Looks like it could have been even worse.
Via the Wall Street Journal:
Counterterrorism officials found what they believe to be five additional, undetonated explosive devices around the Boston area, according to two people briefed on the rapidly moving investigation.
The devices—which are in addition to the two that exploded near the finish line of the marathon—were discovered over the course of a frantic inspection of suspicious packages, many of them abandoned as pedestrians, runners, and others scrambled away from crowded public streets. Each had been rendered inoperative or was in the process of being rendered inoperative, the officials said.
It is not yet clear if Boston police have confirmed any of this:
FYI seeing some others knocking down that WSJ report on 5 unexploded devices. Seems police may not have fully confirmed.
— Josh Marshall (@joshtpm) April 16, 2013
Oops. Officials now tell the WSJ the devices probably were not bombs:
Breaking: Officials found 5 more suspect devices, but late Monday said they now doubt the devices were bombs. http://t.co/EHpOeRNgcZ
— Wall Street Journal (@WSJ) April 16, 2013