Blast Radius

Every weekday, 06:30 UTC

Only the CVEs that touch your stack.

Paste your dependency manifest once. You get the vulnerabilities affecting the versions you actually run, and nothing else.

Free. One click to unsubscribe. Never sold, never passed to advertisers. Handled by us and our email provider, and the pinned versions you paste are sent to OSV (api.osv.dev), the public vulnerability database they are matched against — that query is how the matching works. With a manifest, your email is built automatically from the matched advisories: no AI drafting and no human edit. Without one, you get the shared issue, drafted with an AI model and edited by a person before it is sent. Unpinned lines are skipped rather than guessed at: a name with no version cannot be matched against a version range.

Sample from 30 September 202638 items scanned, 12 kept

GHSA-vcvr-r3jv-pc5j next

CVSS 9.5

Next.js: Remote Code Execution in next/og ImageResponse

fixed in 16.3.6npmcritical

CVE-2026-74864

CVSS 9.3

sogo_yhn configures SOGo with a parameter that forces the request with HTTP header "x-webobjects-remote-user" to be treated as sent by a verified user without performing password validation. Since Nginx does not strip this header, any client can supply it arbitrarily and gain access as any user, including a privileged user, without providing a password. This issue was fixed in version 5.8.0~ynh9.

criticalnginx

CVE-2026-53988

CVSS 9.2

Dockhand before 1.0.40 contains an authentication bypass vulnerability in its git webhook endpoints that allows unauthenticated remote attackers to trigger arbitrary stack redeployments by exploiting a null webhook secret guard condition. Attackers can enumerate sequential stack IDs and send unsigned webhook requests to force git clone and docker compose operations, enabling denial of service or, when combined with write access to the tracked git branch, container escape and full host compromise via attacker-controlled docker-compose.yml with privileged bind mounts.

criticaldocker

In every issue

Matched, not dumped
Version ranges are compared against your manifest. A CVE for a version you don't run never reaches you.
Exploitation status first
Whether CISA lists it as exploited in the wild, and the version that fixes it, before the CVSS number.
A quiet day still gets an email
Three lines saying nothing matched, at the usual time. You never have to wonder whether it was quiet or whether the thing broke.

Where it comes from

  • services.nvd.nist.gov/rest/json/cves/2.0
  • cisa.gov/known-exploited-vulnerabilities
  • api.github.com/advisories (GHSA, reviewed only)
  • osv.dev/v1/query
  • distro trackers: Debian, Red Hat, Alpine

The other seven newsletters

Job Queue infrastructure jobs, without the job boards Redline what changed in tech law, and who it binds Import the libraries that got interesting this week Toolchain the tools people actually started using Sunset deprecations, before they break you Root Cause other people's outages, summarised Rate Card when the vendors change their prices