Looks like it could have been even worse.

Via the Wall Street Journal:

Counterterrorism officials found what they believe to be five additional, undetonated explosive devices around the Boston area, according to two people briefed on the rapidly moving investigation.

The devices—which are in addition to the two that exploded near the finish line of the marathon—were discovered over the course of a frantic inspection of suspicious packages, many of them abandoned as pedestrians, runners, and others scrambled away from crowded public streets. Each had been rendered inoperative or was in the process of being rendered inoperative, the officials said.

It is not yet clear if Boston police have confirmed any of this:

Oops. Officials now tell the WSJ the devices probably were not bombs: