gcdRadar
What's being exploited right now, whether there's a patch, and what to do about it, with an AI lens.
gcdradar.vercel.app · free · no account · no cookies · no tracking
Security news is loud and spread across dozens of feeds. gcdRadar reads 45 of them, the advisories and the official databases (NVD, CISA KEV, GitHub Advisories, Have I Been Pwned) every 30 minutes and turns them into one calm page that answers three questions:
- Is anything I run being exploited? Pick your products once and the page shows only what touches them.
- Is there a fix, and by when? Every record carries a patch status and, when CISA has set one, the deadline.
- Is this week normal? Every number sits beside a typical week, so a spike looks like a spike and a quiet week looks quiet.
Every record is counted once, however many outlets cover it, and links back to the reporting it came from.
A day sheet, not a news feed
- My stack. One chip per product you care about, with its exploitation over the last 90 days and a coloured word only while something is exploited and still open. Your picks stay in your browser; a share link puts them in the URL so a teammate opens the same view.
- The runway. The nearest KEV due date (CISA's patch deadline) as a large countdown, beside one timeline of the two weeks around now: new incidents as dots, holes with no patch as bars that keep growing, deadlines as markers ahead.
- Needs action. Three short lists under it: what else has a KEV due date this week, exploited vulnerabilities with no full patch yet, and what's new this week with confirmed impact first. CVE ids, plain scores, plain times ("1 day left", "open 3 days").
- The week. Published, critical and exploited CVEs, breaches and AI incidents, each against a typical week, plus the next Patch Tuesday.
- Live board. Everything open right now in four lanes: patch now, breaches and attacks, supply chain, research.
Follow one product
Product watch pages gather everything that names one product or framework (Langflow, LiteLLM, Ollama, MCP servers and many more), with confirmed exploitation and CISA KEV listings at the top. Tags group records by technique, target and actor.
The AI lens
Every record says whether AI was involved and how: AI was the target (a model, agent or AI product was exploited, abused or leaked) or AI was the weapon (attackers used AI as a real part of the attack). Disclosed CVEs in AI software are tracked as their own series and never inflate the incident count.
Why trust the numbers
- Counted once. One event covered by fifteen outlets is one record with fifteen sources. Duplicates are merged by CVE id, link and title.
- Sourced. Every record links to its reporting; the source list names every feed and API it reads. Feeds and official APIs only, no article text stored: only titles, links, dates and our own two-sentence summaries.
- Open method. The methodology gives every counting rule and a dated changelog of every change to them.
- Open data. 2,300+ records back to 2016, published as JSON in
/data under CC BY-SA 4.0.
How it works
45 feeds + official APIs ──▶ collector (GitHub Actions, every 30 min) ──▶ /data/*.json ──▶ static Next.js site (Vercel)
fetch → pre-filter → dedupe → LLM classify → publish / review / reject → commit
- The collector (
/collector, TypeScript) classifies candidates with free-tier LLMs (Gemini first, Groq as fallback). Anything it cannot classify waits in a pending file: nothing is dropped and nothing is published unclassified.
- Data commits land on
main all day; the site rebuilds twice a day (06 and 18 UTC) and on every merge. The home page's live layer (the NVD count and the Cloudflare Radar globe) comes from a small Cloudflare Worker, so it stays current between builds.
- The site is static files with no server code, cookies, accounts or analytics. The security model describes what runs where and what protects it.
Tech: Next.js, TypeScript, Zod, Tailwind, GitHub Actions, Vercel, Cloudflare Workers. Classification by Gemini and Groq free tiers.
Development
npm install
npm run dev # http://localhost:3000
npm test # unit tests (dedupe, schema, stats, briefing)
npm run typecheck && npm run lint
npm run build # static export to ./out
Collector commands, the GitHub Actions secrets, the deploy windows and what happens if a free tier disappears are in docs/operations.md. Sources and audits: docs/sources.md, docs/audit-2026-10.md.
Part of the gcd family
gcdatlas (the real universe, drawn in ASCII) · gcdTracker (AI traffic and agent activity) · gcdSignal (a local-first AI news reader)
Licences
Code: all rights reserved, see LICENSE. Data: CC BY-SA 4.0, with upstream attributions listed there. If you reuse the counts, credit gcdRadar with a link and the date you accessed it.
