Live· 12 threats · Monday, Aug 17· last check 2026-11-04 13:01 UTC

Everything we’re watching.

Every new vulnerability, vendor incident and attack on AI tools, merged from every source as it lands. Early warnings before a CVE exists.

Monday, Aug 17

Most severe in everything

CRITICAL9.3

EXPLOITED IN THE WILD

lfprojects mlflow: MLflow is an open source AI engineering platform for agents, large language models, and machine learning modelsMLflow MLflow1 talking

CRITICALNO CVE YET

GitHub: Incident with GitHub.comGitHub

HIGH8.8

WordPress: malicious PostScript upload by an Author gives remote code executionwordpress

HIGH8.2

SiYuan: Cross-Site WebSocket Hijacking on the admin-only network proxy endpoint (`/ws/network/proxy`) via explicit `CheckOrigin: true` bypass in github.com/siyuan-note/siyuan/kernelgithub.com/siyuan-note/siyuan/kernel

Monday, Aug 17

HIGH5.0A logic issue was addressed with improved checksapple ipadosVendor2026-08-17 22:17 UTCby EPSS–FIX 26.6.1 CRITICAL9.3EXPLOITEDlfprojects mlflow: MLflow is an open source AI engineering platform for agents, large language models, and machine learning modelsMLflow MLflow1 talkingAI agents & MCP2026-08-02 08:12 UTCby InfraStack Analyst1talkingFIX 3.15.0 MEDIUM5.5An information leakage was addressed with additional validationapple ipadosVendor2026-08-17 22:17 UTCby EPSS–FIX 18.7.10 MEDIUMINCIDENTCircleCI: Insight data is currently delayedCircleCIVendor2026-08-17 21:06 UTCby status page–WHAT TO DO HIGH7.1ApostropheCMS: 2nd-order prototype pollution via PATCH leading to single-request persistent DoSapostrophePackage2026-08-17 20:16 UTCby EPSS–FIX 4.32.1 MEDIUM6.5ApostropheCMS: Arbitrary file read via import-export attachment-name path traversal@apostrophecms/import-exportPackage2026-08-12 17:39 UTCby EPSS–FIX 3.6.2 HIGH8.8WordPress: malicious PostScript upload by an Author gives remote code executionwordpressOther2026-08-12 14:44 UTCby InfraStack Analyst–FIX 7.0.4 MEDIUMINCIDENTVercel: Partial disruption of Observability, Analytics, Firewall, Usage, and Login in DashboardVercelVendor2026-08-17 14:30 UTCby status page–WHAT TO DO HIGHINCIDENTCircleCI: GitHub Incidents impacting CircleCI functionalityCircleCIVendor2026-08-17 14:04 UTCby status page–WHAT TO DO MEDIUMINCIDENTAnthropic: Degraded performance for Claude Opus 5, Claude Sonnet 5AnthropicVendor2026-08-17 13:56 UTCby status page–WHAT TO DO CRITICALINCIDENTGitHub: Incident with GitHub.comGitHubVendor2026-08-17 13:40 UTCby status page–WHAT TO DO HIGH8.2SiYuan: Cross-Site WebSocket Hijacking on the admin-only network proxy endpoint (`/ws/network/proxy`) via explicit `CheckOrigin: true` bypass in github.com/siyuan-note/siyuan/kernelgithub.com/siyuan-note/siyuan/kernelPackage2026-08-17 11:16 UTCby EPSS–FIX 0.0.0-20260803045322-cb67e0b4fab5