Live· 11 threats · Friday, Oct 2· last check 2026-11-04 08:57 UTC

Everything we’re watching.

Every new vulnerability, vendor incident and attack on AI tools, merged from every source as it lands. Early warnings before a CVE exists.

Friday, Oct 2

Most severe in everything

CRITICAL10.0

Loom for AWS: missing auth lets any network client take admin control

CRITICAL9.3

Amazon SageMaker Distribution: command injection in Space startup script

MALICIOUSDO NOT INSTALL

MALICIOUS · REMOVE IT

Malicious code in voxeval (PyPI)voxeval

MALICIOUSDO NOT INSTALL

MALICIOUS · REMOVE IT

Malicious code in dedh-devops-automation (PyPI)dedh-devops-automation

Friday, Oct 2

MALICIOUSDON'T INSTALLREMOVE ITMalicious code in voxeval (PyPI)voxevalPackage2026-10-02 21:28 UTCby osv-malicious–UNINSTALL CRITICAL9.3Amazon SageMaker Distribution: command injection in Space startup scriptInfrastructure2026-10-02 20:17 UTCby EPSS–WHAT TO DO HIGH8.3Loom for AWS: authenticated users can reach internal addresses via tool server connectionsAI agents & MCP2026-10-02 19:16 UTCby EPSS–WHAT TO DO HIGH8.2Loom for AWS: OAuth2 discovery flaw leaks client secrets and tokens to third partiesAI agents & MCP2026-10-02 19:15 UTCby EPSS–WHAT TO DO CRITICAL10.0Loom for AWS: missing auth lets any network client take admin controlAI agents & MCP2026-10-02 19:12 UTCby EPSS–WHAT TO DO MEDIUM6.3Next.js: cache poisoning flaw can serve attacker content to other usersvercel next.jsRuntime2026-09-30 16:14 UTCby EPSS–FIX 15.5.27 MEDIUM5.9PostCSS: Quadratic complexity in flat selector parsing allows CPU exhaustionpostcss-selector-parserPackage2026-09-03 08:57 UTCby EPSS–FIX 7.1.6 MALICIOUSDON'T INSTALLREMOVE ITMalicious code in dedh-devops-automation (PyPI)dedh-devops-automationPackage2026-10-02 14:10 UTCby osv-malicious–UNINSTALL LOWINCIDENTDatadog: Delayed RUM sessionsDatadogVendor2026-10-02 12:46 UTCby status page–WHAT TO DO HIGHINCIDENTPyPI: PyPI Backends Partial AvailabilityPyPIVendor2026-10-02 01:15 UTCby status page–WHAT TO DO MEDIUMINCIDENTMongoDB Atlas: MongoDB Charts: Infinite login loop when creating new Charts projectsMongoDB AtlasVendor2026-10-02 00:01 UTCby status page–WHAT TO DO