Live· 34 threats · Thursday, Oct 8· last check 2026-11-04 08:23 UTC

Everything we’re watching.

Every new vulnerability, vendor incident and attack on AI tools, merged from every source as it lands. Early warnings before a CVE exists.

Thursday, Oct 8

Most severe in everything

CRITICAL9.8

Root.Mkdir(All) can follow junctions out of the root on Windows in osstdlib

CRITICAL9.1

Double flow control refund on HTTP/2 server streams in net/httpstdlib

CRITICALNO CVE YET

Fly.io: Sprite creates failingFly.io

MALICIOUSDO NOT INSTALL

MALICIOUS · REMOVE IT

Malicious code in css-overscroll-contain (npm)css-overscroll-contain

Thursday, Oct 8

HIGH7.5Lack of limit on size of parsed Range headers in net/httpstdlibRuntime2026-10-08 22:31 UTCby EPSS–FIX 1.26.9 HIGH7.5HTTP/1 client connection desynchronization after CONNECT rejection in net/httpstdlibRuntime2026-10-08 22:31 UTCby EPSS–FIX 1.26.9 HIGH7.5Excessive CPU consumption from repeated initial window changes in net/httpstdlibRuntime2026-10-08 22:31 UTCby EPSS–FIX 1.26.9 HIGH7.5HTTP/2 server crash due to HPACK encoder race in net/httpstdlibRuntime2026-10-08 22:31 UTCby EPSS–FIX 1.26.9 CRITICAL9.1Double flow control refund on HTTP/2 server streams in net/httpstdlibPackage2026-10-08 22:31 UTCby EPSS–FIX 1.26.9 HIGH7.5HTTP/1 server connection desynchronization after 2xx CONNECT response in net/httpstdlibPackage2026-10-08 22:31 UTCby EPSS–FIX 1.26.9 HIGH7.8Checksum database bypass for golang.org/toolchain in cmd/gotoolchainRuntime2026-10-08 22:31 UTCby EPSS–FIX 1.26.9 MEDIUM6.1Reset context tracking on consecutive template expressions in html/templatestdlibPackage2026-10-08 22:31 UTCby EPSS–FIX 1.26.9 HIGH7.8Checksum bypass for golang.org/fips140 in cmd/gotoolchainRuntime2026-10-08 22:31 UTCby InfraStack Analyst–FIX 1.26.9 MEDIUM6.1Recognize yield as regexp preceder keyword in html/templatestdlibPackage2026-10-08 22:31 UTCby EPSS–FIX 1.26.9 HIGH7.5Reject malformed ECH outer extension references in crypto/tlsstdlibRuntime2026-10-08 22:31 UTCby EPSS–FIX 1.26.9 HIGH7.5HTTP/2 transport accepts malformed framing-related headers in net/httpstdlibRuntime2026-10-08 22:31 UTCby EPSS–FIX 1.26.9 HIGH7.5Memory limit bypass when parsing MIME headers in net/textproto, mime/multipartstdlibRuntime2026-10-08 22:31 UTCby EPSS–FIX 1.26.9 HIGH7.5HTTP/2 server memory exhaustion due to Trailer headers in net/httpstdlibRuntime2026-10-08 22:31 UTCby EPSS–FIX 1.26.9 CRITICAL9.8Root.Mkdir(All) can follow junctions out of the root on Windows in osstdlibRuntime2026-10-08 22:31 UTCby EPSS–FIX 1.26.9 MEDIUM5.1Duplicate Advisory: PYTHON-6110 Out-of-bounds read in BSON decoding via a malformed Regex elementpymongoPackage2026-10-08 21:33 UTCby GitHub Advisories–WHAT TO DO CRITICALINCIDENTFly.io: Sprite creates failingFly.ioVendor2026-10-08 21:23 UTCby status page–WHAT TO DO MALICIOUSDON'T INSTALLREMOVE ITMalicious code in css-overscroll-contain (npm)css-overscroll-containPackage2026-10-08 21:19 UTCby osv-malicious–UNINSTALL HIGH5.9MongoDB Python Driver: Out-of-bounds read in BSON decoding via a malformed Regex elementpymongoPackage2026-10-08 21:17 UTCby EPSS–FIX 4.18.3 MALICIOUSDON'T INSTALLREMOVE ITMalicious code in kafka-helmsman (PyPI)kafka-helmsmanPackage2026-10-08 21:15 UTCby osv-malicious–UNINSTALL MALICIOUSDON'T INSTALLREMOVE ITMalicious code in kafka-roller (PyPI)kafka-rollerPackage2026-10-08 20:52 UTCby osv-malicious–UNINSTALL MEDIUM6.8AWS CDK: symlinks injected during Docker asset bundling expose host filesPackage2026-10-08 20:17 UTCby EPSS–WHAT TO DO MEDIUM6.3Pre-negotiation frame limit is not enforced to 4KB in github.com/rabbitmq/amqp091-gogithub.com/rabbitmq/amqp091-goPackage2026-08-18 10:07 UTCby EPSS–FIX 1.14.0 HIGH8.5Amazon Agent Plugins: databases-on-aws command injection via crafted agent contentAI agents & MCP2026-10-08 19:16 UTCby EPSS–WHAT TO DO MEDIUM6.8AWS Toolkit for VS Code: world-readable CodeCatalyst bearer token cache on diskPackage2026-10-08 17:37 UTCby EPSS–WHAT TO DO HIGH7.5msgpack5: Truncated map32 headers throw an unexpected errormsgpack5Package2026-09-26 11:10 UTCby GitHub Advisories–FIX 6.1.0 MEDIUM5.5Possible DoS via unbounded parsing of user and group database files in github.com/moby/sys/usergithub.com/moby/sys/userPackage2026-06-25 19:12 UTCby EPSS–FIX 0.4.1 MALICIOUSDON'T INSTALLREMOVE ITMalicious code in @xayz/baileys (npm)@xayz/baileysPackage2026-10-08 13:31 UTCby osv-malicious–UNINSTALL MEDIUMINCIDENTCircleCI: Elevated wait times for machine jobsCircleCIVendor2026-10-08 13:00 UTCby status page–WHAT TO DO HIGHINCIDENTFly.io: LHR network issuesFly.ioVendor2026-10-08 05:40 UTCby status page–WHAT TO DO MALICIOUSDON'T INSTALLREMOVE ITMalicious code in @ziedzzz/demo-canary (npm)@ziedzzz/demo-canaryPackage2026-10-08 03:37 UTCby osv-malicious–UNINSTALL MALICIOUSDON'T INSTALLREMOVE ITMalicious code in abbishal-poc-as-dependency (npm)abbishal-poc-as-dependencyPackage2026-10-08 03:36 UTCby osv-malicious–UNINSTALL MEDIUMINCIDENTOpenAI: Some APAC users are seeing errors in ChatGPT Work, conversations, and GPTs.OpenAIVendor2026-10-08 03:17 UTCby status page–WHAT TO DO MALICIOUSDON'T INSTALLREMOVE ITMalicious code in tensorlake (npm)tensorlakePackage2026-10-08 02:54 UTCby osv-malicious–UNINSTALL