Live tracker of exploited and high-impact vulnerabilities
New vulnerabilities from CERTs, vendors, researchers and newsrooms in 180+ countries, checked automatically, with how widely each one is being exploited, warned about and covered.
Panic meter
Connecting- Researchers talking
- –
- News outlets covering
- –
- CERTs and agencies warning
- –
Distinct people and organisations discussing new vulnerabilities in the past 24 hours.
Trending now
Outbreak map
- Countries in the news
- –
- Agencies warning
- –
- Countries warned
- –
- Patient zero
- –
Daily panic
Vulnerabilities
Spring vulnerabilities
Every Spring vulnerability Vulnocalypse is tracking, newest first: whether it’s being exploited, which CERTs have warned about it and how widely it’s covered. Subscribe with the RSS feed for Spring alerts.
- 21impact
User Attribute Enumeration when Using DaoAuthenticationProvider
0 news outlets0 CERTs0 researchersCVSS 3.7 - 35impact
Spring Framework Denial of Service via Unbounded List Growth in Data Binding
0 news outlets0 CERTs0 researchersCVSS 7.5 - 43impact
Server Sent Event stream corruption in Spring MVC functional web framework
0 news outlets0 CERTs0 researchersCVSS 9.8 - 24impact
Spring Framework Open Redirect in UrlFileNameViewController
0 news outlets0 CERTs0 researchersCVSS 6.1 - 35impact
Spring Framework Memory Leak via SETUP Frame in RSocketMessageHandler
0 news outlets0 CERTs0 researchersCVSS 7.5 - 25impact
Spring Framework Security Filter Bypass in WebFlux Kotlin Router DSL
0 news outlets0 CERTs0 researchersCVSS 4.8 - 24impact
Spring Security JdbcOneTimeTokenService allows a one-time token to authenticate multiple sessions
0 news outlets0 CERTs0 researchersCVSS 4.8 - 43impact
Spring Framework Improper Path Limitation in XsltView
0 news outlets0 CERTs0 researchersCVSS 9.8 - 30impact
Spring Framework Improper Path Limitation with Script View Templates
0 news outlets0 CERTs0 researchersCVSS 5.9 - 41impact
CVE-2024-38816: Path traversal vulnerability in functional web frameworks
0 news outlets0 CERTs0 researchersCVSS 7.5 - 36impact
CVE-2025-22228: Spring Security BCryptPasswordEncoder does not enforce maximum password length
0 news outlets0 CERTs0 researchersCVSS 7.4 - 23impact
Spring Framework Cross-site Scripting via JSP Form Tags
0 news outlets0 CERTs0 researchersCVSS 5.9 - 20impact
Spring Framework Predictable Session ID in WebSocket Module
0 news outlets0 CERTs0 researchersCVSS 4.8 - 36impact
Spring Framework Unsafe Deserialization via Jackson JMS Converters
0 news outlets0 CERTs0 researchersCVSS 8.1 - 18impact
Spring Framework Server-Side Request Forgery via UriComponentsBuilder
0 news outlets0 CERTs0 researchersCVSS 4.2 - 25impact
Mail Auto-Configuration Does Not Enable SSL Hostname Verification
0 news outlets0 CERTs0 researchersCVSS 5.0 - 24impact
Spring Framework Open Redirect in UrlHandlerFilter
0 news outlets0 CERTs0 researchersCVSS 6.1 - 12impact
Server Sent Event stream corruption
0 news outlets0 CERTs0 researchersCVSS 2.6 - 35impact
Spring Framework Denial of Service via Versioned Resources in Spring MVC and WebFlux
0 news outlets0 CERTs0 researchersCVSS 7.5 - 27impact
Spring Framework Multipart Request Smuggling in Spring MVC and WebFlux
0 news outlets0 CERTs0 researchersCVSS 5.3 - 30impact
Spring Spring Framework: Spring WebFlux applications are vulnerable to Denial of Service (DoS) attacks when processing multipart requests. Affect
0 news outlets0 CERTs0 researchersCVSS 5.9 - 27impact
Spring Framework Cross-site Scripting via JavaScriptUtils
0 news outlets0 CERTs0 researchersCVSS 7.1 - 22impact
Spring Framework Arbitrary Method Invocation in SpEL Expressions
0 news outlets0 CERTs0 researchersCVSS 3.7 - 29impact
Timing Attack via Non-Constant-Time Comparison of Sensitive Values
0 news outlets0 CERTs0 researchersCVSS 5.9 - 43impact
Spring Framework Server Sent Event stream corruption while rendering fragments
0 news outlets0 CERTs0 researchersCVSS 9.8 - 20impact
Predictable Temp Directory in Artemis Auto-configuration
0 news outlets0 CERTs0 researchersCVSS 5.3 - 43impact
Spring Framework maxInMemorySize Bypassed in Jaxb2Decoder
0 news outlets0 CERTs0 researchersCVSS 9.8 - 26impact
Spring Spring Boot: When configured to use an SSL bundle, Spring Boot's RabbitMQ auto-configuration does not perform hostname verification w
0 news outlets0 CERTs0 researchersCVSS 5.0 - 29impact
Spring Framework Denial of Service via Unbounded Cache in SpEL
0 news outlets0 CERTs0 researchersCVSS 5.3 - 35impact
Spring Framework Request Headers Included in Exception Reasons in HandshakeWebsocketService
0 news outlets0 CERTs0 researchersCVSS 7.5 - 25impact
Spring Spring Boot: A local attacker on the same host as the application may be able to take control of the directory used by `ApplicationTe
0 news outlets0 CERTs0 researchersCVSS 7.0 - 24impact
Spring Framework Denial of Service via AntPathMatcher
0 news outlets0 CERTs0 researchersCVSS 3.7 - 17impact
Spring Framework DataBinder Case Sensitive Match Exception
0 news outlets0 CERTs0 researchersCVSS 3.1 - 24impact
Spring Framework Cross-site Scripting via EscapedErrors
0 news outlets0 CERTs0 researchersCVSS 6.1 - 20impact
Spring Framework Path Traversal via Backslash in SpringTemplateLoader
0 news outlets0 CERTs0 researchersCVSS 4.3 - 18impact
Spring Spring Boot: When an application is configured to use `ApplicationPidFileWriter`, a local attacker with write access to the PID file'
0 news outlets0 CERTs0 researchersCVSS 4.7 - 41impact
Spring Spring Boot: In certain circumstances, Spring Boot's default web security is ineffective allowing unauthorized access to all endpoint
0 news outlets0 CERTs0 researchersCVSS 9.1 - 29impact
Spring Framework Information Disclosure via Static Resource Cache in Spring MVC and WebFlux
0 news outlets0 CERTs0 researchersCVSS 5.9 - 35impact
Spring Framework sameSite Attribute Dropped in JettyCoreServerHttpResponse
0 news outlets0 CERTs0 researchersCVSS 7.5 - 18impact
Spring Framework Escalation via Session Fixation in WebFlux
0 news outlets0 CERTs0 researchersCVSS 4.2 - 41impact
Spring Framework Safety Guard Bypass via SpEL Expression Compilation
0 news outlets0 CERTs0 researchersCVSS 9.1 - 27impact
Spring Spring Boot: Spring Boot's Cassandra auto-configuration does not perform hostname verification when establishing an SSL connection to
0 news outlets0 CERTs0 researchersCVSS 5.0 - 43impact
Spring Framework Header Predicate Bypass in WebFlux Functional Endpoints
0 news outlets0 CERTs0 researchersCVSS 9.8 - 22impact
Spring Security InetAddressMatchers Incomplete Internal Network Classification
0 news outlets0 CERTs0 researchersCVSS 3.7 - 35impact
Spring Framework Denial of Service via Integer Overflow in SpEL Expressions
0 news outlets0 CERTs0 researchersCVSS 7.5 - 35impact
CVE-2024-22262: Spring Framework URL Parsing with Host Validation
0 news outlets0 CERTs0 researchersCVSS 8.1 - 37impact
CVE-2024-22259: Spring Framework URL Parsing with Host Validation (2nd report)
0 news outlets0 CERTs0 researchersCVSS 8.1 - 27impact
Spring Spring Boot: Values produced by ${random.value} are not suitable for use as secrets. ${random.uuid} is not affected. ${random.int} an
0 news outlets0 CERTs0 researchersCVSS 4.8 - 18impact
Spring Framework Open Redirect in Spring MVC and WebFlux
0 news outlets0 CERTs0 researchersCVSS 4.2 - 35impact
Spring Framework Denial of Service via Unbounded Exponentiation in SpEL Expressions
0 news outlets0 CERTs0 researchersCVSS 7.5 - 22impact
Spring Framework response splitting in ContentDisposition
0 news outlets0 CERTs0 researchersCVSS 3.7 - 38impact
RFD Attack via "Content-Disposition" Header Sourced from Request Input by Spring MVC or Spring WebFlux Application
0 news outlets0 CERTs0 researchersCVSS 8.0 - 35impact
Spring Framework Algorithmic Denial of Service via SpEL Expressions
0 news outlets0 CERTs0 researchersCVSS 7.5 - 34impact
Spring Framework maxPartSize Ignored in PartEventHttpMessageReader
0 news outlets0 CERTs0 researchersCVSS 7.5 - 22impact
CVE-2024-38808: Spring Expression DoS Vulnerability
0 news outlets0 CERTs0 researchersCVSS 4.3 - 30impact
Spring Framework Path Traversal via Versioned Static Resources in Spring MVC and WebFlux
0 news outlets0 CERTs0 researchersCVSS 5.9 - 37impact
CVE-2024-22243: Spring Framework URL Parsing with Host Validation
0 news outlets0 CERTs0 researchersCVSS 8.1
Sources
CERTs and cyber security agencies, national news outlets in every country we could find, vendor advisories, research blogs and the security press. Every source is polled on its own schedule, by RSS where possible and by headless browser where not. Broken feeds are repaired automatically; anything still failing is listed here.
Sources admin
Enter the admin token from your server’s .env file (ADMIN_TOKEN). It’s sent once to start a session and isn’t stored in this browser.
Recent sign-in activity
Pipeline, last 24 hours
How many articles each type of source produced, how many were read in full, and how many were linked to a vulnerability. “Unmatched” are articles that look like vulnerability news but couldn’t be linked; the reasons and examples show what to improve.
Add a source
Coverage
All sources
How it works
Vulnocalypse reads vulnerability registries, government CERTs, vendor advisories, research blogs and newsrooms around the clock, links everything that refers to the same vulnerability, and only shows what passes automated validation.
What gets into the feed
A vulnerability is admitted when it is corroborated, either through a published CVE record or through at least two independent organisations, and its impact score reaches 60 out of 100. Anything listed in a known-exploited catalogue is admitted regardless of score. Once admitted, an entry stays, so the feed never flickers.
Impact score
Up to 30 points for severity (CVSS, or inferred from the description when no score exists), 25 for exploitation, 15 for blast radius by product category (edge devices and identity systems score highest), 15 for attention from news, CERTs and researchers, 10 for EPSS exploitation probability, and 5 for pre-authentication. Every entry shows its breakdown.
Exploitation status
We only mark something exploited when there is a citable source: a KEV listing (CISA, VulnCheck or ENISA), a statement from the vendor or a government agency, CISA’s SSVC assessment, or at least two independent organisations reporting attacks with no later denial from the vendor. Phrases like “no evidence of exploitation” are detected and count against a claim.
Validation, without humans
Identifiers are checked against the CVE List; rejected or non-existent CVEs are dropped. Titles, vendors, products and CVSS come from the official record rather than from headlines. Wire stories syndicated across outlets are counted once. Roundups that list dozens of CVEs only count the ones they actually discuss. Reports without an identifier wait for corroboration and are merged into the right CVE once one is assigned. Every decision is logged and shown on each vulnerability’s page.
The Panic meter
Three numbers over the past 24 hours, counting only vulnerabilities first seen in the last 14 days: distinct researchers posting about them, distinct news organisations covering them, and distinct CERTs and agencies warning about them. Each is ranked against its own 90-day history, weighted 35% CERTs, 35% news and 30% researchers, and stretched so the top levels stay rare. Each day’s score is split across the vulnerabilities that caused it.
The outbreak map
The map shows two things for every country: how many national news outlets are covering new vulnerabilities, and whether the national CERT or cyber security agency has issued a warning. National outlets are read directly, through local-language Google News editions, and through GDELT, which attributes coverage in over 100 languages to its source country. International security press is left off the map so it shows national attention, not trade coverage. Replay the spread to watch a vulnerability travel from patient zero across the world.
Subscribe
- Everything (RSS), also as Atom and JSON Feed
- Exploited only and KEV-listed only
- Updates: new KEV listings, exploitation changes and public exploits for tracked vulnerabilities
- Per vendor:
/feed.xml?vendor=Fortinet, or by score:/feed.xml?min_score=80
Use it from an AI agent
Vulnocalypse runs a read-only MCP server. Add it to any MCP client as a remote server:
https://vulnocalypse.com/mcpTools: get_feed, search_vulnerabilities, get_vulnerability, check_exposure (send the products you run and get back anything that affects them), get_panic and explain_panic_day. The JSON API is documented at /api/docs.