Sign in Get started free

loading

Every new threat · Live · InfraStack

Sign in Get started free

Live· 28 threats · Wednesday, Sep 23· last check 2026-11-04 09:52 UTC

Everything we’re watching.

Every new vulnerability, vendor incident and attack on AI tools, merged from every source as it lands. Early warnings before a CVE exists.

On fire Needs attention Early warnings Everything

Wednesday, Sep 23

Most severe in everything

EXPLOITED IN THE WILD

Plex Media Server before 1.43.3.10861 allows an admin user to write arbitrary files that may be executed on loadPlex Media Server1 talking

EXPLOITED IN THE WILD

Plex Media Server before 1.43.3.10861 does not correctly neutralize URL values included in 'searchOne,' allowing an…Plex Media Server

EXPLOITED IN THE WILD

Plex Media Server before 1.43.3.10861 allows SSRF via '/player/timeline'Plex Media Server

Moquette: Pattern-ACL wildcard injection (cross-tenant authorization bypass) plus a remote-unauthenticated DoS cluster, a Will-message authorization bypass, and a cross-session durable-corruption bugio.moquette:moquette-broker

Wednesday, Sep 23

MEDIUMINCIDENTRender: Key Value service restartsRenderVendor2026-09-23 23:30 UTCby status page–WHAT TO DO LOWINCIDENTSupabase: Supabase CLI CI workflow failuresSupabaseVendor2026-09-23 21:58 UTCby status page–WHAT TO DO HIGH7.8Librsvg: Use-after-free when XML includes have duplicated entitieslibrsvgPackage2026-09-23 20:17 UTCby GitHub Advisories–FIX 2.57.5 HIGH7.5Klever-Go: Unauthenticated WebSocket /subscribe: no read-size limit, no connection cap, permissive origin -> remote node memory/goroutine exhaustion (DoS) in github.com/klever-io/klever-gogithub.com/klever-io/klever-goPackage2026-07-20 06:16 UTCby EPSS–FIX 1.7.20 HIGH8.6Klever-Go: /log controls global node logging in github.com/klever-io/klever-gogithub.com/klever-io/klever-goPackage2026-07-20 06:14 UTCby EPSS–FIX 1.7.20 HIGH8.4Klever-Go: Elasticsearch bulk / painless injection via on-chain account name -> explorer/indexer data forgery in github.com/klever-io/klever-gogithub.com/klever-io/klever-goPackage2026-07-20 07:08 UTCby EPSS–FIX 1.7.20 HIGH7.0Klever-Go: Validator registration accepts an unvalidated BLS public key → consensus liveness DoS in github.com/klever-io/klever-gogithub.com/klever-io/klever-goPackage2026-07-20 07:09 UTCby EPSS–FIX 1.7.20 HIGH7.1Klever-Go: Zombie-order theft: `Buy` missing `IsClaimed` guard in native marketplace in github.com/klever-io/klever-gogithub.com/klever-io/klever-goPackage2026-07-20 06:18 UTCby EPSS–FIX 1.7.20 HIGH8.7Klever-Go Account takeover: `kleverUpdateAccountPermission` authorizes on attacker-controlled `RecipientAddr` instead of the authenticated caller in github.com/klever-io/klever-gogithub.com/klever-io/klever-goPackage2026-07-20 07:07 UTCby EPSS–FIX 1.7.20 LOW2.4OpenBao Agent Writes Secrets to Stdout in github.com/openbao/openbaogithub.com/openbao/openbaoPackage2026-07-14 17:30 UTCby EPSS–FIX 0.0.0-20260714163218-90272575e5f5 CRITICAL9.2OpenBao's Recovery Mode Vulnerable To Token Leakage via Timing Attack in github.com/openbao/openbaogithub.com/openbao/openbaoPackage2026-07-14 17:38 UTCby EPSS–FIX 0.0.0-20260713141742-763625a20721 MEDIUM6.0OpenBao Skips Stricter Deny Policy for LIST operations in github.com/openbao/openbaogithub.com/openbao/openbaoPackage2026-07-14 17:38 UTCby EPSS–FIX 0.0.0-20260713133043-f58d848c139e HIGHINCIDENTFly.io: Partial Sprites outageFly.ioVendor2026-09-23 19:12 UTCby status page–WHAT TO DO LOWINCIDENTCircleCI: Delays in processing new signups and plan changesCircleCIVendor2026-09-23 18:13 UTCby status page–WHAT TO DO CRITICALINCIDENTHashiCorp: HCP Terraform Returning 404sHashiCorpVendor2026-09-23 17:43 UTCby status page–WHAT TO DO HIGH8.6EXPLOITEDPlex2ShellPlex Media Server before 1.43.3.10861 allows an admin user to write arbitrary files that may be executed on loadPlex Media Server1 talkingVendor2026-09-23 17:17 UTCby InfraStack Analyst1talkingFIX 1.43.3.10861 HIGH5.3EXPLOITEDPlex2ShellPlex Media Server before 1.43.3.10861 allows an authenticated user to request arbitrary internal or external…Plex Media Server1 talkingRuntime2026-09-23 17:17 UTCby InfraStack Analyst1talkingFIX 1.43.3.10861 HIGH6.9EXPLOITEDPlex Media Server before 1.43.3.10861 does not correctly neutralize URL values included in 'searchOne,' allowing an…Plex Media ServerVendor2026-09-23 17:17 UTCby InfraStack Analyst–FIX 1.43.3.10861 HIGH5.3EXPLOITEDPlex Media Server before 1.43.3.10861 allows SSRF via '/player/timeline'Plex Media ServerRuntime2026-09-23 17:17 UTCby InfraStack Analyst–FIX 1.43.3.10861 CRITICAL9.6Moquette: Pattern-ACL wildcard injection (cross-tenant authorization bypass) plus a remote-unauthenticated DoS cluster, a Will-message authorization bypass, and a cross-session durable-corruption bugio.moquette:moquette-brokerPackage2026-08-01 13:38 UTCby GitHub Advisories–FIX 0.18.1 HIGHINCIDENTFly.io: Elevated private networking errorsFly.ioVendor2026-09-23 15:13 UTCby status page–WHAT TO DO HIGHINCIDENTFly.io: Upstash unavailability in FRA regionFly.ioVendor2026-09-23 13:07 UTCby status page–WHAT TO DO MEDIUMINCIDENTPyPI: Issues with search, logins and logged-in pagesPyPIVendor2026-09-23 11:02 UTCby status page–WHAT TO DO MEDIUMINCIDENTGitHub: Incident across several servicesGitHubVendor2026-09-23 10:11 UTCby status page–WHAT TO DO MEDIUMINCIDENTSupabase: Increased error rate in project creation and project restoreSupabaseVendor2026-09-23 10:09 UTCby status page–WHAT TO DO MEDIUMINCIDENTSupabase: Storage search failing for restored projectsSupabaseVendor2026-09-23 09:31 UTCby status page–WHAT TO DO HIGHINCIDENTFly.io: IPv6 Networking Issues in DFWFly.ioVendor2026-09-23 07:12 UTCby status page–WHAT TO DO MALICIOUSDON'T INSTALLREMOVE ITMalicious code in memoryos (PyPI)memoryosPackage2026-09-23by osv-malicious–UNINSTALL

Tuesday, Sep 22Wednesday, Sep 23Thursday, Sep 24