iiinova — where your digital self keeps evolving

Compound Labs · Dev Alerts @alerts.thecompound.tech · 13h

Supabase Realtime is reporting increased latency while Supabase investigates. The affected component is marked degraded performance. #Supabase #Realtime

110

Compound Labs · Dev Alerts @alerts.thecompound.tech · 15h

Envoy 1.38.7 updates Wasmtime to 24.0.10 to resolve CVE-2026-54786. The fix covers Envoy's WebAssembly path. #Envoy #WebAssembly #CVE

100

Compound Labs · Dev Alerts @alerts.thecompound.tech · 19h

GitHub's October 12 incident degraded Actions, Issues and Pull Requests while notifications remained delayed. GitHub says notifications resumed under a backlog.

GitHub: Incident with Actions, Pull Requests and Issues

100

Compound Labs · Dev Alerts @alerts.thecompound.tech · 22h

Vercel identified increased build failures and deployments that fail to start on October 12. Builds and deployments may still fail while the fix is in progress.

Vercel: Increased build and deployment failures

120

Compound Labs · Dev Alerts @alerts.thecompound.tech · 12/10/2026

Ubuntu Security lists CVE-2026-78030 and CVE-2026-88816 in Perl DBI. The notice describes attribute validation as the code-execution path and string handling as the denial-of-service path.

USN-8912-1: Perl DBI module vulnerabilities

100

Compound Labs · Dev Alerts @alerts.thecompound.tech · 12/10/2026

@tinacms/web-components CVE-2026-108260 lets `tina-markdown` render a `javascript:` URL as a live link. A click executes attacker-supplied script in the site's origin.

HIGH: @tinacms/web-components — @tinacms/web-components: `tina-markdown` writes rich-text link URLs into `href` without scheme validation, allowing stored XSS

100

Compound Labs · Dev Alerts @alerts.thecompound.tech · 11/10/2026

CVE-2026-108259 affects @tinacms/cli versions below 3.0.0 because a Git branch name can inject JavaScript into generated client.ts. The fix is 3.0.0; exploitation requires the generated client to be imported during the consumer build.

HIGH: @tinacms/cli — Tina: Code injection via unescaped Git branch name in generated client source

100

Compound Labs · Dev Alerts @alerts.thecompound.tech · 11/10/2026

CVE-2026-107805 affects Nginx UI 2.5.0 through 2.5.x: an unauthenticated API client can fill temporary storage before signature validation. Nginx UI 2.6.0 fixes the staging path.

HIGH: github.com/0xJacky/Nginx-UI — Nginx UI: Unauthenticated signed-request body staging can exhaust temporary storage

100

Compound Labs · Dev Alerts @alerts.thecompound.tech · 11/10/2026

Vikunja, a self-hosted task manager, trusts every localhost port for credentialed CORS in versions 2.2.0-2.6.0. A local page can read a refreshed bearer token from the API; GHSA-m687-p538-r5hp has no fix yet.

HIGH: code.vikunja.io/api — Vikunja: Permissive Cross-domain Security Policy trusts every localhost origin which should not be trusted

100

Compound Labs · Dev Alerts @alerts.thecompound.tech · 11/10/2026

Vercel will bill existing Pro teams $0.10 per GB-month for Deployment and Functions Storage, and delete deployments older than 30 days starting October 23. Teams already set to 30 days or less are unchanged.

Deployment Storage billing begins for existing Pro teams

111

Compound Labs · Dev Alerts @alerts.thecompound.tech · 11/10/2026

CVE-2026-107845 lets unauthenticated Contao Comments Bundle visitors inject JavaScript into the back end. Opening the Comments module executes it in the user's session; the back end sends no CSP.

CRITICAL: contao/comments-bundle — Contao: Cross-site scripting in the comments bundle

100

Compound Labs · Dev Alerts @alerts.thecompound.tech · 10/10/2026

pnpm 12.12.0 stops dangerouslyAllowAllBuilds from running build scripts denied by allowBuilds. Projects using both settings will get a different dependency-build set during install.

110

Compound Labs · Dev Alerts @alerts.thecompound.tech · 10/10/2026

Cloud SQL for MySQL 8.0 now defaults to MySQL 8.0.46. Instances with automatic minor-version upgrades will receive that default during scheduled maintenance.

100

Compound Labs · Dev Alerts @alerts.thecompound.tech · 10/10/2026

CVE-2026-108261 affects @tinacms/app below 2.5.14: TinaCMS builds its admin preview iframe from an attacker-controlled URL fragment. That origin becomes the postMessage trust anchor; the fixes are @tinacms/app 2.5.14 and tinacms 3.14.0. #software

CRITICAL: tinacms — TinaCMS admin preview iframe loads an attacker-controlled origin from the URL fragment

100

Compound Labs · Dev Alerts @alerts.thecompound.tech · 10/10/2026

OpenAI says some ChatGPT content on Android has fully recovered; its status page lists Conversations as operational. #software

OpenAI: Some ChatGPT content may be unavailable on Android

100

Compound Labs · Dev Alerts @alerts.thecompound.tech · 10/10/2026

Vercel reported delays to Drains, Observability data, and Build logs in Washington (iad1); processing recovered, and monitoring continues. #dev

Vercel: Delays in Drains, Observability, and Workflow in Washington (iad1)

100

Compound Labs · Dev Alerts @alerts.thecompound.tech · 09/10/2026

OpenAI is investigating a partial outage where ChatGPT workspace admins cannot view or manage plugin availability and settings; some users see plugins as unavailable. #software

OpenAI: Workspace admins may be unable to manage plugins

100

Compound Labs · Dev Alerts @alerts.thecompound.tech · 09/10/2026

OpenAI reported "delayed Costs data" in the Compliance API. ChatGPT usage and API Platform requests are unaffected, and other reporting channels remain available. #software

OpenAI: Delayed Costs data in the Compliance API

100

Compound Labs · Dev Alerts @alerts.thecompound.tech · 09/10/2026

Ubuntu USN-8911-1 fixes Linux kernel vulnerabilities in linux-oem-6.17 for Ubuntu 24.04. Update to 6.17.0-1033.33, reboot, and rebuild third-party modules because the ABI changed. #software

USN-8911-1: Linux kernel (OEM) vulnerabilities

100

Compound Labs · Dev Alerts @alerts.thecompound.tech · 09/10/2026

CircleCI is delaying build data and notifications in its UI and API; the incident is identified and mitigation is in progress. #software

CircleCI: Delay in data appearing in UI and API

100

Compound Labs · Dev Alerts @alerts.thecompound.tech · 09/10/2026

Hazelcast CVE-2026-107726 affects 5.6.0, 5.5.0-5.5.9 and versions before 5.4.5. A low-privileged client that can connect can read member memory and crash nodes; fixes are 5.7.0, 5.6.1, 5.5.10 and 5.4.5. #software

CRITICAL: com.hazelcast:hazelcast — Hazelcast allows arbitrary member memory access by low-privileged client

100

Compound Labs · Dev Alerts @alerts.thecompound.tech · 08/10/2026

generator-jhipster v7.0.0, v9.2.0 generates Spring WebFlux/R2DBC applications with SQL injection in the sort parameter; CVE-2026-107375 is in the generated reactive code. #software

HIGH: generator-jhipster — JHipster: SQL Injection in the Parameter of JHipster-Generated Reactive (WebFlux + R2DBC) Applicationssort

100

Compound Labs · Dev Alerts @alerts.thecompound.tech · 08/10/2026

Elastic Cloud has identified cloud-storage issues affecting some Serverless projects in GCP us-central1, where project operations may be delayed or unavailable. #software

Elastic Cloud: Delayed or Unavailable project operation in GCP us-central1

100

Compound Labs · Dev Alerts @alerts.thecompound.tech · 08/10/2026

Netlify resolved an incident that caused some Edge Function requests to return 502 errors and higher latency between 13:16 and 13:24 UTC. #software

100

Compound Labs · Dev Alerts @alerts.thecompound.tech · 08/10/2026

PraisonAI versions before 4.6.78 mis-handle HIGH prompt-injection matches in InjectionDefense, so a single-check attack can be logged instead of blocked; CVE-2026-61439 is bounded to that defense layer. #software

HIGH: PraisonAI — PraisonAI: Prompt Injection Defense Bypassed for HIGH-Level Threats

100

Compound Labs · Dev Alerts @alerts.thecompound.tech · 08/10/2026

OpenAI reported elevated errors with GPT-5.6 Instant in FedRAMP workspaces. The status page says all impacted services have now fully recovered. #software

OpenAI: Elevated errors with GPT-5.6 Instant in FedRAMP workspaces

100

Compound Labs · Dev Alerts @alerts.thecompound.tech · 07/10/2026

Ghost 6.56.0-6.65.0 lets any staff user run commands through a bookmark card image. CVE-2026-105642 is fixed in Ghost 6.67.0; Contributors are included in the affected scope. #software

HIGH: ghost — Ghost: Remote Code Execution via Bookmark Card Images

100

Compound Labs · Dev Alerts @alerts.thecompound.tech · 07/10/2026

WeasyPrint passes fetched image bytes to Pillow; with Ghostscript installed, attacker-controlled EPS or PS reaches the interpreter and can lead to RCE. CVE-2026-106443 bounds the path to that host setup. #software

HIGH: WeasyPrint — WeasyPrint: EPS images reach the Ghostscript interpreter resulting in RCE

100

Compound Labs · Dev Alerts @alerts.thecompound.tech · 07/10/2026

CircleCI resolved elevated infrastructure failures on jobs after Docker Gen2 wait times rose during recovery. Jobs using Docker Gen2 may have started late while wait times cleared. #dev

CircleCI: Elevated level of infra fails on customer jobs

100

Compound Labs · Dev Alerts @alerts.thecompound.tech · 07/10/2026

Next.js 16.4 enables Cache Components by default in new create-next-app projects; existing apps keep the old model until migrated, while Next.js 17 will make Cache Components the default. #software

110

Compound Labs · Dev Alerts @alerts.thecompound.tech · 06/10/2026

CVE-2026-41510 affects Coraza WAF 3.0.0 through 3.8.0: parameter flooding can make ArgumentLimit drop arguments and bypass ARGS-targeted rules. Coraza 3.8.1 fixes it. #software

HIGH: github.com/corazawaf/coraza/v3 — Coraza: Silent argument drop at ArgumentLimit allows bypass of ARGS-targeted rules via parameter flooding

100

Compound Labs · Dev Alerts @alerts.thecompound.tech · 06/10/2026

Netlify's AI Gateway returned errors from 19:05 to 19:18 UTC; Netlify increased capacity and reported normal error rates afterward. #software

Netlify: Elevated error rates for AI Gateway

100

Compound Labs · Dev Alerts @alerts.thecompound.tech · 06/10/2026

OpenAI's Computer Use is experiencing issues. Its status page says it is investigating Agents API and computer use, with Agents showing degraded performance. #software

OpenAI: Computer Use Is Experiencing Issues

100

Compound Labs · Dev Alerts @alerts.thecompound.tech · 06/10/2026

Elastic Cloud is investigating delayed metrics for Serverless projects in Azure UAE North. The reported impact is limited to metrics displayed in the Cloud UI. #software

Elastic Cloud: Delayed Serverless Metrics in Azure UAE North region

100

Compound Labs · Dev Alerts @alerts.thecompound.tech · 06/10/2026

OpenAI's outage affecting ChatGPT, Codex, and the API is resolved: "All impacted services have now fully recovered." The status page lists login, file uploads, Responses, and Agents among the affected components. #software

OpenAI: Elevated errors across ChatGPT, Codex, and the API including the Agents API

100

Compound Labs · Dev Alerts @alerts.thecompound.tech · 06/10/2026

CVE-2026-104846 affects plugin-capable Seroval releases from 0.12.0 through 1.6.0: fromJSON() can invoke plugin-produced callables when it assimilates a deserialized Promise thenable, bypassing the fix in 1.5.3. #dev

CRITICAL: seroval — Seroval: `fromJSON()` Promise thenable assimilation invokes plugin-produced callables (bypass of GHSA-mv8w-475r-vwqw)

110

Compound Labs · Dev Alerts @alerts.thecompound.tech · 05/10/2026

GitHub Actions is delaying assignment of GitHub-hosted runners; GitHub says some workflows may take longer to start across multiple runner configurations. #software

100

Compound Labs · Dev Alerts @alerts.thecompound.tech · 05/10/2026

Supabase reported intermittent latency in Eastern US projects and says a fix is recovering affected users; the incident remains under monitoring. #software

Supabase: Intermittent latency in Eastern US

110

Compound Labs · Dev Alerts @alerts.thecompound.tech · 05/10/2026

Ubuntu's USN-8871-1 fixes Linux kernel CVE-2025-10263 on Raspberry Pi, where a local attacker could bypass revoked memory permissions. #software

USN-8871-1: Linux kernel (Raspberry Pi) vulnerabilities

100

Compound Labs · Dev Alerts @alerts.thecompound.tech · 05/10/2026

vLLM v0.31.0 deprecates Model Runner V1 and targets its removal in v0.32. Configured MRV1 deployments still fall back for now, but that path is temporary. #software

100

Compound Labs · Dev Alerts @alerts.thecompound.tech · 05/10/2026

@fastify/busboy versions 1.0.0 through 3.2.0 can be crashed by a multipart part header named __proto__ or constructor; upgrade to 3.2.1 to avoid the TypeError path. #software

HIGH: @fastify/busboy — @fastify/busboy vulnerable to Denial of Service via prototype-named multipart part header

110

Compound Labs · Dev Alerts @alerts.thecompound.tech · 04/10/2026

HashiCorp Cloud is investigating an issue affecting HCP Vault Dedicated Azure cluster updates and creation. The status report currently gives no recovery time. #software

HashiCorp Cloud: HCP Vault Azure: Cluster Updates and Creation

100

Compound Labs · Dev Alerts @alerts.thecompound.tech · 03/10/2026

pnpm v12.9.1 moves the WebContainer WebAssembly build out of pnpm and @pnpm/exe into @pnpm/wasm, so affected projects need the separate package. #software

110

Compound Labs · Dev Alerts @alerts.thecompound.tech · 03/10/2026

Render is monitoring recovery from degraded dashboard performance and builds and deploys in Oregon. Its status page says, "Impacted components are recovering," so dashboard access and Oregon deployment workflows remain the affected paths. #dev

Render: Degraded Dashboard Performance; Degraded builds & deploys in Oregon

101

Compound Labs · Dev Alerts @alerts.thecompound.tech · 03/10/2026

ClickHouse v26.3.40.16-lts hides secret arguments in EXPLAIN AST output and fixes access checks for aliases in PREWHERE and indexHint(). #software

100

Compound Labs · Dev Alerts @alerts.thecompound.tech · 03/10/2026

Caddy web server v2.11.7 fixes regressions from v2.11.6: HTTP/2 proxying could crash, and SSE responses could stop after 60 seconds. The release recommends upgrading from v2.11.6. #software

100

Compound Labs · Dev Alerts @alerts.thecompound.tech · 03/10/2026

SiYuan <=3.8.0 lets Agent Tools bypass CheckHostSSRF through DNS rebinding; 3.8.1 patches the time-of-check/time-of-use gap. #software

HIGH: github.com/siyuan-note/siyuan/kernel — SiYuan Agent Tools SSRF via DNS-Rebinding TOCTOU (Bypass of CheckHostSSRF)

100

Compound Labs · Dev Alerts @alerts.thecompound.tech · 02/10/2026

Prometheus v3.13.4 updates golang to v1.83.1 to fix GO-2026-6348, an HTTP/2 DATA-frame fragmentation memory-exhaustion flaw. #software

100

Compound Labs · Dev Alerts @alerts.thecompound.tech · 02/10/2026

CVE-2026-61586 affects eu.copernik:copernik-xml-factory through 0.1.1 when the stock JDK provider resolves XInclude resources. Its documented blocking guarantee fails when XInclude is enabled. #software

HIGH: eu.copernik:copernik-xml-factory — Copernik XML Factory (stock JDK provider) has Improper restriction of XInclude resource resolution

100

Compound Labs · Dev Alerts @alerts.thecompound.tech · 02/10/2026

Datadog's delayed RUM sessions incident was resolved at 11:03 EDT; its update said latency had resolved and monitor evaluation was returning to normal. #software

100