - 73impact
Active Exploitation of Windows Defender Privilege Escalation Vulnerabilities Enables SYSTEM-Level Compromise
Known exploited (KEV) (CISA)0 news outlets2 CERTs1 researchersCVSS 7.8 - 71impact
Microsoft SharePoint Server Spoofing Vulnerability
Known exploited (KEV) (CISA)0 news outlets1 CERTs0 researchersCVSS 6.5 - 72impact
Microsoft SharePoint Remote Code Execution Vulnerability
Known exploited (KEV) (CISA)0 news outlets1 CERTs0 researchersCVSS 8.8 - 64impact
Microsoft SharePoint Server Elevation of Privilege Vulnerability
Known exploited (KEV) (CISA)0 news outlets1 CERTs0 researchersCVSS 5.3 - 81impact
Microsoft SharePoint Remote Code Execution Vulnerability
Known exploited (KEV) (CISA)0 news outlets1 CERTs0 researchersCVSS 9.8 - 80impact
Active Exploitation Confirmed for Critical SharePoint RCE CVE-2026-50522 Following Public PoC
Known exploited (KEV) (CISA)0 news outlets1 CERTs0 researchersCVSS 9.8 - 86impact
SMBGhost (CVE-2020-0796): A Persistently Recurring Critical SMBv3 Vulnerability in Jamaican Networks
Known exploited (KEV) (CISA)0 news outlets1 CERTs0 researchersCVSS 10.0 - 85impact
BlueKeep (CVE-2019-0708): A Persistently Recurring Wormable RDP Vulnerability in Jamaican Networks
Known exploited (KEV) (CISA)0 news outlets1 CERTs0 researchersCVSS 9.8 - 85impact
MS15-034 (CVE-2015-1635): A Persistently Recurring HTTP.sys Vulnerability in Jamaican Networks
Known exploited (KEV) (CISA)0 news outlets1 CERTs0 researchersCVSS 9.8 - 68impact
Microsoft SharePoint Server Remote Code Execution Vulnerability
Known exploited (KEV) (CISA)0 news outlets0 CERTs0 researchersCVSS 8.8 - 81impact
Microsoft SharePoint Zero-Day RCE Vulnerability (CVE-2025-53770)
Known exploited (KEV) (CISA)0 news outlets1 CERTs0 researchersCVSS 9.8 - 80impact
Windows Shell Security Feature Bypass Vulnerability
Known exploited (KEV) (CISA)0 news outlets2 CERTs1 researchersCVSS 8.8 - 36impact
Microsoft Exchange Server Security Feature Bypass Vulnerability
0 news outlets1 CERTs0 researchersCVSS 6.5 - 46impact
Microsoft Exchange Server Elevation of Privilege Vulnerability
0 news outlets1 CERTs0 researchersCVSS 8.0 - 40impact
Microsoft Exchange Server Denial of Service Vulnerability
0 news outlets1 CERTs0 researchersCVSS 6.5 - 38impact
Microsoft Exchange Server Spoofing Vulnerability
0 news outlets1 CERTs0 researchersCVSS 7.3 - 40impact
Microsoft Exchange Server Elevation of Privilege Vulnerability
0 news outlets1 CERTs0 researchersCVSS 7.2 - 38impact
Microsoft Exchange Server Elevation of Privilege Vulnerability
0 news outlets1 CERTs0 researchersCVSS 6.5 - 35impact
DigiWin｜EasyFlow .NET - Arbitrary File Read
0 news outlets0 CERTs0 researchersCVSS 6.5 - 36impact
DigiWin｜EasyFlow .NET - Reflected Cross-site Scripting
0 news outlets0 CERTs0 researchersCVSS 6.1 - 38impact
DigiWin｜EasyFlow .NET - Arbitrary File Upload
0 news outlets0 CERTs0 researchersCVSS 7.2 - 50impact
DigiWin｜EasyFlow .NET - Missing Authentication
0 news outlets0 CERTs0 researchersCVSS 9.8 - 55impact
DigiWin｜EasyFlow .NET - Insecure Deserialization
0 news outlets1 CERTs0 researchersCVSS 9.8 - 48impact
TEAMPLUS TECHNOLOGY｜TeamPlus Messenger - Code Injection
0 news outlets0 CERTs0 researchersCVSS 8.8 - 33impact
DigiWin｜EasyFlow .NET - SQL Injection
0 news outlets0 CERTs0 researchersCVSS 6.5 - 48impact
TEAMPLUS TECHNOLOGY｜TeamPlus Messenger - Code Injection
0 news outlets0 CERTs0 researchersCVSS 8.8 - 73impact
Microsoft Exchange Server Remote Code Execution Vulnerability
Known exploited (KEV) (CISA)0 news outlets2 CERTs0 researchersCVSS 7.8 - 73impact
Microsoft Exchange Server Remote Code Execution Vulnerability
Known exploited (KEV) (CISA)0 news outlets2 CERTs0 researchersCVSS 7.8 - 49impact
Microsoft Exchange Server Remote Code Execution Vulnerability
0 news outlets1 CERTs0 researchersCVSS 9.1 - 49impact
Microsoft Exchange Server Remote Code Execution Vulnerability
0 news outlets1 CERTs0 researchersCVSS 9.1 - 42impact
Microsoft Exchange Server Remote Code Execution Vulnerability
0 news outlets1 CERTs0 researchersCVSS 6.6 - 73impact
Microsoft Exchange Server Remote Code Execution Vulnerability
Known exploited (KEV) (CISA)0 news outlets2 CERTs0 researchersCVSS 7.8 - 82impact
Microsoft Exchange Server Remote Code Execution Vulnerability
Known exploited (KEV) (CISA)0 news outlets2 CERTs0 researchersCVSS 9.1 - 54impact
Apache Portable Runtime (APR): Windows out-of-bounds write in apr_socket_sendv function
0 news outlets0 CERTs0 researchersCVSS 9.8 - 32impact
Denial of Service attack on windows app using Netty
0 news outlets0 CERTs0 researchersCVSS 5.5 - 39impact
Apache MINA SSHD: Path traversal in org.apache.sshd:sshd-git on Windows
0 news outlets0 CERTs0 researchersCVSS 7.1 - 43impact
Apache Portable Runtime Utility: apr_password_validate() vulnerable to timing attack
0 news outlets0 CERTs0 researchersCVSS 7.5 - 42impact
Microsoft Windows: An authentication bypass vulnerability exists libcurl <8.0.0 in the connection reuse feature which can reuse previously
0 news outlets0 CERTs0 researchersCVSS 5.9 - 67impact
Microsoft Exchange Server Security Feature Bypass Vulnerability
Known exploited (KEV) (CISA)0 news outlets1 CERTs0 researchersCVSS 6.6 - 44impact
Microsoft Exchange Server Remote Code Execution Vulnerability
0 news outlets1 CERTs0 researchersCVSS 7.6 - 79impact
Microsoft Exchange Server Elevation of Privilege Vulnerability
Known exploited (KEV) (CISA)0 news outlets1 CERTs0 researchersCVSS 9.0 - 79impact
Microsoft Exchange Server Remote Code Execution Vulnerability
Known exploited (KEV) (CISA)0 news outlets1 CERTs0 researchersCVSS 9.1 - 33impact
Out of Bound Write on WibuKey for Windows
0 news outlets0 CERTs0 researchersCVSS 7.0 - 41impact
Microsoft Edge: A vulnerability has been identified in Industrial Edge App Publisher (All versions < V1.27.9). The application fails to
0 news outlets0 CERTs0 researchersCVSS 8.3 - 43impact
Siemens Siemens ICS: A vulnerability has been identified in .NET Client Library for SIMATIC S7 Webserver API (All versions < V3.3.61). Affect
0 news outlets0 CERTs0 researchersCVSS 7.5 - 36impact
Microsoft Edge: A vulnerability has been identified in Industrial Edge Cloud Device (IECD), Industrial Edge Device Kit - arm64 V1.10, In
0 news outlets0 CERTs0 researchersCVSS 6.8 - 50impact
SQLite sqldiff remote code execution via argument injection
0 news outlets0 CERTs0 researchersCVSS 9.8 - 29impact
Siemens Siemens ICS: A vulnerability has been identified in .NET Client Library for SIMATIC S7 Webserver API (All versions < V3.3.62). Affect
0 news outlets0 CERTs0 researchersCVSS 5.5 - 40impact
Microsoft Windows: In MIT Kerberos 5 (aka krb5) before 1.22.3, there is a NULL pointer dereference if an application calls gss_accept_sec_c
0 news outlets0 CERTs0 researchersCVSS 5.9 - 40impact
Microsoft Edge: A vulnerability has been identified in Industrial Edge App Publisher (All versions < V1.27.9). The affected software doe
0 news outlets0 CERTs0 researchersCVSS 7.4 - 48impact
Microsoft SQL Server Remote Code Execution Vulnerability
0 news outlets1 CERTs0 researchersCVSS 8.8 - 46impact
Microsoft Office SharePoint Elevation of Privilege Vulnerability
0 news outlets1 CERTs0 researchersCVSS 8.1 - 60impact
Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability
Known exploited (KEV) (CISA)0 news outlets0 CERTs0 researchersCVSS 7.0 - 36impact
iTunes 12.13.2 for Windows
0 news outlets0 CERTs0 researchersCVSS 6.3 - 46impact
Microsoft Windows: A logic issue was addressed with improved restrictions. This issue is fixed in iTunes 12.13.3 for Windows. A local attac
0 news outlets0 CERTs0 researchersCVSS 8.4 - 30impact
Microsoft Windows: A stack buffer overflow was addressed through improved input validation. This issue is fixed in Apple TV 1.5.0.152 for W
0 news outlets0 CERTs0 researchersCVSS 5.5 - 30impact
Apple Music 1.5.0.152 for Windows
0 news outlets0 CERTs0 researchersCVSS 5.5 - 25impact
Passwortmanager ohne Cloud-Zwang: Update für KeePassXC
0 news outlets0 CERTs0 researchersCVSS 4.3 - 40impact
Azure Pipelines Remote Code Execution Vulnerability
0 news outlets0 CERTs0 researchersCVSS 9.1 - 31impact
Azure AI Foundry Elevation of Privilege Vulnerability
0 news outlets0 CERTs0 researchersCVSS 7.7 - 47impact
AAD App Proxy Elevation of Privilege Vulnerability
0 news outlets0 CERTs0 researchersCVSS 10.0 - 43impact
VM Inspector for Azure Virtual Machines Elevation of Privilege Vulnerability
0 news outlets0 CERTs0 researchersCVSS 10.0 - 30impact
Microsoft Exchange Online Remote Code Execution Vulnerability
0 news outlets0 CERTs0 researchersCVSS 7.5 - 43impact
Azure Kubernetes Configuration Service Elevation of Privilege Vulnerability
0 news outlets0 CERTs0 researchersCVSS 10.0 - 54impact
OpenCode Flaw Lets Malicious MCP Servers Execute Code During Sign-In on Windows and WSL
1 news outlets0 CERTs0 researchersCVSS 9.6 - 65impact
Secure Boot Security Feature Bypass Vulnerability
Exploited in the wild0 news outlets0 CERTs1 researchersCVSS 6.7 - 58impact
Secure Boot Security Feature Bypass Vulnerability
Exploited in the wild0 news outlets0 CERTs1 researchersCVSS 4.4 - 50impact
Authen::SASL::Perl::DIGEST_MD5 versions before 2.2100 for Perl accept replayed authentication responses via unverified nonce in server_step
0 news outlets0 CERTs0 researchersCVSS 9.8 - 36impact
Microsoft Office SharePoint Spoofing Vulnerability
0 news outlets0 CERTs0 researchersCVSS 8.1 - 35impact
Windows Common Log File System Driver Elevation of Privilege Vulnerability
0 news outlets0 CERTs0 researchersCVSS 7.0 - 38impact
Windows Storage Elevation of Privilege Vulnerability
0 news outlets0 CERTs0 researchersCVSS 7.8 - 38impact
Windows NTLM Elevation of Privilege Vulnerability
0 news outlets0 CERTs0 researchersCVSS 7.8 - 35impact
Windows NTFS Remote Code Execution Vulnerability
0 news outlets0 CERTs0 researchersCVSS 6.7 - 38impact
Uninitialized memory disclosure and out-of-bounds read in POP3 and SMTP NTLM authentication
0 news outlets2 CERTs0 researchersCVSS 5.3 - 44impact
Microsoft Exchange Server Remote Code Execution Vulnerability
0 news outlets1 CERTs0 researchersCVSS 8.8 - 38impact
Windows Subsystem for Linux Elevation of Privilege Vulnerability
0 news outlets0 CERTs0 researchersCVSS 7.8 - 41impact
Windows Kernel Elevation of Privilege Vulnerability
0 news outlets0 CERTs0 researchersCVSS 8.8 - 34impact
Windows Hyper-V Elevation of Privilege Vulnerability
0 news outlets0 CERTs0 researchersCVSS 7.0 - 44impact
Microsoft PowerShell Remote Code Execution Vulnerability
0 news outlets0 CERTs0 researchersCVSS 8.8 - 32impact
Windows DNS Information Disclosure Vulnerability
0 news outlets0 CERTs0 researchersCVSS 5.5 - 66impact
Microsoft Office Security Feature Bypass Vulnerability
Known exploited (KEV) (CISA)0 news outlets0 CERTs0 researchersCVSS 7.8 - 46impact
.NET Remote Code Execution Vulnerability
0 news outlets0 CERTs0 researchersCVSS 8.1 - 38impact
Windows Win32k Elevation of Privilege Vulnerability
0 news outlets0 CERTs0 researchersCVSS 7.8 - 35impact
Windows Installer Elevation of Privilege Vulnerability
0 news outlets0 CERTs0 researchersCVSS 7.0 - 45impact
ASP.NET Core Denial of Service Vulnerability
0 news outlets0 CERTs0 researchersCVSS 7.5 - 46impact
Windows iSCSI Denial of Service Vulnerability
0 news outlets0 CERTs0 researchersCVSS 7.5 - 38impact
Windows CD-ROM Driver Elevation of Privilege Vulnerability
0 news outlets0 CERTs0 researchersCVSS 7.8 - 40impact
Microsoft QUIC Information Disclosure Vulnerability
0 news outlets0 CERTs0 researchersCVSS 5.9 - 35impact
Windows Update Service Elevation of Privilege Vulnerability
0 news outlets0 CERTs0 researchersCVSS 7.0 - 44impact
Visual Studio Tools for Applications and SQL Server Management Studio Remote Code Execution Vulnerability
0 news outlets0 CERTs0 researchersCVSS 8.8 - 46impact
Windows iSCSI Remote Code Execution Vulnerability
0 news outlets0 CERTs0 researchersCVSS 8.1 - 38impact
CVE-2026-83831 Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability
0 news outlets3 CERTs0 researchers - 35impact
Microsoft Excel Remote Code Execution Vulnerability
0 news outlets0 CERTs0 researchersCVSS 7.8 - 38impact
RPC Runtime Elevation of Privilege Vulnerability
0 news outlets0 CERTs0 researchersCVSS 7.8 - 40impact
Microsoft Office SharePoint Elevation of Privilege Vulnerability
0 news outlets0 CERTs0 researchersCVSS 8.8
Sources
CERTs and cyber security agencies, national news outlets in every country we could find, vendor advisories, research blogs and the security press. Every source is polled on its own schedule, by RSS where possible and by headless browser where not. Broken feeds are repaired automatically; anything still failing is listed here.
Sources admin
Enter the admin token from your server’s .env file (ADMIN_TOKEN). It’s sent once to start a session and isn’t stored in this browser.
Recent sign-in activity
Pipeline, last 24 hours
How many articles each type of source produced, how many were read in full, and how many were linked to a vulnerability. “Unmatched” are articles that look like vulnerability news but couldn’t be linked; the reasons and examples show what to improve.
Add a source
Coverage
All sources
How it works
Vulnocalypse reads vulnerability registries, government CERTs, vendor advisories, research blogs and newsrooms around the clock, links everything that refers to the same vulnerability, and only shows what passes automated validation.
What gets into the feed
A vulnerability is admitted when it is corroborated, either through a published CVE record or through at least two independent organisations, and its impact score reaches 60 out of 100. Anything listed in a known-exploited catalogue is admitted regardless of score. Once admitted, an entry stays, so the feed never flickers.
Impact score
Up to 30 points for severity (CVSS, or inferred from the description when no score exists), 25 for exploitation, 15 for blast radius by product category (edge devices and identity systems score highest), 15 for attention from news, CERTs and researchers, 10 for EPSS exploitation probability, and 5 for pre-authentication. Every entry shows its breakdown.
Exploitation status
We only mark something exploited when there is a citable source: a KEV listing (CISA, VulnCheck or ENISA), a statement from the vendor or a government agency, CISA’s SSVC assessment, or at least two independent organisations reporting attacks with no later denial from the vendor. Phrases like “no evidence of exploitation” are detected and count against a claim.
Validation, without humans
Identifiers are checked against the CVE List; rejected or non-existent CVEs are dropped. Titles, vendors, products and CVSS come from the official record rather than from headlines. Wire stories syndicated across outlets are counted once. Roundups that list dozens of CVEs only count the ones they actually discuss. Reports without an identifier wait for corroboration and are merged into the right CVE once one is assigned. Every decision is logged and shown on each vulnerability’s page.
The Panic meter
Three numbers over the past 24 hours, counting only vulnerabilities first seen in the last 14 days: distinct researchers posting about them, distinct news organisations covering them, and distinct CERTs and agencies warning about them. Each is ranked against its own 90-day history, weighted 35% CERTs, 35% news and 30% researchers, and stretched so the top levels stay rare. Each day’s score is split across the vulnerabilities that caused it.
The outbreak map
The map shows two things for every country: how many national news outlets are covering new vulnerabilities, and whether the national CERT or cyber security agency has issued a warning. National outlets are read directly, through local-language Google News editions, and through GDELT, which attributes coverage in over 100 languages to its source country. International security press is left off the map so it shows national attention, not trade coverage. Replay the spread to watch a vulnerability travel from patient zero across the world.
Subscribe
- Everything (RSS), also as Atom and JSON Feed
- Exploited only and KEV-listed only
- Updates: new KEV listings, exploitation changes and public exploits for tracked vulnerabilities
- Per vendor:
/feed.xml?vendor=Fortinet, or by score:/feed.xml?min_score=80
Use it from an AI agent
Vulnocalypse runs a read-only MCP server. Add it to any MCP client as a remote server:
https://vulnocalypse.com/mcpTools: get_feed, search_vulnerabilities, get_vulnerability, check_exposure (send the products you run and get back anything that affects them), get_panic and explain_panic_day. The JSON API is documented at /api/docs.