For coding agents

Sign in Get started free

loading

Every new threat · Live · InfraStack

Sign in Get started free

Live· 120 threats · Saturday, Oct 24· last check 2026-11-05 01:33 UTC

Everything we’re watching.

Every new vulnerability, vendor incident and attack on AI tools, merged from every source as it lands. Early warnings before a CVE exists.

On fire Needs attention Early warnings Everything

Saturday, Oct 24

Most severe in everything

MALWARENO CVE YET

EXPLOITED IN THE WILD

Magento stores injected with scanner-evading JavaScript loader via CMS blocks (deepveindrilling.com)Magento4 talking

Unitree Go2 robot: remote OS command injection via set_volume chat module2 talking

Postiz: user-supplied token claims let attackers forge sessions and resetspostiz-app

Newsletters Lite WordPress plugin: untrusted data object injection, up to 4.18.1

Check new threats with your coding agent

It checks this feed against your repository before you add a dependency, and whenever you ask about a CVE.

Saturday, Oct 24

HIGHNOT SCOREDCVE-2026-87912 and CVE-2026-87913: Missing S3 bucket ownership verification in the AWS Security Agent plugin for aws-agents-for-devsecops and MCP ServerAI agents & MCP2026-10-24 20:05 UTCby Vendor & lab pages–WHAT TO DO HIGHNOT SCOREDCVE-2026-87912 and CVE-2026-87913: Missing S3 bucket ownership verification in the AWS Security Agent plugin for aws-agents-for-devsecops and MCP ServerAI agents & MCP2026-10-24 20:05 UTCby Vendor & lab pages–WHAT TO DO HIGHNOT SCOREDCVE-2026-97662 - Argument injection in AWS security-agent-mcp-server diff scanAI agents & MCP2026-10-24 19:43 UTCby Vendor & lab pages–WHAT TO DO HIGHNOT SCOREDCVE-2026-103956, CVE-2026-103957, and CVE-2026-103958 - Issues in Loom for AWSAI agents & MCP2026-10-24 19:28 UTCby Vendor & lab pages–WHAT TO DO HIGHNOT SCOREDCVE-2026-103956, CVE-2026-103957, and CVE-2026-103958 - Issues in Loom for AWSAI agents & MCP2026-10-24 19:28 UTCby Vendor & lab pages–WHAT TO DO HIGHNOT SCOREDCVE-2026-103956, CVE-2026-103957, and CVE-2026-103958 - Issues in Loom for AWSAI agents & MCP2026-10-24 19:28 UTCby Vendor & lab pages–WHAT TO DO NOT SCOREDNOT SCOREDCVE-2026-107322 - OS command injection in Amazon Agent Plugins for AWS databases-on-awsAI agents & MCP2026-10-24 19:28 UTCby Vendor & lab pages–WHAT TO DO HIGHNOT SCOREDCVE-2026-105812 and CVE-2026-106032: Issue with Bedrock AgentCore Starter Toolkit - Import Agent Code Injection and SSRFAI agents & MCP2026-10-24 18:43 UTCby Vendor & lab pages–WHAT TO DO NOT SCOREDNOT SCOREDCVE-2026-85787 - An incomplete list of disallowed inputs in the SQL validation component in Amazon awslabs postgres-mcp-server to modify data beyond the read-only scopeAI agents & MCP2026-10-24 18:43 UTCby Vendor & lab pages–WHAT TO DO MEDIUM5.3Xiaozhi-esp32-server: authenticated users can read other users' device address booksAI agents & MCP2026-10-24 12:16 UTCby EPSS–WHAT TO DO MEDIUM5.0InternAgent: LoRA loading lets remote attackers pull untrusted model codeAI agents & MCP2026-10-24 07:16 UTCby EPSS–WHAT TO DO

Friday, Oct 23Saturday, Oct 24Sunday, Oct 25