Sign in Get started free

loading

Every new threat · Live · InfraStack

Sign in Get started free

Live· 23 threats · Monday, Sep 21· last check 2026-11-04 10:05 UTC

Everything we’re watching.

Every new vulnerability, vendor incident and attack on AI tools, merged from every source as it lands. Early warnings before a CVE exists.

On fire Needs attention Early warnings Everything

Monday, Sep 21

Most severe in everything

MALICIOUSDO NOT INSTALL

MALICIOUS · REMOVE IT

Malicious code in pullgetsage (PyPI)pullgetsage

MALICIOUSDO NOT INSTALL

MALICIOUS · REMOVE IT

Malicious code in gemini-computer-use (npm)gemini-computer-use

MALICIOUSDO NOT INSTALL

MALICIOUS · REMOVE IT

Malicious code in starlette-healthchecks (PyPI)starlette-healthchecks

MALICIOUSDO NOT INSTALL

MALICIOUS · REMOVE IT

Malicious code in rrs (PyPI)rrs

Monday, Sep 21

HIGH8.7vllm p2p never connected zmq_exhaustionvllmAI agents & MCP2026-09-21 22:17 UTCby EPSS–FIX 0.32.0 MALICIOUSDON'T INSTALLREMOVE ITMalicious code in pullgetsage (PyPI)pullgetsagePackage2026-09-21 19:43 UTCby osv-malicious–UNINSTALL HIGH8.1KubeEdge: keadm DecompressTarGz path traversal enables arbitrary file write on Windows during edge node join in github.com/kubeedge/kubeedgegithub.com/kubeedge/kubeedgePackage2026-07-15 14:22 UTCby EPSS–FIX 1.21.2 HIGH8.8KubeEdge: ConfigUpdateJob updateFields enables remote shell injection and code execution on edge nodes in github.com/kubeedge/kubeedgegithub.com/kubeedge/kubeedgePackage2026-07-15 14:21 UTCby EPSS–FIX 1.21.2 MALICIOUSDON'T INSTALLREMOVE ITMalicious code in gemini-computer-use (npm)gemini-computer-usePackage2026-09-21 17:21 UTCby osv-malicious–UNINSTALL MEDIUM6.9Tinyauth: User enumeration attack by timing oracle in github.com/tinyauthapp/tinyauthgithub.com/tinyauthapp/tinyauthPackage2026-07-15 13:59 UTCby EPSS–FIX 1.0.1-0.20260714134959-c22925c2fba9 MEDIUM5.3Tinyauth: Unauthenticated login attempts can trigger global login lockdown denial of service in github.com/tinyauthapp/tinyauthgithub.com/tinyauthapp/tinyauthPackage2026-07-15 14:01 UTCby EPSS–FIX 1.0.1-0.20260715123057-dade1e2c8f27 HIGH8.1Tinyauth: forward-auth per-app ACL is matched case-sensitively against the (case-insensitive) hostname, letting an authenticated user reach apps they are not on the allowlist for in github.com/tinyauthapp/tinyauthgithub.com/tinyauthapp/tinyauthPackage2026-07-15 13:59 UTCby EPSS–FIX 1.0.1-0.20260720133915-80bc87188ec3 MEDIUM5.8Fabio - Incomplete fix for CVE-2025-48865: operator-configured trust headers (clientip/tls/requestid) still strippable via the Connection header in github.com/fabiolb/fabiogithub.com/fabiolb/fabioPackage2026-07-03 00:17 UTCby EPSS–FIX 1.7.2 MEDIUM6.2Dasel: Selector lexer panics on trailing whitespace in `parseCurRune` in github.com/tomwright/daselgithub.com/tomwright/daselPackage2026-06-27 15:05 UTCby EPSS–WHAT TO DO HIGH8.8KubeEdge: Command Injection in NodeUpgradeJob - RCE on edge nodes via v1alpha2 API in github.com/kubeedge/kubeedgegithub.com/kubeedge/kubeedgePackage2026-07-15 14:21 UTCby EPSS–FIX 1.21.2 MEDIUM6.5KubeEdge: Unbounded allocation in viaduct packer enables authenticated remote DoS against CloudHub in github.com/kubeedge/kubeedgegithub.com/kubeedge/kubeedgePackage2026-07-15 14:23 UTCby EPSS–FIX 1.21.2 MEDIUM6.2Dasel: Unbounded recursion in JSON and XML readers causes unrecoverable stack-overflow DoS in github.com/tomwright/daselgithub.com/tomwright/daselPackage2026-06-27 15:00 UTCby EPSS–WHAT TO DO MALICIOUSDON'T INSTALLREMOVE ITMalicious code in starlette-healthchecks (PyPI)starlette-healthchecksPackage2026-09-21 16:50 UTCby osv-malicious–UNINSTALL MEDIUMINCIDENTCircleCI: Delays starting Linux Machine jobsCircleCIVendor2026-09-21 16:22 UTCby status page–WHAT TO DO MEDIUM4.3Hatchet DurableTask WorkerStatus gRPC resolves caller-supplied durable-task UUIDs via ListSatisfiedEntries with no tenant_id filter in github.com/hatchet-dev/hatchetgithub.com/hatchet-dev/hatchetPackage2026-09-04 18:27 UTCby EPSS–FIX 0.106.1 LOW3.1Hatchet: Cross-tenant durable callback payload disclosure in Hatchet V1 Dispatcher in github.com/hatchet-dev/hatchetgithub.com/hatchet-dev/hatchetPackage2026-09-04 13:08 UTCby EPSS–FIX 0.95.3 MEDIUM6.3Hatchet: Cross-Tenant Durable Task Event Log Disclosure via Missing Authorization Check in github.com/hatchet-dev/hatchetgithub.com/hatchet-dev/hatchetRuntime2026-06-30 17:55 UTCby EPSS–FIX 0.91.1 HIGH7.1Unauthenticated OAuth state CSRF via empty-state collision in ValidateOAuthState in github.com/hatchet-dev/hatchetgithub.com/hatchet-dev/hatchetRuntime2026-06-30 17:54 UTCby EPSS–FIX 0.91.2 MEDIUM4.1SSRF via Unsigned UnsubscribeURL in SNS UnsubscribeConfirmation Handler in github.com/hatchet-dev/hatchetgithub.com/hatchet-dev/hatchetPackage2026-06-30 17:54 UTCby EPSS–FIX 0.91.2 HIGH7.5OpenBao's Templated Policies Allow Privilege Escalation via Wildcard Characters in github.com/openbao/openbaogithub.com/openbao/openbaoPackage2026-07-14 17:36 UTCby EPSS–FIX 0.0.0-20260710001938-2d4ebafec5c5 MEDIUMINCIDENTDatadog: Delayed Monitors NotificationsDatadogVendor2026-09-21 09:44 UTCby status page–WHAT TO DO MALICIOUSDON'T INSTALLREMOVE ITMalicious code in rrs (PyPI)rrsPackage2026-09-21 03:46 UTCby osv-malicious–UNINSTALL

Sunday, Sep 20Monday, Sep 21Tuesday, Sep 22