Live tracker of exploited and high-impact vulnerabilities
New vulnerabilities from CERTs, vendors, researchers and newsrooms in 180+ countries, checked automatically, with how widely each one is being exploited, warned about and covered.
Panic meter
Connecting- Researchers talking
- –
- News outlets covering
- –
- CERTs and agencies warning
- –
Distinct people and organisations discussing new vulnerabilities in the past 24 hours.
Trending now
Outbreak map
- Countries in the news
- –
- Agencies warning
- –
- Countries warned
- –
- Patient zero
- –
Daily panic
Vulnerabilities
OpenSSL vulnerabilities
Every OpenSSL vulnerability Vulnocalypse is tracking, newest first: whether it’s being exploited, which CERTs have warned about it and how widely it’s covered. Subscribe with the RSS feed for OpenSSL alerts.
- 78impact
Heartbleed (CVE-2014-0160): A Persistently Recurring OpenSSL Vulnerability in Jamaican Networks
Known exploited (KEV) (CISA)0 news outlets1 CERTs0 researchersCVSS 7.5 - 41impact
OpenSSL TLS 1.3 server may choose unexpected key agreement group
0 news outlets0 CERTs0 researchersCVSS 6.5 - 55impact
Untrusted Sender DN Used as Format String in CMP Response Validation
0 news outlets0 CERTs0 researchersCVSS 9.8 - 44impact
Client-Side Memory Leak in OCSP Response Checking
0 news outlets0 CERTs0 researchersCVSS 7.5 - 31impact
Heap Buffer Overflow in Hexadecimal Conversion
0 news outlets0 CERTs0 researchersCVSS 5.8 - 46impact
Heap Buffer Over-read in ASN.1 Content Parsing
0 news outlets0 CERTs0 researchersCVSS 7.5 - 38impact
ASN1_TYPE Type Confusion in the PKCS7_digest_from_attributes() function
0 news outlets0 CERTs0 researchersCVSS 5.3 - 45impact
QUIC ACK-only Packet Retention Can Cause Memory Exhaustion
0 news outlets0 CERTs0 researchersCVSS 7.5 - 44impact
Excessive Memory Use Buffering DTLS Records for a Future Epoch
0 news outlets0 CERTs0 researchersCVSS 7.5 - 45impact
NULL Pointer Dereference in QUIC Server Initial Packet Handling
0 news outlets0 CERTs0 researchersCVSS 7.5 - 39impact
OpenSSL OpenSSL: strongSwan 5.0.2 through 6.0.7 has an Expired Pointer Dereference in PKCS#7 parsing in the openssl plugin.
0 news outlets0 CERTs0 researchersCVSS 5.9 - 45impact
AES-OCB IV Ignored on EVP_Cipher() Path
0 news outlets0 CERTs0 researchersCVSS 7.5 - 46impact
Heap Buffer Overflow in CMS Key Unwrapping
0 news outlets0 CERTs0 researchersCVSS 7.5 - 47impact
Invalid Pointer Dereference in CMP Server via Crafted protectionAlg
0 news outlets0 CERTs0 researchersCVSS 7.5 - 45impact
Possible NULL Dereference When Processing CMS KeyAgreeRecipientInfo
0 news outlets0 CERTs0 researchersCVSS 7.5 - 29impact
Trust-Anchor Substitution via cert/issuer Typo in CMP rootCaKeyUpdate
0 news outlets0 CERTs0 researchersCVSS 5.3 - 43impact
Out-of-bounds read in HTTP client no_proxy handling
0 news outlets0 CERTs0 researchersCVSS 5.9 - 46impact
Unbounded Memory Growth in the QUIC PATH_CHALLENGE Handler
0 news outlets0 CERTs0 researchersCVSS 7.5 - 45impact
Missing ASN1_TYPE validation in TS_RESP_verify_response() function
0 news outlets0 CERTs0 researchersCVSS 7.5 - 53impact
CMS AuthEnvelopedData Processing May Accept Forged Messages
0 news outlets0 CERTs0 researchersCVSS 9.1 - 46impact
NULL Pointer Dereference in PKCS12_item_decrypt_d2i_ex function
0 news outlets0 CERTs0 researchersCVSS 7.5 - 46impact
Incorrect Failure Handling in RSA KEM RSASVE Encapsulation
0 news outlets0 CERTs0 researchersCVSS 7.5 - 33impact
Incorrect Tag Processing for Empty Messages in AES-GCM-SIV and AES-SIV modes
0 news outlets0 CERTs0 researchersCVSS 4.8 - 46impact
Potential Use-after-free in DANE Client Code
0 news outlets0 CERTs0 researchersCVSS 8.1 - 33impact
OpenSSL partial chain store policy bypass
0 news outlets0 CERTs0 researchersCVSS 5.3 - 40impact
PKCS#12 Files with PBMAC1 Are Accepted with Short HMAC Keys
0 news outlets0 CERTs0 researchersCVSS 7.4 - 30impact
OpenSSL OpenSSL: strongSwan 5.0.2 through 6.0.7 allows PKCS#7 certificate enumeration in the openssl plugin that leads to a lack of relea
0 news outlets0 CERTs0 researchersCVSS 3.7 - 45impact
Unbounded Memory Growth in QUIC Server Incoming Channel Queue
0 news outlets0 CERTs0 researchersCVSS 7.5 - 46impact
RPK Server Signature Algorithm Selection Can Dereference a Missing Certificate
0 news outlets0 CERTs0 researchersCVSS 7.5 - 47impact
QUIC Server May Trigger Double Free When Processing INITIAL Packet
0 news outlets0 CERTs0 researchersCVSS 7.5 - 41impact
Possible NULL Dereference in Password-Based CMS Decryption
0 news outlets0 CERTs0 researchersCVSS 5.9 - 45impact
Out-of-Bounds Read in CMS Password-Based Decryption
0 news outlets0 CERTs0 researchersCVSS 7.5 - 34impact
Multi-RecipientInfo Bleichenbacher Oracle in CMS_decrypt() and PKCS7_decrypt()
0 news outlets0 CERTs0 researchersCVSS 3.7 - 27impact
Heap out-of-bounds write in BIO_f_linebuffer on short writes
0 news outlets0 CERTs0 researchersCVSS 4.7 - 32impact
FFC-DH Peer Validation Uses Attacker-Supplied q
0 news outlets0 CERTs0 researchersCVSS 3.7 - 39impact
NULL Pointer Dereference in CRMF EncryptedValue Decryption
0 news outlets0 CERTs0 researchersCVSS 5.9 - 29impact
Missing ASN1_TYPE validation in PKCS#12 parsing
0 news outlets0 CERTs0 researchersCVSS 5.5 - 46impact
AEAD Forgeries with Empty Ciphertext When Using EVP_Cipher()
0 news outlets0 CERTs0 researchersCVSS 9.1 - 45impact
Possible NULL Dereference When Processing CMS KeyTransportRecipientInfo
0 news outlets0 CERTs0 researchersCVSS 7.5 - 45impact
NULL Pointer Dereference When Processing a Delta CRL
0 news outlets0 CERTs0 researchersCVSS 7.5 - 47impact
Heap Use-After-Free in the PKCS7_verify() Function
0 news outlets0 CERTs0 researchersCVSS 8.8 - 44impact
Out of bounds write in PKCS12_get_friendlyname() UTF-8 conversion
0 news outlets0 CERTs0 researchersCVSS 7.4 - 29impact
Unauthenticated/unencrypted trailing bytes with low-level OCB function calls
0 news outlets0 CERTs0 researchersCVSS 4.0 - 48impact
Stack buffer overflow in CMS (Auth)EnvelopedData parsing
0 news outlets0 CERTs0 researchersCVSS 8.8 - 39impact
CMP Indefinite Cache Growth of ExtraCerts
0 news outlets0 CERTs0 researchersCVSS 5.9 - 47impact
Out-of-bounds read & write in RFC 3211 KEK Unwrap
0 news outlets0 CERTs0 researchersCVSS 7.5 - 47impact
Possible Heap Buffer Overflow in ASN.1 Multibyte String Conversion
0 news outlets0 CERTs0 researchersCVSS 8.1 - 42impact
OpenSSL pinning bypass
0 news outlets0 CERTs0 researchersCVSS 7.5 - 28impact
- 42impact
libgit2: Inverted IP SubjectAltName Comparison in OpenSSL Backend
0 news outlets1 CERTs0 researchersCVSS 6.5
Sources
CERTs and cyber security agencies, national news outlets in every country we could find, vendor advisories, research blogs and the security press. Every source is polled on its own schedule, by RSS where possible and by headless browser where not. Broken feeds are repaired automatically; anything still failing is listed here.
Sources admin
Enter the admin token from your server’s .env file (ADMIN_TOKEN). It’s sent once to start a session and isn’t stored in this browser.
Recent sign-in activity
Pipeline, last 24 hours
How many articles each type of source produced, how many were read in full, and how many were linked to a vulnerability. “Unmatched” are articles that look like vulnerability news but couldn’t be linked; the reasons and examples show what to improve.
Add a source
Coverage
All sources
How it works
Vulnocalypse reads vulnerability registries, government CERTs, vendor advisories, research blogs and newsrooms around the clock, links everything that refers to the same vulnerability, and only shows what passes automated validation.
What gets into the feed
A vulnerability is admitted when it is corroborated, either through a published CVE record or through at least two independent organisations, and its impact score reaches 60 out of 100. Anything listed in a known-exploited catalogue is admitted regardless of score. Once admitted, an entry stays, so the feed never flickers.
Impact score
Up to 30 points for severity (CVSS, or inferred from the description when no score exists), 25 for exploitation, 15 for blast radius by product category (edge devices and identity systems score highest), 15 for attention from news, CERTs and researchers, 10 for EPSS exploitation probability, and 5 for pre-authentication. Every entry shows its breakdown.
Exploitation status
We only mark something exploited when there is a citable source: a KEV listing (CISA, VulnCheck or ENISA), a statement from the vendor or a government agency, CISA’s SSVC assessment, or at least two independent organisations reporting attacks with no later denial from the vendor. Phrases like “no evidence of exploitation” are detected and count against a claim.
Validation, without humans
Identifiers are checked against the CVE List; rejected or non-existent CVEs are dropped. Titles, vendors, products and CVSS come from the official record rather than from headlines. Wire stories syndicated across outlets are counted once. Roundups that list dozens of CVEs only count the ones they actually discuss. Reports without an identifier wait for corroboration and are merged into the right CVE once one is assigned. Every decision is logged and shown on each vulnerability’s page.
The Panic meter
Three numbers over the past 24 hours, counting only vulnerabilities first seen in the last 14 days: distinct researchers posting about them, distinct news organisations covering them, and distinct CERTs and agencies warning about them. Each is ranked against its own 90-day history, weighted 35% CERTs, 35% news and 30% researchers, and stretched so the top levels stay rare. Each day’s score is split across the vulnerabilities that caused it.
The outbreak map
The map shows two things for every country: how many national news outlets are covering new vulnerabilities, and whether the national CERT or cyber security agency has issued a warning. National outlets are read directly, through local-language Google News editions, and through GDELT, which attributes coverage in over 100 languages to its source country. International security press is left off the map so it shows national attention, not trade coverage. Replay the spread to watch a vulnerability travel from patient zero across the world.
Subscribe
- Everything (RSS), also as Atom and JSON Feed
- Exploited only and KEV-listed only
- Updates: new KEV listings, exploitation changes and public exploits for tracked vulnerabilities
- Per vendor:
/feed.xml?vendor=Fortinet, or by score:/feed.xml?min_score=80
Use it from an AI agent
Vulnocalypse runs a read-only MCP server. Add it to any MCP client as a remote server:
https://vulnocalypse.com/mcpTools: get_feed, search_vulnerabilities, get_vulnerability, check_exposure (send the products you run and get back anything that affects them), get_panic and explain_panic_day. The JSON API is documented at /api/docs.