Sign in Get started free

loading

Every new threat · Live · InfraStack

Sign in Get started free

Live· 12 threats · Tuesday, Jul 21· last check 2026-11-04 15:43 UTC

Everything we’re watching.

Every new vulnerability, vendor incident and attack on AI tools, merged from every source as it lands. Early warnings before a CVE exists.

On fire Needs attention Early warnings Everything

Tuesday, Jul 21

Most severe in everything

websocket-driver-ruby: Denial of service via malformed Host headerwebsocket-driver

Next.js: Server Actions on custom servers enable SSRF via Host headersvercel next.js

Next.js: rewrites and redirects can be pointed at attacker-chosen hostsvercel next.js

Next.js: middleware and proxy checks can be bypassed on Turbopack single-locale appsvercel next.js

Tuesday, Jul 21

MEDIUM6.3Next.js: unbounded Server Action payload lets crafted requests exhaust memoryvercel next.jsPackage2026-07-21 18:42 UTCby EPSS–FIX 15.5.21 HIGH8.3Next.js: Server Actions on custom servers enable SSRF via Host headersvercel next.jsRuntime2026-07-21 18:42 UTCby EPSS–FIX 15.5.21 HIGH8.3Next.js: rewrites and redirects can be pointed at attacker-chosen hostsvercel next.jsRuntime2026-07-21 18:42 UTCby EPSS–FIX 15.5.21 HIGH8.2Next.js: crafted requests with Server Actions exhaust CPU, causing denial of servicevercel next.jsRuntime2026-07-21 18:42 UTCby EPSS–FIX 15.5.21 HIGH8.3Next.js: middleware and proxy checks can be bypassed on Turbopack single-locale appsvercel next.jsPackage2026-07-21 18:42 UTCby EPSS–FIX 16.2.11 MEDIUM6.3Next.js: unauthenticated disclosure of internal server function endpoint IDsvercel next.jsPackage2026-07-21 18:42 UTCby EPSS–FIX 15.5.21 MEDIUM6.3Next.js: image optimization of crafted SVGs exhausts CPU when remote images enabledvercel next.jsRuntime2026-07-21 18:42 UTCby EPSS–FIX 15.5.21 MEDIUM6.3Next.js: server fetch can return another request's cached response bodyvercel next.jsRuntime2026-07-21 18:42 UTCby EPSS–FIX 15.5.21 MEDIUM6.0Next.js: server fetch can return another request's cached response bodyvercel next.jsRuntime2026-07-21 18:42 UTCby EPSS–FIX 15.5.21 HIGH8.9websocket-driver-ruby: Denial of service via malformed Host headerwebsocket-driverPackage2026-06-23 11:37 UTCby EPSS–FIX 0.8.2 MEDIUMINCIDENTHashiCorp: Terraform Runs Failing to Fetch GitHub Sources Over SSHHashiCorpVendor2026-07-21 10:32 UTCby status page–WHAT TO DO MEDIUMINCIDENTSentry: Delayed ingestion on us regionSentryVendor2026-07-21 10:30 UTCby status page–WHAT TO DO

Monday, Jul 20Tuesday, Jul 21Wednesday, Jul 22