Live tracker of exploited and high-impact vulnerabilities
New vulnerabilities from CERTs, vendors, researchers and newsrooms in 180+ countries, checked automatically, with how widely each one is being exploited, warned about and covered.
Panic meter
Connecting- Researchers talking
- –
- News outlets covering
- –
- CERTs and agencies warning
- –
Distinct people and organisations discussing new vulnerabilities in the past 24 hours.
Trending now
Outbreak map
- Countries in the news
- –
- Agencies warning
- –
- Countries warned
- –
- Patient zero
- –
Daily panic
Vulnerabilities
n/a vulnerabilities
Every n/a vulnerability Vulnocalypse is tracking, newest first: whether it’s being exploited, which CERTs have warned about it and how widely it’s covered. Subscribe with the RSS feed for n/a alerts.
- 32impact
VMware Cloud Foundation Missing Authorisation Vulnerability
0 news outlets0 CERTs0 researchersCVSS 7.3 - 66impact
named in ISC BIND 9.x before 9.9.7-P2 and 9.10.x before 9.10.2-P3 allows remote attackers to cause a denial of service (REQUIRE assertion failure and daemon exi
Known exploited (KEV) (CISA)0 news outlets0 CERTs0 researchersCVSS 7.5 - 60impact
Strapi through 4.5.5 allows attackers (with access to the admin panel) to discover sensitive user details by exploiting the query filter. The attacker can filte
Known exploited (KEV) (CISA)0 news outlets0 CERTs0 researchersCVSS 7.2 - 73impact
Directory traversal with remote code execution can occur in /upload in ONLYOFFICE Document Server before 5.6.3, when JWT is used, via a /.. sequence in an image
Known exploited (KEV) (CISA)0 news outlets0 CERTs0 researchersCVSS 9.8 - 77impact
n/a n/a: An issue was discovered in Citrix Application Delivery Controller (ADC) and Gateway 10.5, 11.1, 12.0, 12.1, and 13.0.
Known exploited (KEV) (CISA)0 news outlets1 CERTs0 researchersCVSS 9.8 - 18impact
- 74impact
The mod_copy module in ProFTPD 1.3.5 allows remote attackers to read and write to arbitrary files via the site cpfr and site cpto commands.
Known exploited (KEV) (CISA)0 news outlets0 CERTs0 researchersCVSS 10.0 - 18impact
- 39impact
n/a n/a: The DNS protocol in RFC 1035 and updates allows remote attackers to cause a denial of service (resource consumption) by arranging for DNS qu
0 news outlets0 CERTs0 researchersCVSS 7.5 - 27impact
n/a n/a: Heap Buffer Overflow vulnerability in Libde265 v1.0.15 allows attackers to crash the application via crafted payload to __interceptor_memcpy
0 news outlets0 CERTs0 researchersCVSS 6.5 - 34impact
n/a n/a: An information disclosure issue in the zipfileInflate function in the zipfile extension in SQLite v3.51.1 and earlier allows attackers to ob
0 news outlets0 CERTs0 researchersCVSS 7.5 - 37impact
n/a n/a: In Connect2id Nimbus JOSE+JWT before 9.37.2, an attacker can cause a denial of service (resource consumption) via a large JWE p2c header val
0 news outlets0 CERTs0 researchersCVSS 7.5 - 66impact
n/a n/a: The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as
Known exploited (KEV) (CISA)0 news outlets0 CERTs0 researchersCVSS 7.5 - 35impact
n/a https://github.com/curl/curl: A use after free vulnerability exists in curl <7.87.0.
0 news outlets0 CERTs0 researchersCVSS 5.9 - 33impact
- 34impact
- 27impact
n/a n/a: Heap Buffer Overflow vulnerability in Libde265 v1.0.15 allows attackers to crash the application via crafted payload to display444as420 func
0 news outlets0 CERTs0 researchersCVSS 6.5 - 22impact
- 42impact
n/a n/a: virtualenv before 20.26.6 allows command injection through the activation scripts for a virtual environment.
0 news outlets0 CERTs0 researchersCVSS 8.4 - 34impact
- 17impact
- 31impact
- 18impact
- 24impact
n/a Intel(R) Processors: Exposure of Sensitive Information in Shared Microarchitectural Structures during Transient Execution for some Intel(R) Processors may allow
0 news outlets0 CERTs0 researchersCVSS 5.6 - 18impact
- 32impact
- 48impact
n/a n/a: initDocumentParser in xml/XMLSchedulingDataProcessor.java in Terracotta Quartz Scheduler through 2.3.0 allows XXE attacks via a job descript
0 news outlets0 CERTs0 researchersCVSS 9.8 - 24impact
n/a n/a: An issue was discovered in the Bidirectional Algorithm in the Unicode Specification through 14.0.
0 news outlets0 CERTs0 researchers - 31impact
Multiple Products Security Advisory (CVE-2016-10750, CVE-2022-26133)
0 news outlets0 CERTs0 researchers - 23impact
- 42impact
Deserialization of Untrusted Data
0 news outlets0 CERTs0 researchersCVSS 7.7 - 22impact
- 39impact
n/a n/a: A stack overflow in Jettison before v1.5.2 allows attackers to cause a Denial of Service (DoS) via crafted JSON data.
0 news outlets0 CERTs0 researchersCVSS 7.5 - 38impact
n/a n/a: A stack overflow in the XML.toJSONObject component of hutool-json v5.8.10 allows attackers to cause a Denial of Service (DoS) via crafted JS
0 news outlets0 CERTs0 researchersCVSS 7.5 - 41impact
n/a n/a: jackson-databind before 2.13.0 allows a Java StackOverflow exception and denial of service via a large depth of nested objects.
0 news outlets0 CERTs0 researchersCVSS 7.5 - 40impact
n/a n/a: In FasterXML jackson-databind before 2.13.4, resource exhaustion can occur because of a lack of a check in BeanDeserializer._deserializeFrom
0 news outlets0 CERTs0 researchersCVSS 7.5 - 40impact
n/a n/a: In FasterXML jackson-databind before versions 2.13.4.1 and 2.12.17.1, resource exhaustion can occur because of a lack of a check in primitiv
0 news outlets0 CERTs0 researchersCVSS 7.5 - 36impact
n/a n/a: A security issue was found in Netplex Json-smart 2.5.0 through 2.5.1.
0 news outlets0 CERTs0 researchersCVSS 7.5 - 19impact
n/a n/a: File before 5.43 has an stack-based buffer over-read in file_copystr in funcs.c.
0 news outlets0 CERTs0 researchers - 46impact
n/a n/a: An issue was discovered in libexpat before 2.6.3.
0 news outlets0 CERTs0 researchersCVSS 9.8 - 23impact
- 41impact
n/a n/a: HTTP::Tiny before 0.083, a Perl core module since 5.13.9 and available standalone on CPAN, has an insecure default TLS configuration where u
0 news outlets0 CERTs0 researchersCVSS 8.1 - 41impact
n/a n/a: CPAN.pm before 2.35 does not verify TLS certificates when downloading distributions over HTTPS.
0 news outlets0 CERTs0 researchersCVSS 8.1 - 32impact
n/a n/a: execute_filter_delta in archive_read_support_format_rar.c in libarchive before 3.7.5 allows out-of-bounds access via a crafted archive file
0 news outlets0 CERTs0 researchersCVSS 7.8 - 33impact
n/a n/a: The email module of Python through 3.11.3 incorrectly parses e-mail addresses that contain a special character.
0 news outlets0 CERTs0 researchersCVSS 5.3 - 47impact
n/a n/a: A buffer-overread issue was discovered in StringIO 3.0.1, as distributed in Ruby 3.0.x through 3.0.6 and 3.1.x through 3.1.4.
0 news outlets0 CERTs0 researchersCVSS 9.8 - 18impact
- 18impact
- 34impact
n/a n/a: In Libheif 1.17.6, insufficient checks in ImageOverlay::parse() decoding a heif file containing an overlay image with forged offsets can lea
0 news outlets0 CERTs0 researchersCVSS 8.1 - 14impact
pygments archetype.py AdlLexer redos
0 news outlets0 CERTs0 researchersCVSS 3.3 - 37impact
libssh2 userauth.c userauth_password integer overflow
0 news outlets0 CERTs0 researchersCVSS 7.3 - 37impact
n/a n/a: An issue was discovered in Bouncy Castle Java Cryptography APIs before 1.78.
0 news outlets0 CERTs0 researchersCVSS 7.5 - 21impact
- 23impact
n/a n/a: In the Bouncy Castle JCE Provider version 1.55 and earlier the primary engine class used for AES was AESFastEngine.
0 news outlets0 CERTs0 researchers - 17impact
- 20impact
- 24impact
- 22impact
- 22impact
n/a n/a: In the Bouncy Castle JCE Provider version 1.55 and earlier the DHIES/ECIES CBC mode vulnerable to padding oracle attack.
0 news outlets0 CERTs0 researchers - 25impact
- 23impact
- 22impact
- 22impact
- 33impact
n/a n/a: An issue was discovered in Bouncy Castle Java TLS API and JSSE Provider before 1.78.
0 news outlets0 CERTs0 researchersCVSS 5.9 - 23impact
- 22impact
n/a n/a: In the Bouncy Castle JCE Provider version 1.55 and earlier the DHIES implementation allowed the use of ECB mode.
0 news outlets0 CERTs0 researchers - 21impact
- 24impact
- 20impact
- 22impact
- 22impact
n/a n/a: In the Bouncy Castle JCE Provider version 1.55 and earlier DSA signature generation is vulnerable to timing attack.
0 news outlets0 CERTs0 researchers - 22impact
n/a n/a: In the Bouncy Castle JCE Provider version 1.55 and earlier the other party DH public key is not fully validated.
0 news outlets0 CERTs0 researchers - 24impact
- 23impact
- 20impact
n/a n/a: Bouncy Castle For Java before 1.74 is affected by an LDAP injection vulnerability.
0 news outlets0 CERTs0 researchers - 30impact
n/a Spring Framework: In spring framework versions prior to 5.2.24 release+ ,5.3.27+ and 6.0.8+ , it is possible for a user to provide a specially crafted SpEL ex
0 news outlets0 CERTs0 researchersCVSS 6.5 - 18impact
n/a Intel(R) Processors: Improper handling of values for some Intel(R) Processors within Ring 0: Kernel, Hypervisor and Bare Metal OS may allow an escalation of priv
0 news outlets0 CERTs0 researchersCVSS 4.5 - 36impact
n/a n/a: Directory Traversal vulnerability in the extractFile method of org.codehaus.plexus.util.Expand in plexus-utils before 6d780b3378829318ba5c2d
0 news outlets0 CERTs0 researchersCVSS 8.8 - 24impact
- 20impact
- 31impact
N/A Spring Framework: Applications that parse ETags from "If-Match" or "If-None-Match" request headers are vulnerable to DoS attack.
0 news outlets0 CERTs0 researchersCVSS 5.3 - 22impact
n/a n/a: In the Bouncy Castle JCE Provider version 1.55 and earlier the ECIES implementation allowed the use of ECB mode.
0 news outlets0 CERTs0 researchers - 22impact
- 14impact
LatencyUtils PauseDetector LatencyStats.java LatencyStats.recordDetectedPause memory corruption
0 news outlets0 CERTs0 researchersCVSS 3.3 - 24impact
- 66impact
n/a polkit: A local privilege escalation vulnerability was found on polkit's pkexec utility.
Known exploited (KEV) (CISA)0 news outlets0 CERTs1 researchersCVSS 7.8
Sources
CERTs and cyber security agencies, national news outlets in every country we could find, vendor advisories, research blogs and the security press. Every source is polled on its own schedule, by RSS where possible and by headless browser where not. Broken feeds are repaired automatically; anything still failing is listed here.
Sources admin
Enter the admin token from your server’s .env file (ADMIN_TOKEN). It’s sent once to start a session and isn’t stored in this browser.
Recent sign-in activity
Pipeline, last 24 hours
How many articles each type of source produced, how many were read in full, and how many were linked to a vulnerability. “Unmatched” are articles that look like vulnerability news but couldn’t be linked; the reasons and examples show what to improve.
Add a source
Coverage
All sources
How it works
Vulnocalypse reads vulnerability registries, government CERTs, vendor advisories, research blogs and newsrooms around the clock, links everything that refers to the same vulnerability, and only shows what passes automated validation.
What gets into the feed
A vulnerability is admitted when it is corroborated, either through a published CVE record or through at least two independent organisations, and its impact score reaches 60 out of 100. Anything listed in a known-exploited catalogue is admitted regardless of score. Once admitted, an entry stays, so the feed never flickers.
Impact score
Up to 30 points for severity (CVSS, or inferred from the description when no score exists), 25 for exploitation, 15 for blast radius by product category (edge devices and identity systems score highest), 15 for attention from news, CERTs and researchers, 10 for EPSS exploitation probability, and 5 for pre-authentication. Every entry shows its breakdown.
Exploitation status
We only mark something exploited when there is a citable source: a KEV listing (CISA, VulnCheck or ENISA), a statement from the vendor or a government agency, CISA’s SSVC assessment, or at least two independent organisations reporting attacks with no later denial from the vendor. Phrases like “no evidence of exploitation” are detected and count against a claim.
Validation, without humans
Identifiers are checked against the CVE List; rejected or non-existent CVEs are dropped. Titles, vendors, products and CVSS come from the official record rather than from headlines. Wire stories syndicated across outlets are counted once. Roundups that list dozens of CVEs only count the ones they actually discuss. Reports without an identifier wait for corroboration and are merged into the right CVE once one is assigned. Every decision is logged and shown on each vulnerability’s page.
The Panic meter
Three numbers over the past 24 hours, counting only vulnerabilities first seen in the last 14 days: distinct researchers posting about them, distinct news organisations covering them, and distinct CERTs and agencies warning about them. Each is ranked against its own 90-day history, weighted 35% CERTs, 35% news and 30% researchers, and stretched so the top levels stay rare. Each day’s score is split across the vulnerabilities that caused it.
The outbreak map
The map shows two things for every country: how many national news outlets are covering new vulnerabilities, and whether the national CERT or cyber security agency has issued a warning. National outlets are read directly, through local-language Google News editions, and through GDELT, which attributes coverage in over 100 languages to its source country. International security press is left off the map so it shows national attention, not trade coverage. Replay the spread to watch a vulnerability travel from patient zero across the world.
Subscribe
- Everything (RSS), also as Atom and JSON Feed
- Exploited only and KEV-listed only
- Updates: new KEV listings, exploitation changes and public exploits for tracked vulnerabilities
- Per vendor:
/feed.xml?vendor=Fortinet, or by score:/feed.xml?min_score=80
Use it from an AI agent
Vulnocalypse runs a read-only MCP server. Add it to any MCP client as a remote server:
https://vulnocalypse.com/mcpTools: get_feed, search_vulnerabilities, get_vulnerability, check_exposure (send the products you run and get back anything that affects them), get_panic and explain_panic_day. The JSON API is documented at /api/docs.