Sign in Get started free

loading

Every new threat · Live · InfraStack

Sign in Get started free

Live· 21 threats · Tuesday, Sep 15· last check 2026-11-04 10:35 UTC

Everything we’re watching.

Every new vulnerability, vendor incident and attack on AI tools, merged from every source as it lands. Early warnings before a CVE exists.

On fire Needs attention Early warnings Everything

Tuesday, Sep 15

Most severe in everything

EXPLOITED IN THE WILD

google android: In Cellular Modem, there is a possible permission bypass due to a logic error in the codeGoogle Pixel

Vikunja: Read-only project members can obtain any link share's access hash via the single-share read endpoint (v1 and v2) and escalate to the share's permission level in code.vikunja.io/apicode.vikunja.io/api

Vikunja: CalDAV and feeds BasicAuth endpoints have no rate limit, bypassing the anti-brute-force floor on account passwords in code.vikunja.io/apicode.vikunja.io/api

Vikunja: Every /api/v2 pre-auth endpoint is unthrottled on a stock install while its /api/v1 twin is rate limited in code.vikunja.io/apicode.vikunja.io/api

Tuesday, Sep 15

HIGH8.8EXPLOITEDgoogle android: In Cellular Modem, there is a possible permission bypass due to a logic error in the codeGoogle PixelVendor2026-09-15 19:17 UTCby CISA KEV–WHAT TO DO MEDIUMINCIDENTGitHub: Disruption with some GitHub servicesGitHubVendor2026-09-15 19:11 UTCby status page–WHAT TO DO MEDIUMINCIDENTnpm: Package Publish DegradationnpmVendor2026-09-15 17:20 UTCby status page–WHAT TO DO HIGH8.7Vikunja: Read-only project members can obtain any link share's access hash via the single-share read endpoint (v1 and v2) and escalate to the share's permission level in code.vikunja.io/apicode.vikunja.io/apiPackage2026-08-31 19:59 UTCby InfraStack Analyst–FIX 2.6.0 MEDIUM5.3Vikunja: Cross-tenant task-position rows can be injected into arbitrary project views via the unvalidated project_view_id in the task position endpoint (v1 and v2) in code.vikunja.io/apicode.vikunja.io/apiPackage2026-08-31 19:59 UTCby EPSS–WHAT TO DO MEDIUM5.3Vikunja: API token scopes bypassed via task expand parameter (comments, reactions, time entry counts) in code.vikunja.io/apicode.vikunja.io/apiPackage2026-08-31 19:59 UTCby EPSS–WHAT TO DO MEDIUM5.3Vikunja: TOTP secret is readable after enrollment, no step-up auth in code.vikunja.io/apicode.vikunja.io/apiPackage2026-08-31 19:59 UTCby EPSS–WHAT TO DO MEDIUM5.3Vikunja: Link-share token can enumerate users through the v2 API in code.vikunja.io/apicode.vikunja.io/apiPackage2026-08-31 19:59 UTCby EPSS–WHAT TO DO MEDIUM5.3Vikunja: Any user can enumerate every team and its members by attaching arbitrary teams to a throwaway project in code.vikunja.io/apicode.vikunja.io/apiPackage2026-08-31 19:59 UTCby EPSS–WHAT TO DO HIGH7.1Vikunja: Denial of service via decompression bomb in the data import in code.vikunja.io/apicode.vikunja.io/apiPackage2026-08-31 19:59 UTCby EPSS–WHAT TO DO HIGH8.7Vikunja: CalDAV and feeds BasicAuth endpoints have no rate limit, bypassing the anti-brute-force floor on account passwords in code.vikunja.io/apicode.vikunja.io/apiPackage2026-08-31 19:59 UTCby EPSS–WHAT TO DO HIGH8.7Vikunja: Every /api/v2 pre-auth endpoint is unthrottled on a stock install while its /api/v1 twin is rate limited in code.vikunja.io/apicode.vikunja.io/apiPackage2026-08-31 19:59 UTCby InfraStack Analyst–FIX 2.6.0 HIGH7.1Vikunja: Unbounded image decode on avatar and project-background uploads enables decode/resize amplification in code.vikunja.io/apicode.vikunja.io/apiPackage2026-08-31 19:59 UTCby EPSS–WHAT TO DO HIGH7.1Vikunja: Planka migration retains an unbounded aggregate of attacker-served attachments and can OOM the API in code.vikunja.io/apicode.vikunja.io/apiPackage2026-08-31 19:59 UTCby EPSS–WHAT TO DO HIGH7.1Vikunja: Unbounded CSV row cardinality permits API process termination in code.vikunja.io/apicode.vikunja.io/apiPackage2026-08-31 19:52 UTCby InfraStack Analyst–FIX 2.6.0 HIGH7.1Vikunja: Unbounded nested task-filter recursion permits API process termination in code.vikunja.io/apicode.vikunja.io/apiPackage2026-08-31 19:51 UTCby EPSS–WHAT TO DO MEDIUMINCIDENTnpm: Publishing Packages Degraded PerformancenpmVendor2026-09-15 16:13 UTCby status page–WHAT TO DO MEDIUMINCIDENTCircleCI: Customers may experience delays in UI updatesCircleCIVendor2026-09-15 14:42 UTCby status page–WHAT TO DO HIGHINCIDENTAnthropic: Intermittent error spikes for Claude Mythos 5.1 and Claude Fable 5.1AnthropicVendor2026-09-15 09:48 UTCby status page–WHAT TO DO MEDIUMINCIDENTGitHub: Disruption with some GitHub servicesGitHubVendor2026-09-15 09:47 UTCby status page–WHAT TO DO MEDIUMINCIDENTFly.io: Depot builder failuresFly.ioVendor2026-09-15 05:07 UTCby status page–WHAT TO DO

Monday, Sep 14Tuesday, Sep 15Wednesday, Sep 16