Sign in Get started free

loading

Every new threat · Live · InfraStack

Sign in Get started free

Live· 36 threats · Wednesday, Oct 7· last check 2026-11-04 08:28 UTC

Everything we’re watching.

Every new vulnerability, vendor incident and attack on AI tools, merged from every source as it lands. Early warnings before a CVE exists.

On fire Needs attention Early warnings Everything

Wednesday, Oct 7

Most severe in everything

Duplicate Advisory: Remote code execution via unsafe deserialization in multiprocess mode transportlmcache

LMCache: Remote code execution via unsafe deserialization in multiprocess mode transportlmcache

Homer: Complete Authentication Bypass When coordinator.jwt.secret Is Empty (Default) in github.com/sipcapture/homer-appgithub.com/sipcapture/homer-app

Homer: Hardcoded Default Admin Password 'sipcapture' With No Forced Change on First Login in github.com/sipcapture/homer-appgithub.com/sipcapture/homer-app

Wednesday, Oct 7

MEDIUMINCIDENTOpenAI: Elevated errors with GPT-5.6 Instant in FedRAMP workspacesOpenAIVendor2026-10-07 23:42 UTCby status page–WHAT TO DO LOWINCIDENTAnthropic: Issue with spend limitsAnthropicVendor2026-10-07 21:23 UTCby status page–WHAT TO DO HIGH7.7Amazon Athena: missing authorization let users read other accounts' query metadataVendor2026-10-07 21:17 UTCby EPSS–WHAT TO DO MEDIUMINCIDENTCircleCI: Increased task wait times for Docker Gen2CircleCIVendor2026-10-07 18:54 UTCby status page–WHAT TO DO MALICIOUSDON'T INSTALLREMOVE ITMalicious code in animatecss-tailwind-bridge (npm)animatecss-tailwind-bridgePackage2026-10-07 18:36 UTCby osv-malicious–UNINSTALL HIGH7.5Mutually-referencing array formulas recurse unboundedly, causing a fatal stack overflow in github.com/xuri/excelizegithub.com/xuri/excelize/v2Package2026-09-11 05:52 UTCby EPSS–FIX 2.11.1-0.20260911060113-ea12859e43c6 HIGH7.5Panic and memory exhaustion via unbounded CFB stream allocation in github.com/xuri/excelizegithub.com/360EntSecGroup-Skylar/excelize/v2Package2026-09-12 11:33 UTCby EPSS–FIX 2.11.1-0.20260912113515-5f636f9dcde5 HIGH7.5Excelize Decrypt: unrecoverable panics on malformed OLE/CFB encrypted workbooks in github.com/xuri/excelizegithub.com/360EntSecGroup-Skylar/excelize/v2Package2026-09-15 03:18 UTCby EPSS–FIX 2.11.1-0.20260915055537-22f76f9acb94 HIGH8.7Nil-pointer dereference in GetSlicers when a worksheet has extLst present but no drawing element in github.com/xuri/excelizegithub.com/xuri/excelize/v2Package2026-09-29 01:57 UTCby EPSS–FIX 2.11.1-0.20260929015830-8ffeb07ec9a3 HIGH7.5Excelize: Unbounded row number in Rows.Columns makes GetRows and the Rows iterator loop for days in github.com/xuri/excelizegithub.com/360EntSecGroup-Skylar/excelize/v2Package2026-09-30 02:12 UTCby EPSS–FIX 2.11.1-0.20260930021559-01a9ff32fb3c HIGH8.7Panic via unchecked pivot-cache field index in github.com/xuri/excelize/v2github.com/xuri/excelize/v2Package2026-10-03 00:22 UTCby EPSS–FIX 2.11.1-0.20261003002531-6258dcebc4e2 MEDIUMINCIDENTOpenAI: Degraded performance in Codex and Work mode: Dot turn failures, delayed responses, and reduced proactivityOpenAIVendor2026-10-07 17:21 UTCby status page–WHAT TO DO CRITICALINCIDENTGitHub: Incident with Git Operations, Issues, Actions and Pull RequestsGitHubVendor2026-10-07 17:17 UTCby status page–WHAT TO DO CRITICAL9.8Homer: Complete Authentication Bypass When coordinator.jwt.secret Is Empty (Default) in github.com/sipcapture/homer-appgithub.com/sipcapture/homer-appPackage2026-06-25 09:49 UTCby EPSS–WHAT TO DO CRITICAL9.8Homer: Hardcoded Default Admin Password 'sipcapture' With No Forced Change on First Login in github.com/sipcapture/homer-appgithub.com/sipcapture/homer-appPackage2026-06-25 09:49 UTCby EPSS–WHAT TO DO HIGH8.1Homer: Authenticated SQL Injection via Unvalidated rawquery Field in /api/v4/statistics/query in github.com/sipcapture/homer-appgithub.com/sipcapture/homer-appPackage2026-06-25 09:48 UTCby InfraStack Analyst–FIX 11.0.283 MEDIUMINCIDENTOpenAI: Dot in Codex may fail to create new threadsOpenAIVendor2026-10-07 16:31 UTCby status page–WHAT TO DO CRITICALINCIDENTGitHub: Incident with Git Operations, Pull Requests and ActionsGitHubVendor2026-10-07 15:14 UTCby status page–WHAT TO DO MEDIUMINCIDENTCircleCI: Elevated level of infra fails on customer jobsCircleCIVendor2026-10-07 14:27 UTCby status page–WHAT TO DO NOT SCOREDNOT SCOREDSiYuan: TLS Private Keys Readable via getFile (Incomplete Blocklist) in github.com/siyuan-note/siyuan/kernelgithub.com/siyuan-note/siyuan/kernelPackage2026-10-07 14:10 UTCby Go vuln DB–FIX 0.0.0-20260819144130-256d73aa7f94 NOT SCOREDNOT SCOREDSiYuan: /history/*path and /repo/diff/*path potentially exposing historical snapshots of data/.siyuan/publishAccess.json and data/templates/* in github.com/siyuan-note/siyuan/kernelgithub.com/siyuan-note/siyuan/kernelPackage2026-10-07 14:10 UTCby Go vuln DB–FIX 0.0.0-20260816034002-035bf9a8c311 NOT SCOREDNOT SCOREDSiYuan MCP asset.upload Reads Arbitrary Absolute File Paths (Workspace Boundary Bypass) in github.com/siyuan-note/siyuan/kernelgithub.com/siyuan-note/siyuan/kernelAI agents & MCP2026-10-07 14:10 UTCby Go vuln DB–FIX 0.0.0-20260813142104-b26a4a307b8a HIGH8.8gitea-runner: workflow container.options passes host namespaces and capability flags to job container when privileged mode is disabled in gitea.com/gitea/runnergitea.com/gitea/runnerPackage2026-08-15 12:32 UTCby EPSS–FIX 1.0.9-0.20260731160927-34bfa1915022 NOT SCOREDNOT SCOREDSiYuan Agent Tools SSRF via DNS-Rebinding TOCTOU (Bypass of CheckHostSSRF) in github.com/siyuan-note/siyuan/kernelgithub.com/siyuan-note/siyuan/kernelPackage2026-10-07 14:10 UTCby Go vuln DB–FIX 0.0.0-20260813142806-dd2778b70d02 NOT SCOREDNOT SCOREDSiYuan: getAttributeViewSearchTarget returns database row content to anonymous readers with no publish-access check, reopening the class closed one day earlier at the adjacent route in github.com/siyuan-note/siyuan/kernelgithub.com/siyuan-note/siyuan/kernelPackage2026-10-07 14:09 UTCby Go vuln DB–FIX 0.0.0-20260812083335-251596fc0de2 HIGH7.5Panic parsing crafted input in x/text/secure/precis in golang.org/x/textgolang.org/x/textPackage2026-10-07 14:09 UTCby EPSS–FIX 0.41.0 MEDIUM6.5wger: Cross-User Data Corruption via Missing Ownership Check on WorkoutLog.slot_entrywgerPackage2026-10-04 17:21 UTCby EPSS–WHAT TO DO HIGH7.1wger: Trainer Privilege Escalation - Improper Privilege ManagementwgerPackage2026-10-04 17:18 UTCby EPSS–WHAT TO DO MEDIUMINCIDENTCircleCI: Delay on starting Machine Job TasksCircleCIVendor2026-10-07 13:40 UTCby status page–WHAT TO DO HIGH7.1wger: cross-tenant admin notes/contracts leak via gym=None bypass (5 views)wgerPackage2026-10-04 17:38 UTCby EPSS–WHAT TO DO HIGHINCIDENTAnthropic: Elevated errors on platform.claude.comAnthropicVendor2026-10-07 13:25 UTCby status page–WHAT TO DO CRITICAL9.8Duplicate Advisory: Remote code execution via unsafe deserialization in multiprocess mode transportlmcacheAI agents & MCP2026-10-07 12:31 UTCby GitHub Advisories–WHAT TO DO CRITICAL9.8PUBLIC EXPLOITLMCache: Remote code execution via unsafe deserialization in multiprocess mode transportlmcacheAI agents & MCP2026-10-07 10:17 UTCby GitHub Advisories–FIX 0.5.6 HIGHINCIDENTOpenAI: Unable to create new ChatGPT Work threads in latest version of desktop appOpenAIVendor2026-10-07 05:31 UTCby status page–WHAT TO DO HIGHINCIDENTAnthropic: Elevated errors loading usage data on platform.claude.comAnthropicVendor2026-10-07 01:20 UTCby status page–WHAT TO DO MEDIUMINCIDENTOpenAI: Workspace Agents Degraded and Responses ImpactedOpenAIVendor2026-10-07 01:12 UTCby status page–WHAT TO DO

Tuesday, Oct 6Wednesday, Oct 7Thursday, Oct 8