Skip to content
Fencer Intel

live: new CVEs every 10 minutes, KEV hourly

Every vulnerability. One feed.

The CVE List, GitHub advisories, OSV, NVD, ENISA EUVD and distro advisories merged into one entry per vulnerability, flagged with what attackers actually use: CISA KEV, EPSS and public exploits.

Open the critical feed Check a lockfile

2,027 new in the last 24 hours, 20 critical in 7 days, 40 added to CISA KEV in 30 days.

vulnerabilities published per utc day, by severity 9 weeks
kev 76 critical 2,935 high 12,879 medium 12,378 low 1,525 unscored 2,363 Sep 10: 54 critical, 187 high, 126 medium, 5 low, 0 unscored; 2 added to CISA KEV Sep 11: 101 critical, 340 high, 184 medium, 14 low, 152 unscored; 4 added to CISA KEV Sep 12: 15 critical, 26 high, 43 medium, 6 low, 1 unscored Sep 13: 6 critical, 51 high, 68 medium, 27 low, 1 unscored Sep 14: 53 critical, 214 high, 357 medium, 66 low, 1 unscored; 1 added to CISA KEV Sep 15: 176 critical, 758 high, 285 medium, 35 low, 0 unscored Sep 16: 105 critical, 387 high, 240 medium, 27 low, 126 unscored; 3 added to CISA KEV Sep 17: 62 critical, 291 high, 112 medium, 24 low, 434 unscored Sep 18: 43 critical, 189 high, 220 medium, 33 low, 0 unscored; 3 added to CISA KEV Sep 19: 7 critical, 28 high, 64 medium, 6 low, 0 unscored Sep 20: 14 critical, 35 high, 53 medium, 15 low, 2 unscored Sep 21: 17 critical, 87 high, 99 medium, 14 low, 3 unscored; 1 added to CISA KEV Sep 22: 84 critical, 168 high, 188 medium, 12 low, 4 unscored; 4 added to CISA KEV Sep 23: 38 critical, 210 high, 238 medium, 37 low, 2 unscored Sep 24: 33 critical, 178 high, 129 medium, 16 low, 174 unscored; 2 added to CISA KEV Sep 25: 23 critical, 162 high, 189 medium, 11 low, 231 unscored; 3 added to CISA KEV Sep 26: 8 critical, 24 high, 28 medium, 5 low, 1 unscored Sep 27: 10 critical, 33 high, 74 medium, 25 low, 1 unscored; 2 added to CISA KEV Sep 28: 38 critical, 119 high, 196 medium, 20 low, 1 unscored Sep 29: 97 critical, 243 high, 254 medium, 41 low, 1 unscored; 1 added to CISA KEV Sep 30: 64 critical, 328 high, 268 medium, 27 low, 0 unscored; 1 added to CISA KEV Oct 1: 44 critical, 138 high, 149 medium, 20 low, 1 unscored; 1 added to CISA KEV Oct 2: 43 critical, 179 high, 167 medium, 13 low, 1 unscored; 2 added to CISA KEV Oct 3: 5 critical, 51 high, 71 medium, 7 low, 0 unscored Oct 4: 6 critical, 26 high, 23 medium, 7 low, 0 unscored; 1 added to CISA KEV Oct 5: 23 critical, 146 high, 188 medium, 22 low, 1 unscored Oct 6: 89 critical, 365 high, 360 medium, 33 low, 156 unscored Oct 7: 55 critical, 124 high, 180 medium, 12 low, 2 unscored Oct 8: 53 critical, 170 high, 229 medium, 25 low, 0 unscored; 5 added to CISA KEV Oct 9: 32 critical, 158 high, 130 medium, 16 low, 6 unscored Oct 10: 76 critical, 143 high, 197 medium, 29 low, 1 unscored Oct 11: 17 critical, 68 high, 153 medium, 16 low, 0 unscored Oct 12: 40 critical, 178 high, 239 medium, 25 low, 0 unscored Oct 13: 152 critical, 1335 high, 700 medium, 27 low, 1 unscored; 2 added to CISA KEV Oct 14: 59 critical, 258 high, 297 medium, 40 low, 43 unscored; 4 added to CISA KEV Oct 15: 41 critical, 199 high, 263 medium, 14 low, 0 unscored; 1 added to CISA KEV Oct 16: 39 critical, 137 high, 219 medium, 25 low, 20 unscored; 2 added to CISA KEV Oct 17: 8 critical, 54 high, 62 medium, 14 low, 0 unscored Oct 18: 9 critical, 61 high, 78 medium, 11 low, 400 unscored Oct 19: 23 critical, 125 high, 264 medium, 38 low, 0 unscored Oct 20: 171 critical, 804 high, 782 medium, 107 low, 0 unscored; 6 added to CISA KEV Oct 21: 54 critical, 199 high, 203 medium, 25 low, 1 unscored Oct 22: 63 critical, 150 high, 187 medium, 29 low, 3 unscored Oct 23: 34 critical, 138 high, 66 medium, 16 low, 170 unscored; 2 added to CISA KEV Oct 24: 11 critical, 27 high, 40 medium, 4 low, 2 unscored Oct 25: 2 critical, 19 high, 36 medium, 10 low, 0 unscored Oct 26: 38 critical, 257 high, 384 medium, 57 low, 13 unscored; 2 added to CISA KEV Oct 27: 89 critical, 283 high, 186 medium, 27 low, 1 unscored; 2 added to CISA KEV Oct 28: 39 critical, 217 high, 243 medium, 40 low, 89 unscored; 2 added to CISA KEV Oct 29: 84 critical, 181 high, 222 medium, 20 low, 2 unscored; 2 added to CISA KEV Oct 30: 35 critical, 170 high, 221 medium, 17 low, 2 unscored; 2 added to CISA KEV Oct 31: 13 critical, 49 high, 62 medium, 17 low, 0 unscored Nov 1: 26 critical, 28 high, 60 medium, 11 low, 0 unscored Nov 2: 35 critical, 201 high, 204 medium, 18 low, 18 unscored Nov 3: 69 critical, 269 high, 342 medium, 37 low, 17 unscored; 1 added to CISA KEV Nov 4: 35 critical, 142 high, 154 medium, 36 low, 23 unscored; 1 added to CISA KEV Nov 5: 35 critical, 119 high, 124 medium, 13 low, 7 unscored Nov 6: 35 critical, 124 high, 193 medium, 39 low, 14 unscored; 1 added to CISA KEV Nov 7: 69 critical, 159 high, 230 medium, 10 low, 12 unscored Nov 8: 10 critical, 27 high, 94 medium, 16 low, 0 unscored Nov 9: 25 critical, 160 high, 222 medium, 60 low, 16 unscored; 4 added to CISA KEV Nov 10: 88 critical, 1116 high, 597 medium, 36 low, 193 unscored; 6 added to CISA KEV Nov 11: 13 critical, 67 high, 142 medium, 20 low, 13 unscored Sep 16 Sep 30 Oct 14 Oct 28 today
Vulnerabilities published per UTC day for the last 63 days by severity, 32,080 in all, and 76 added to CISA KEV.

Just added to CISA KEV

CISA confirms these are being exploited in the wild. Federal agencies get a deadline to patch; you should treat them the same way.

all known exploited
  1. 7.5
     CVE-2026-20320 A vulnerability in the Open Client Interface (OCI) XML Parser of Cisco BroadWorks could allow an unauthenticated, remote attacker to read s…
  2. 8.8
     CVE-2026-125350 Use after free in XML in Google Chrome prior to 157.0.8103.50 allowed a remote attacker to execute arbitrary code inside the sandbox via a…
  3. 6.5
     CVE-2026-124194 Microsoft Outlook Spoofing Vulnerability
  4. 9.3
     CVE-2026-116606 Authentication Bypass Allows Global Configuration Restore in Barracuda Email Security Gateway
  5. 4.3
     CVE-2026-111793 Openwave Webtop Media Transcoder does not enforce administrator-defined file type restrictions to restrict the file-types to be converted.
  6. 8.6
     CVE-2026-111560 OS Command Injection in Barracuda Appliances

Plug it into anything

The same entries as a feed, a JSON API, an MCP server and a lockfile check. No account and no API key.

~ fencer-intel
$ curl -s "https://intel.fencer.dev/feed?filter=critical" 
<rss version="2.0">
  <channel><title>Fencer Intel — Critical</title>
    <item>
      <title>CVE-2026-20320: A vulnerability in the Open Client Interface ...</title>
      <link>https://intel.fencer.dev/CVE-2026-20320</link>
$ curl -s https://intel.fencer.dev/api/v1/entries/CVE-2026-20320 
{
  "id": "CVE-2026-20320",
  "title": "A vulnerability in the Open Client Interface (OCI) XML Pa...",
  "severity": "high",
  "cvss": {
    "score": 7.5,
    "version": "3.1"
  },
  "kev": {
    "added": "2026-11-10"
  },
  "epss": {
    "score": 0.0039
  },
  "exploits": []
}
$ claude mcp add --transport http fencer-intel https://intel.fencer.dev/mcp 
# tools: search, get_vulnerability, list_feed, check_stack
# your agent checks a package before it installs it
$ curl -s -F lockfile=@package-lock.json https://intel.fencer.dev/api/v1/stack 
# every advisory for the versions you pin, exploited first
# the report has its own feed for new matches

All · swift

Newest first, late arrivals on top. Also a feed.

  1. 7.5
    CVE-2026-61695 Wire Swift runtime: negative LENGTH_DELIMITED length in skipGroup() crashes any protobuf-decoding service
    swift
  2. 9.3
    CVE-2026-103922 Capacitor Android and iOS: remote content can be loaded at the app origin via the internal HTTP proxy path
    npmswiftmaven
  3. 5.3
    CVE-2026-64785 swift-nio-http2: Missing CR/LF/NUL validation in header values
    swift
  4. 5.3
    CVE-2026-28898 SwiftNIO HTTP/2: HTTP/2-to-HTTP/1 Request Smuggling via unvalidated :path pseudo-header in HTTP2ToHTTP1Codec
    swift
  5. —
    CVE-2026-28975 NIOExtras: NIOHTTPRequestDecompressor ratio limit bypass via inflated Content-Length
    swift
  6. —
    CVE-2026-28980 SwiftNIO NIOHTTP1: HTTPDecoder accepts unbounded HTTP/1 header blocks, enabling remote DoS
    swift
  7. —
    CVE-2026-43671 SwiftNIO: Out-of-bounds write via ByteBuffer index and length UInt32 overflow
    swift
  8. —
    CVE-2026-28970 SwiftNIO: CRLF Injection in outbound HTTP request URI via NIOHTTPRequestHeadersValidator
    swift
  9. 4.2
    CVE-2026-47122 Sparkle's AppInstaller post-stage-1 XPC listener accepts unvalidated connections, allowing spoofed appcast item data injection
    swift
  10. 6.1
    CVE-2026-47121 Sparkle: Binary delta apply intermediate-symlink traversal in malicious .delta
    swift
  11. —
    GHSA-39g5-644c-qwcg container: pf Rule Injection via Domain Name Argument in `container system dns create --localhost` Command
    swift
  12. 7.5
    CVE-2026-28815 Swift Crypto: X-Wing HPKE Decapsulation Accepts Malformed Ciphertext Length
    swift
  13. 5.7
    CVE-2026-30867 CocoaMQTT: Denial of Service via Reachable Assertion in `PUBLISH` Packet Parsing
    swift
  14. 6.1
    CVE-2026-28499 LeafKit's HTML escaping may be skipped for Collection values, enabling XSS
    swift
  15. 6.1
    CVE-2026-27120 Leaf-kit html escaping does not work on characters that are part of extended grapheme cluster
    swift
  16. 7.8
    CVE-2026-20613 Container and Containerization archive extraction does not guard against escapes from extraction base directory.
    swift
  17. 5.3
    CVE-2026-23886 Swift W3C TraceContext has malformed HTTP header that can cause a crash
    swift
  18. —
    GHSA-88q6-jcjg-hvmw jose-swift has JWT Signature Verification Bypass via None Algorithm
    swift
  19. 3.7
    GHSA-pc9j-5v36-2mww AWS SDK for Swift adopted defense in depth enhancement for region parameter value
    swift
  20. —
    GHSA-xvr7-p2c6-j83w swift-nio-http2 affected by HTTP/2 MadeYouReset vulnerability
    swift
  21. 9.8
    CVE-2025-54951 ExecuTorch vulnerable to Heap-based Buffer Overflow
    pypimavenswift
  22. 9.8
    CVE-2025-54950 ExecuTorch out-of-bounds access vulnerability
    pypimavenswift
  23. 9.8
    CVE-2025-54949 ExecuTorch heap buffer overflow vulnerability
    pypimavenswift
  24. 9.8
    CVE-2025-30405 ExecuTorch integer overflow vulnerability
    pypimavenswift
  25. 9.8
    CVE-2025-30404 ExecuTorch integer overflow vulnerability
    pypimavenswift
  26. 8.1
    CVE-2025-30402 ExecuTorch vulnerable to Heap-based Buffer Overflow attack
    pypimavenswift
  27. 7.3
    CVE-2025-0509 Signing Checks Bypass
    swiftbitnami
  28. 7.5
    CVE-2025-0343 CVE-2025-0343: Swift ASN.1 can crash when parsing maliciously formed BER/DER
    swift
  29. 8.4
    CVE-2024-27529 wasm3 uncontrolled memory allocation vulnerability
    swiftpypicrates.io
  30. 5.9
    CVE-2024-28867 Swift Prometheus un-sanitized metric name or labels can be used to take over exported metrics
    swift