Live tracker of exploited and high-impact vulnerabilities
New vulnerabilities from CERTs, vendors, researchers and newsrooms in 180+ countries, checked automatically, with how widely each one is being exploited, warned about and covered.
Panic meter
Connecting- Researchers talking
- –
- News outlets covering
- –
- CERTs and agencies warning
- –
Distinct people and organisations discussing new vulnerabilities in the past 24 hours. Get alerts when it changes
Trending now
Outbreak map
- Countries in the news
- –
- Agencies warning
- –
- Countries warned
- –
- Patient zero
- –
Daily panic
Vulnerabilities
Alerts
Get told when the Panic meter changes level or surges, and when new vulnerabilities are confirmed exploited or warned about by CERTs in several countries. Every alert says what’s driving it, who’s warning, how widely it’s covered and where the fix is.
Browser notifications
Notifications on this device, even when the site isn’t open. On iPhone and iPad, add Vulnocalypse to your Home Screen first.
Slack, Teams, Discord or webhook
Paste an incoming webhook URL. We send a test message first and only connect it if it arrives.
Where do I get a webhook URL?
Slack: create an app with Incoming Webhooks enabled, add it to a channel and copy the URL. Microsoft Teams: in the channel, use Workflows → “Post to a channel when a webhook request is received”. Discord: channel settings → Integrations → Webhooks → New webhook → Copy URL. Anything else: any HTTPS endpoint that accepts JSON; you’ll get a secret to verify our signature.
RSS
No sign-up and nothing stored: subscribe to /alerts.xml in any feed reader.
Your alerts on this browser
Recent alerts
Privacy
We store only what’s needed to deliver alerts: your browser’s push address and encryption keys (random values your browser creates, with no name or email) or the webhook URL you enter, plus your choices above. No accounts, no IP addresses and no tracking. Removing an alert here, or using the manage link in any message, deletes it immediately.
Red Hat vulnerabilities
Every Red Hat vulnerability Vulnocalypse is tracking, newest first: whether it’s being exploited, which CERTs have warned about it and how widely it’s covered. Subscribe with the RSS feed for Red Hat alerts.
- 33impact
Libxml2: double-free/uaf in libxml2 python bindings
0 news outlets0 CERTs0 researchersCVSS 8.5 - 41impact
Undertow: undertow: request smuggling via inconsistent header parsing
0 news outlets0 CERTs0 researchersCVSS 8.7 - 18impact
Tar: tar: --one-top-level hardlink targets not confined to top-level directory enabling arbitrary file overwrite
0 news outlets0 CERTs0 researchersCVSS 4.4 - 41impact
Undertow: undertow: request smuggling via `\r\r\r` as a header block terminator
0 news outlets0 CERTs0 researchersCVSS 8.7 - 22impact
Tar: tar: hidden file injection via crafted archives
0 news outlets0 CERTs0 researchersCVSS 5.0 - 29impact
Ansible-core: argument injection in ansible-galaxy role install leads to arbitrary code execution
0 news outlets0 CERTs0 researchersCVSS 7.8 - 17impact
Tar: tar: toctou in incremental dumpdir 'x' rename handling allows restore path escape
0 news outlets0 CERTs0 researchersCVSS 4.4 - 31impact
Libtiff: out-of-memory in tiffopen via a craft file
0 news outlets0 CERTs0 researchersCVSS 6.5 - 40impact
Libtiff: segment fault in libtiff in tiffreadrgbatileext() leading to denial of service
0 news outlets0 CERTs0 researchersCVSS 7.5 - 39impact
Libexpat: expat: improper restriction of xml entity expansion depth in libexpat
0 news outlets0 CERTs0 researchersCVSS 7.5 - 19impact
Libarchive: reading past eof may be triggered for piped file streams
0 news outlets0 CERTs0 researchersCVSS 3.9 - 38impact
Libarchive: libarchive: information disclosure via heap out-of-bounds read in rar archive processing
0 news outlets0 CERTs0 researchersCVSS 7.5 - 35impact
- 41impact
Undertow: undertow: request smuggling via malformed http request headers
0 news outlets0 CERTs0 researchersCVSS 8.7 - 35impact
Io.netty/netty-codec-stomp: netty: stomp codec content-length long-to-int truncation causes infinite decode loop dos
0 news outlets0 CERTs0 researchersCVSS 7.5 - 35impact
Io.netty/netty-codec-mqtt: netty: resource exhaustion in mqttdecoder
0 news outlets0 CERTs0 researchersCVSS 7.5 - 40impact
Io.netty/netty-codec-http2: http/1 authority-form connect is translated to malformed http/2 connect with host-controlled :authority
0 news outlets0 CERTs0 researchersCVSS 7.5 - 31impact
Io.netty/netty-codec-memcache: netty: memcache binary codec signed/unsigned type mismatch causes frame desynchronization and response smuggling
0 news outlets0 CERTs0 researchersCVSS 6.5 - 28impact
Io.netty/netty-codec-http2: netty: http/2 hpackencoder dos with large table size
0 news outlets0 CERTs0 researchersCVSS 5.3 - 28impact
Io.netty/netty-handler-ssl-ocsp: netty: ocsp validation silently skipped when a response omits the optional nextupdate field
0 news outlets0 CERTs0 researchersCVSS 5.9 - 28impact
Io.netty/netty-handler-ssl-ocsp: netty: missing extended key usage (eku) check in ocsp client allows certificate revocation bypass
0 news outlets0 CERTs0 researchersCVSS 5.9 - 38impact
Io.netty/netty-codec-haproxy: netty: haproxy proxy-v2 nested-tlv grandchild bytebuf reference-count leak (incomplete fix of pr #16881)
0 news outlets0 CERTs0 researchersCVSS 7.5 - 36impact
Io.netty/netty-codec-http: netty: http request smuggling via post-digit whitespace in chunk-size parsing
0 news outlets0 CERTs0 researchersCVSS 6.5 - 34impact
Libxml2: libxml2: denial of service via crafted xsd-validated document
0 news outlets0 CERTs0 researchersCVSS 6.5 - 34impact
Io.netty/netty-codec-http2: netty: http/2 header field values are not validated by default (cr/lf/nul passthrough)
0 news outlets0 CERTs0 researchersCVSS 6.5 - 26impact
Gstreamer: incomplete fix of cve-2026-1940
0 news outlets0 CERTs0 researchersCVSS 5.1 - 34impact
Io.netty/netty-codec-smtp: netty: unbounded multi-line response accumulation in smtpresponsedecoder leads to memory-exhaustion dos
0 news outlets0 CERTs0 researchersCVSS 7.5 - 35impact
Io.netty/netty-codec-stomp: netty: bytebuf leak in stompsubframedecoder when a frame body is never terminated
0 news outlets0 CERTs0 researchersCVSS 7.5 - 33impact
Io.netty/netty-codec-smtp: netty netty-codec-smtp — smtp command-name field is not crlf-validated (incomplete fix of cve-2025-59419)
0 news outlets0 CERTs0 researchersCVSS 7.5 - 38impact
Io.netty/netty-codec-http2: io.netty/netty-codec-http3: netty: http/2 and http/3 extended connect requests are downgraded as regular connect requests
0 news outlets0 CERTs0 researchersCVSS 7.5 - 42impact
Io.netty/netty-codec-http2: http/1 absolute-form host mismatch is translated to http/2 :authority, overriding the request-target authority
0 news outlets0 CERTs0 researchersCVSS 8.2 - 36impact
Gnutls: gnutls: authentication bypass via nul character in username
0 news outlets0 CERTs0 researchersCVSS 7.1 - 38impact
Gnutls: gnutls: denial of service via dtls packet reordering vulnerability
0 news outlets0 CERTs0 researchersCVSS 7.5 - 28impact
P11-kit: stack exhaustion via unbounded recursion in rpc attribute parsing
0 news outlets0 CERTs0 researchersCVSS 6.2 - 38impact
Gnutls: gnutls: certificate validation bypass due to oversized subject alternative name
0 news outlets0 CERTs0 researchersCVSS 8.2 - 40impact
Gnutls: gnutls: information disclosure via heap overread in rsa key exchange
0 news outlets0 CERTs0 researchersCVSS 8.2 - 31impact
Gnutls: gnutls: memory corruption due to off-by-one error in pkcs#12 bag handling
0 news outlets0 CERTs0 researchersCVSS 5.3 - 37impact
Gnutls: gnutls: denial of service via dtls zero-length fragment
0 news outlets0 CERTs0 researchersCVSS 7.5 - 35impact
Gnutls: gnutls: security bypass due to incorrect name constraint handling
0 news outlets0 CERTs0 researchersCVSS 7.4 - 34impact
Gnutls: gnutls: policy bypass due to case-sensitive nameconstraints comparison
0 news outlets0 CERTs0 researchersCVSS 6.5 - 32impact
P11-kit: null dereference via c_derivekey with specific null parameters
0 news outlets0 CERTs0 researchersCVSS 5.3 - 25impact
Gnutls: gnutls: information disclosure via timing side-channel in pkcs#7 padding removal
0 news outlets0 CERTs0 researchersCVSS 3.7 - 29impact
Gdbusserver: glib2: gdbusserver pre-authentication dos via unbounded sasl line buffering
0 news outlets0 CERTs0 researchersCVSS 5.3 - 26impact
Gnutls: gnutls: security bypass allows acceptance of revoked server certificates via crafted ocsp response
0 news outlets0 CERTs0 researchersCVSS 3.7 - 29impact
Gnutls: gnutls: certificate validation bypass due to improper handling of uri and srv sans
0 news outlets0 CERTs0 researchersCVSS 7.1 - 25impact
Gnutls: gnutls: use-after-free in gnutls_pkcs11_token_set_pin
0 news outlets0 CERTs0 researchersCVSS 6.6 - 19impact
Coreutils: heap buffer under-read in gnu coreutils sort via key specification
0 news outlets0 CERTs0 researchersCVSS 4.4 - 38impact
Gnutls: gnutls: denial of service via heap buffer overflow in dtls handshake fragment reassembly
0 news outlets0 CERTs0 researchersCVSS 7.5 - 32impact
Io.netty/netty-codec-http: netty: http request smuggling due to control characters in the chunk-size line
0 news outlets0 CERTs0 researchersCVSS 6.5 - 39impact
Codehaus-plexus: directory traversal
0 news outlets0 CERTs0 researchersCVSS 7.5 - 34impact
Corosync: corosync: heap-based buffer overflow in totempg assembly buffer during fragmented message reassembly
0 news outlets0 CERTs0 researchersCVSS 7.5 - 37impact
Io.netty/netty-codec-http: netty: denial of service via unbounded concurrent spdy streams
0 news outlets0 CERTs0 researchersCVSS 7.5 - 39impact
Pacemaker: pacemaker: denial of service via integer overflow in remote message decompression
0 news outlets0 CERTs0 researchersCVSS 8.6 - 22impact
Codehaus-plexus: xml external entity (xxe) injection
0 news outlets0 CERTs0 researchersCVSS 4.3 - 37impact
Io.netty/netty-codec-http: netty rtspdecoder method-token smuggling via trailing control byte
0 news outlets0 CERTs0 researchersCVSS 7.5 - 38impact
Io.netty/netty-codec-http: netty: unbounded per-connection queue growth in websocketserverextensionhandler leads to denial of service
0 news outlets0 CERTs0 researchersCVSS 7.5 - 25impact
Libkcapi: infinite loop denial of service in libkcapi _kcapi_aio_read_all() due to unhandled io_getevents() timeout return
0 news outlets0 CERTs0 researchersCVSS 5.1 - 27impact
Xdgmime: heap-based buffer overflow in _xdg_mime_magic_parse_magic_line() in xdgmimemagic.c
0 news outlets0 CERTs0 researchersCVSS 7.1 - 34impact
Io.netty/netty-codec-http: netty split transfer-encoding fields bypass final-chunked validation and enable request smuggling
0 news outlets0 CERTs0 researchersCVSS 6.5 - 23impact
Bluez: sdp-xml: bluez 5.86: unprivileged-local and adjacent-le-peer leads to arbitrary code execution as root
0 news outlets0 CERTs0 researchersCVSS 5.7 - 24impact
Bluez: bluez: out-of-bounds read in avrcp parse_media_element and parse_media_folder
0 news outlets0 CERTs0 researchersCVSS 6.3 - 33impact
Libkcapi: iv reuse in libkcapi one-shot symmetric cipher chunking causes cipher state reset across chunk boundaries
0 news outlets0 CERTs0 researchersCVSS 6.5 - 36impact
Bluez: stack overflow in name2utf8 causes dos and potential code execution
0 news outlets0 CERTs0 researchersCVSS 7.6 - 36impact
Resteasy-core: resteasy sourceprovider remote unauthenticated file read
0 news outlets0 CERTs0 researchersCVSS 7.5 - 32impact
Libkcapi: memory corruption via uncanceled aio requests on error in libkcapi's one-shot aio path
0 news outlets0 CERTs0 researchersCVSS 7.3 - 37impact
Openshift/console: openshift/console: unauthenticated ssrf and resource exhaustion via devfile parser endpoint
0 news outlets0 CERTs0 researchersCVSS 9.3
Sources
CERTs and cyber security agencies, national news outlets in every country we could find, vendor advisories, research blogs and the security press. Every source is polled on its own schedule, by RSS where possible and by headless browser where not. Broken feeds are repaired automatically; anything still failing is listed here.
Sources admin
Enter the admin token from your server’s .env file (ADMIN_TOKEN). It’s sent once to start a session and isn’t stored in this browser.
Recent sign-in activity
Coverage and speed audit
Checked against ground truth: every recent CISA KEV listing must be tracked and marked exploited; exploitation levels must match their evidence; and how fast each kind of source reaches us after it publishes.
Pipeline, last 24 hours
How many articles each type of source produced, how many were read in full, and how many were linked to a vulnerability. “Unmatched” are articles that look like vulnerability news but couldn’t be linked; the reasons and examples show what to improve.
Add a source
Coverage
All sources
How it works
Vulnocalypse reads vulnerability registries, government CERTs, vendor advisories, research blogs and newsrooms around the clock, links everything that refers to the same vulnerability, and only shows what passes automated validation.
What gets into the feed
A vulnerability is admitted when it is corroborated, either through a published CVE record or through at least two independent organisations, and its impact score reaches 60 out of 100. Anything listed in a known-exploited catalogue is admitted regardless of score. Once admitted, an entry stays, so the feed never flickers.
Impact score
Up to 30 points for severity (CVSS, or inferred from the description when no score exists), 25 for exploitation, 15 for blast radius by product category (edge devices and identity systems score highest), 15 for attention from news, CERTs and researchers, 10 for EPSS exploitation probability, and 5 for pre-authentication. Every entry shows its breakdown.
Exploitation status
We only mark something exploited when there is a citable source: a KEV listing (CISA, VulnCheck or ENISA), a statement from the vendor or a government agency, CISA’s SSVC assessment, or at least two independent organisations reporting attacks with no later denial from the vendor. Phrases like “no evidence of exploitation” are detected and count against a claim.
Validation, without humans
Identifiers are checked against the CVE List; rejected or non-existent CVEs are dropped. Titles, vendors, products and CVSS come from the official record rather than from headlines. Wire stories syndicated across outlets are counted once. Roundups that list dozens of CVEs only count the ones they actually discuss. Reports without an identifier wait for corroboration and are merged into the right CVE once one is assigned. Every decision is logged and shown on each vulnerability’s page.
The Panic meter
Three numbers over the past 24 hours, counting only vulnerabilities first seen in the last 14 days: distinct researchers posting about them, distinct news organisations covering them, and distinct CERTs and agencies warning about them. Each is ranked against its own 90-day history, weighted 35% CERTs, 35% news and 30% researchers, and stretched so the top levels stay rare. Each day’s score is split across the vulnerabilities that caused it.
The outbreak map
The map shows two things for every country: how many national news outlets are covering new vulnerabilities, and whether the national CERT or cyber security agency has issued a warning. National outlets are read directly, through local-language Google News editions, and through GDELT, which attributes coverage in over 100 languages to its source country. International security press is left off the map so it shows national attention, not trade coverage. Replay the spread to watch a vulnerability travel from patient zero across the world.
Subscribe
- Everything (RSS), also as Atom and JSON Feed
- Exploited only and KEV-listed only
- Updates: new KEV listings, exploitation changes and public exploits for tracked vulnerabilities
- Per vendor:
/feed.xml?vendor=Fortinet, or by score:/feed.xml?min_score=80
Use it from an AI agent
Vulnocalypse runs a read-only MCP server. Add it to any MCP client as a remote server:
https://vulnocalypse.com/mcpTools: get_feed, search_vulnerabilities, get_vulnerability, check_exposure (send the products you run and get back anything that affects them), get_panic and explain_panic_day. The JSON API is documented at /api/docs.