Live tracker of exploited and high-impact vulnerabilities
New vulnerabilities from CERTs, vendors, researchers and newsrooms in 180+ countries, checked automatically, with how widely each one is being exploited, warned about and covered.
Panic meter
Connecting- Researchers talking
- –
- News outlets covering
- –
- CERTs and agencies warning
- –
Distinct people and organisations discussing new vulnerabilities in the past 24 hours.
Trending now
Outbreak map
- Countries in the news
- –
- Agencies warning
- –
- Countries warned
- –
- Patient zero
- –
Daily panic
Vulnerabilities
Node.js vulnerabilities
Every Node.js vulnerability Vulnocalypse is tracking, newest first: whether it’s being exploited, which CERTs have warned about it and how widely it’s covered. Subscribe with the RSS feed for Node.js alerts.
- 42impact
node-tar Vulnerable to Arbitrary File Creation/Overwrite via Hardlink Path Traversal
0 news outlets0 CERTs0 researchersCVSS 8.2 - 30impact
Axios: Proxy-Authorization Header Injection via Prototype Pollution — Incomplete Null-Prototype Fix
0 news outlets0 CERTs0 researchersCVSS 3.7 - 40impact
node-tar Vulnerable to Arbitrary File Overwrite and Symlink Poisoning via Insufficient Path Sanitization
0 news outlets0 CERTs0 researchersCVSS 8.2 - 37impact
@node-oauth/oauth2-server: PKCE code_verifier ABNF not enforced in token exchange allows brute-force redemption of intercepted authorization codes
0 news outlets0 CERTs0 researchersCVSS 5.9 - 38impact
nodejs node: A flaw in Node.js can cause dns.resolveAny() Aborts the Node.js Process When a DNS Response Contains More Than 256 A Rec
0 news outlets0 CERTs0 researchersCVSS 5.9 - 30impact
nodejs node: A flaw in Node.js node:sqlite allows a stale StatementSyncIterator created through DatabaseSync#createTagStore() to cont
0 news outlets0 CERTs0 researchersCVSS 5.3 - 35impact
nodejs node: A flaw in Node.js Permission Model enforcement can over-grant filesystem access across radix-tree prefix boundaries.
0 news outlets0 CERTs0 researchersCVSS 7.5 - 30impact
nodejs node: A flaw in Node.js HTTP client can cause a request desynchronization for Node.js-based forwarding proxies that rebuild ou
0 news outlets0 CERTs0 researchersCVSS 3.7 - 49impact
nodejs node: A flaw in Node.js TLS hostname handling can cause Node.js unicode dot separator handling can lead to tls wildcard-depth
0 news outlets0 CERTs0 researchersCVSS 7.7 - 48impact
nodejs node: A flaw in Node.js WebCrypto implementation can crash the process if the input of `subtle.encrypt()` is a multiple of 2Gi
0 news outlets0 CERTs0 researchersCVSS 7.5 - 44impact
nodejs node: A flaw in Node.js HTTP/2 handling allows `nghttp2_session_mem_send()` to be called re-entrantly while `nghttp2_session_m
0 news outlets0 CERTs0 researchersCVSS 7.5 - 20impact
nodejs node: A flaw in Node.js Permission Model enforcement allows Bypass via `process.report.writeReport()` Path Misvalidation. This
0 news outlets0 CERTs0 researchersCVSS 1.8 - 44impact
nodejs node: A flaw in Node.js HTTP/2 handling can cause HTTP/2 retained header blocks evade maxSessionMemory and enable remote memor
0 news outlets0 CERTs0 researchersCVSS 7.5 - 25impact
NodeJS Node: A vulnerability has been identified in Node.js, affecting users of the experimental permission model when the --allow-fs
0 news outlets0 CERTs0 researchersCVSS 3.3 - 38impact
nodejs node: A flaw in Node.js HMAC verification uses a non-constant-time comparison when validating user-provided signatures, potent
0 news outlets0 CERTs0 researchersCVSS 5.9 - 38impact
Handlebars.js has JavaScript Injection in CLI Precompiler via Unescaped Names and Options
0 news outlets0 CERTs0 researchersCVSS 8.3 - 48impact
Apache Thrift: Node.js skip() recursion
0 news outlets0 CERTs0 researchersCVSS 8.7 - 37impact
nodejs node: A memory leak occurs in Node.js HTTP/2 servers when a client sends WINDOW_UPDATE frames on stream 0 (connection-level) t
0 news outlets0 CERTs0 researchersCVSS 5.3 - 36impact
nodejs node: A flaw in V8's string hashing mechanism causes integer-like strings to be hashed to their numeric value, making hash col
0 news outlets0 CERTs0 researchersCVSS 5.9 - 22impact
nodejs node: A flaw in Node.js Permission Model enforcement allows `trace_events.createTracing().enable()` Writes Trace Logs Outside
0 news outlets0 CERTs0 researchersCVSS 3.3 - 38impact
nodejs node: A flaw in Node.js proxy tunnel error handling could expose proxy credentials in `ERR_PROXY_TUNNEL` error messages. Wh
0 news outlets0 CERTs0 researchersCVSS 5.9 - 32impact
nodejs node: A flaw in Node.js URL processing causes an assertion failure in native code when `url.format()` is called with a malform
0 news outlets0 CERTs0 researchersCVSS 5.7 - 38impact
nodejs node: A flaw in Node.js HTTP/2 client allows a server to send an unlimited number of ORIGIN frames, which could lead to an Out
0 news outlets0 CERTs0 researchersCVSS 5.3 - 22impact
nodejs node: A flaw in Node.js Permission Model enforcement allows process.report writes (and overwrites) files outside --allow-fs-wr
0 news outlets0 CERTs0 researchersCVSS 3.3 - 36impact
nodejs node: A flaw in Node.js TLS hostname handling can cause Embedded-nul hostnames can lead to silent authority rebinding due to c
0 news outlets0 CERTs0 researchersCVSS 5.6 - 49impact
nodejs node: A flaw in Node.js HTTP request handling causes an uncaught `TypeError` when a request is received with a header named `_
0 news outlets0 CERTs0 researchersCVSS 7.5 - 26impact
nodejs node: A inconsistency in Node.js hostname matching can cause a trust-policy bypass in multi-context mTLS setups. This vulne
0 news outlets0 CERTs0 researchersCVSS 4.2 - 45impact
Handlebars.js has Denial of Service via Malformed Decorator Syntax in Template Compilation
0 news outlets0 CERTs0 researchersCVSS 7.5 - 38impact
nodejs node: A flaw in Node.js HTTP/2 server API can cause servers to keep accepting data even after sending a `GOAWAY` frame. This v
0 news outlets0 CERTs0 researchersCVSS 5.3 - 26impact
nodejs node: A flaw in Node.js TLS host verification can cause an attacker to bypass certification validation. This vulnerability
0 news outlets0 CERTs0 researchersCVSS 4.3 - 23impact
nodejs node: A flaw in Node.js Permission API can cause a file metadata to be modified even on a path that was set as read-only with
0 news outlets0 CERTs0 researchersCVSS 3.3 - 22impact
nodejs node: A flaw in Node.js Permission Model filesystem enforcement leaves `fs.realpathSync.native()` without the required read pe
0 news outlets0 CERTs0 researchersCVSS 3.3 - 41impact
Atlassian Atlassian Connect Express (ACE): Broken Authentication in Atlassian Connect Express (ACE) from version 3.0.2 before version 6.6.0: Atlassian Connect Expr
0 news outlets0 CERTs0 researchersCVSS 7.7 - 44impact
brace-expansion DoS via unbounded expansion length causing an out-of-memory process crash
0 news outlets0 CERTs0 researchersCVSS 7.5 - 33impact
nodejs node: An incomplete fix has been identified in Node.js: HTTPS Agent TLS session reuse skips hostname verification across ident
0 news outlets0 CERTs0 researchersCVSS 6.3 - 31impact
nodejs node: A flaw in Node.js HTTP Agent can cause a client to accept as valid a response that is send before the client has sent th
0 news outlets0 CERTs0 researchersCVSS 3.7 - 24impact
nodejs node: A flaw in Node.js HTTPS Agent connection reuse can cause PFX object-array key collisions, allowing mutual TLS (mTLS) cli
0 news outlets0 CERTs0 researchersCVSS 4.1 - 36impact
nodejs node: A flaw in Node.js allows a spoofed `TypedArray` `byteLength` to trigger a reachable assertion in the synchronous `node:z
0 news outlets0 CERTs0 researchersCVSS 6.2 - 48impact
xmldom: End-tag Whitespace-Trim Regex ReDoS — quadratic backtracking in the 0.8.x end-tag parser
0 news outlets0 CERTs0 researchersCVSS 8.7 - 49impact
Apache Thrift: Node.js quadratic-time DoS in server receive transports
0 news outlets0 CERTs0 researchersCVSS 8.7 - 42impact
http-proxy-middleware: multipart/form-data field injection via unescaped CRLF in `fixRequestBody`
0 news outlets0 CERTs0 researchersCVSS 7.5 - 48impact
xmldom: Quadratic-time attribute deduplication
0 news outlets0 CERTs0 researchersCVSS 8.7 - 41impact
http-proxy-middleware `router` host+path substring matching allows Host-header-driven backend routing bypass
0 news outlets0 CERTs0 researchersCVSS 6.9 - 42impact
Axios: maxRedirects: 0 is not enforced by the fetch adapter, allowing redirect-based SSRF
0 news outlets0 CERTs0 researchersCVSS 7.0 - 42impact
Axios: HTTP/2 adapter bypasses configured DNS lookup and proxy controls
0 news outlets0 CERTs0 researchersCVSS 7.0 - 38impact
undici vulnerable to Denial of Service via WebSocketStream unclean close
0 news outlets0 CERTs0 researchersCVSS 5.9 - 43impact
fast-uri vulnerable to host confusion via skipped IDN canonicalization on scheme-relative references
0 news outlets0 CERTs0 researchersCVSS 7.5 - 46impact
axios before 0.33.0 Prototype Pollution via Node HTTP adapter
0 news outlets0 CERTs0 researchersCVSS 8.3 - 41impact
fast-uri vulnerable to host confusion via percent-encoded scheme normalization
0 news outlets0 CERTs0 researchersCVSS 7.5 - 41impact
axios 1.13.0 before 1.18.0 maxBodyLength Bypass via HTTP/2
0 news outlets0 CERTs0 researchersCVSS 6.3 - 41impact
Axios: Prototype-Pollution Gadget in the Default Instance Allows Inherited Object.prototype.method to Override HTTP Method
0 news outlets0 CERTs0 researchersCVSS 6.9 - 43impact
undici vulnerable to Denial of Service via unrequested WebSocket subprotocol
0 news outlets0 CERTs0 researchersCVSS 7.5 - 41impact
fast-uri vulnerable to server-side request forgery via repeated hostname percent-decoding
0 news outlets0 CERTs0 researchersCVSS 7.5 - 45impact
Axios: Denial of Service via Unhandled 'error' Event in HTTP/2 ClientHttp2Session Initialization
0 news outlets0 CERTs0 researchersCVSS 8.2 - 38impact
undici vulnerable to Denial of Service via unhandled error in WebSocket permessage-deflate decompression
0 news outlets0 CERTs0 researchersCVSS 5.9 - 41impact
Axios: Header Injection via Inherited headers After Minimal Interceptor
0 news outlets0 CERTs0 researchersCVSS 6.9 - 45impact
Axios: Prototype Pollution Gadget in axios toFormData Options
0 news outlets0 CERTs0 researchersCVSS 8.3 - 41impact
Microsoft Authentication Library (MSAL) for Node.js Information Disclosure Vulnerability
0 news outlets1 CERTs0 researchersCVSS 5.9 - 41impact
fast-uri vulnerable to server-side request forgery via malformed IPv6 normalization
0 news outlets0 CERTs0 researchersCVSS 7.5 - 42impact
Axios: Fetch Adapter Header Injection via Inherited FormData getHeaders
0 news outlets0 CERTs0 researchersCVSS 6.9 - 33impact
fast-uri vulnerable to inconsistent host case normalization via percent-encoded octets
0 news outlets0 CERTs0 researchersCVSS 4.8 - 42impact
Apache Thrift: Node.js web_server.js multi-vulnerability
0 news outlets0 CERTs0 researchersCVSS 7.3 - 30impact
i18next-http-backend incomplete URL validation permits SSRF
0 news outlets0 CERTs0 researchersCVSS 3.7 - 41impact
Axios: Prototype pollution gadget in fetch adapter can alter outbound requests
0 news outlets0 CERTs0 researchersCVSS 6.9
Sources
CERTs and cyber security agencies, national news outlets in every country we could find, vendor advisories, research blogs and the security press. Every source is polled on its own schedule, by RSS where possible and by headless browser where not. Broken feeds are repaired automatically; anything still failing is listed here.
Sources admin
Enter the admin token from your server’s .env file (ADMIN_TOKEN). It’s sent once to start a session and isn’t stored in this browser.
Recent sign-in activity
Pipeline, last 24 hours
How many articles each type of source produced, how many were read in full, and how many were linked to a vulnerability. “Unmatched” are articles that look like vulnerability news but couldn’t be linked; the reasons and examples show what to improve.
Add a source
Coverage
All sources
How it works
Vulnocalypse reads vulnerability registries, government CERTs, vendor advisories, research blogs and newsrooms around the clock, links everything that refers to the same vulnerability, and only shows what passes automated validation.
What gets into the feed
A vulnerability is admitted when it is corroborated, either through a published CVE record or through at least two independent organisations, and its impact score reaches 60 out of 100. Anything listed in a known-exploited catalogue is admitted regardless of score. Once admitted, an entry stays, so the feed never flickers.
Impact score
Up to 30 points for severity (CVSS, or inferred from the description when no score exists), 25 for exploitation, 15 for blast radius by product category (edge devices and identity systems score highest), 15 for attention from news, CERTs and researchers, 10 for EPSS exploitation probability, and 5 for pre-authentication. Every entry shows its breakdown.
Exploitation status
We only mark something exploited when there is a citable source: a KEV listing (CISA, VulnCheck or ENISA), a statement from the vendor or a government agency, CISA’s SSVC assessment, or at least two independent organisations reporting attacks with no later denial from the vendor. Phrases like “no evidence of exploitation” are detected and count against a claim.
Validation, without humans
Identifiers are checked against the CVE List; rejected or non-existent CVEs are dropped. Titles, vendors, products and CVSS come from the official record rather than from headlines. Wire stories syndicated across outlets are counted once. Roundups that list dozens of CVEs only count the ones they actually discuss. Reports without an identifier wait for corroboration and are merged into the right CVE once one is assigned. Every decision is logged and shown on each vulnerability’s page.
The Panic meter
Three numbers over the past 24 hours, counting only vulnerabilities first seen in the last 14 days: distinct researchers posting about them, distinct news organisations covering them, and distinct CERTs and agencies warning about them. Each is ranked against its own 90-day history, weighted 35% CERTs, 35% news and 30% researchers, and stretched so the top levels stay rare. Each day’s score is split across the vulnerabilities that caused it.
The outbreak map
The map shows two things for every country: how many national news outlets are covering new vulnerabilities, and whether the national CERT or cyber security agency has issued a warning. National outlets are read directly, through local-language Google News editions, and through GDELT, which attributes coverage in over 100 languages to its source country. International security press is left off the map so it shows national attention, not trade coverage. Replay the spread to watch a vulnerability travel from patient zero across the world.
Subscribe
- Everything (RSS), also as Atom and JSON Feed
- Exploited only and KEV-listed only
- Updates: new KEV listings, exploitation changes and public exploits for tracked vulnerabilities
- Per vendor:
/feed.xml?vendor=Fortinet, or by score:/feed.xml?min_score=80
Use it from an AI agent
Vulnocalypse runs a read-only MCP server. Add it to any MCP client as a remote server:
https://vulnocalypse.com/mcpTools: get_feed, search_vulnerabilities, get_vulnerability, check_exposure (send the products you run and get back anything that affects them), get_panic and explain_panic_day. The JSON API is documented at /api/docs.