Live· 12 threats · Monday, Sep 28· last check 2026-11-04 09:17 UTC

Everything we’re watching.

Every new vulnerability, vendor incident and attack on AI tools, merged from every source as it lands. Early warnings before a CVE exists.

Monday, Sep 28

Most severe in everything

HIGH8.8

EXPLOITED IN THE WILD

An out-of-bounds write issue was addressed with improved bounds checkingApple Multiple Products3 talking

CRITICAL9.8

Duplicate Advisory: Authlib: empty signatures validation in JWS JSON deserializationauthlib

CRITICAL9.8

PUBLIC EXPLOIT

Authlib: empty signatures validation in JWS JSON deserializationauthlib

MALICIOUSDO NOT INSTALL

MALICIOUS · REMOVE IT

Malicious code in items-validator (npm)items-validator

Monday, Sep 28

MALICIOUSDON'T INSTALLREMOVE ITMalicious code in items-validator (npm)items-validatorPackage2026-09-28 22:03 UTCby osv-malicious–UNINSTALL CRITICAL9.8Duplicate Advisory: Authlib: empty signatures validation in JWS JSON deserializationauthlibPackage2026-09-28 21:31 UTCby GitHub Advisories–WHAT TO DO MALICIOUSDON'T INSTALLREMOVE ITMalicious code in aseitylab (PyPI)aseitylabPackage2026-09-28 21:24 UTCby osv-malicious–UNINSTALL CRITICALINCIDENTGitHub: Copilot Code Review is unable to complete reviewsGitHubVendor2026-09-28 21:16 UTCby status page–WHAT TO DO CRITICAL9.8Authlib: empty signatures validation in JWS JSON deserializationauthlibPackage2026-09-28 20:17 UTCby EPSS–FIX 1.9.0 MEDIUMINCIDENTPlanetScale: Branch creation delays in GCP europe-west-1PlanetScaleVendor2026-09-28 18:59 UTCby status page–WHAT TO DO LOWINCIDENTSupabase: Log Ingestion DegradationSupabaseVendor2026-09-28 13:47 UTCby status page–WHAT TO DO MEDIUMINCIDENTVercel: Build failures and 500 errors for functions using Edge runtimeVercelVendor2026-09-28 13:44 UTCby status page–WHAT TO DO MEDIUMINCIDENTPyPI: Issues with search, logins and logged-in pagesPyPIVendor2026-09-28 12:42 UTCby status page–WHAT TO DO MALICIOUSDON'T INSTALLREMOVE ITMalicious code in godsplan (npm)godsplanPackage2026-09-28 10:09 UTCby osv-malicious–UNINSTALL MALICIOUSDON'T INSTALLREMOVE ITMalicious code in azure-langchain-example (PyPI)azure-langchain-examplePackage2026-09-28 07:34 UTCby osv-malicious–UNINSTALL HIGH8.8EXPLOITEDAn out-of-bounds write issue was addressed with improved bounds checkingApple Multiple Products3 talkingVendor2026-09-28by InfraStack Analyst3talkingFIX 26.7.1