A moderator on slack told me that every pending transaction poses a threat for my remaining funds in the wallet. Especially when a transaction stays pending for a long time or never confirms.
As far as I understand it my remaining Iotas move to a new address when making a transaction. However, if the transaction is in pending state the remaining balance stays on the already spent and thus vulnerable address till the transaction is confirmed.
While one single transaction is pending, there is no threat to your balance (apart from the obvious, that if the transaction confirms later, your balance will decrease by the transaction amount).
However, if you have more than one transaction spending from the same address pending (where the transactions have different bundle hashes, i. e. the second one is not a reattach of the previous one), you are publishing two (one-time) signatures for the same address, therefore making it possible for attackers to get your private key and possibly signing another transaction that moves your funds somewhere else than you desire. If that attacker's transaction confirms before one of your transaction does, your funds are lost.
