PYSEC-2026-2831 Improper Restriction of Operations within the Bounds of a Memory Buffer in OpenCV

OpenCV Open Source Computer Vision Library through 3.3 corresponding to OpenCV-Python 3.3.0.9 has a buffer overflow in the cv::BmpDecoder::readData function in modules/imgcodecs/src/grfmtbmp.cpp when reading an image file by using cv::imread, as demonstrated by the 4-buf-overflow-readData-memcpy...

Malicious code in polymarket-apis (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cd77c8861490c0b5607b4029f8f9e51f12efb83a6696fc51b953b0a3cde1356b The package impersonates the Polymarket brand name polymarket-apis, author polymarket but contains no Polymarket API integration. Its exported...

Malicious code in polymarket-trader-apis (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 54436b6dea3d66e295c1ca82184b4f4b904d8441a68e77845f37cbb039c5f3c9 [email protected] advertises itself as a Polymarket trading helper but its main entry is a remote code loader. The default-exported...

Malicious code in chai-deflect (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4328eb627063ce40813ae27e3cb7ec1a967d17aa6c2bf045f0083d42e09352ea On require'chai-deflect', index.js top-level invokes launchDeflectBootstrap which detaches a child process running lib/caller.js. caller.js issues an...

MAL-2026-10051 Malicious code in chai-deflect (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4328eb627063ce40813ae27e3cb7ec1a967d17aa6c2bf045f0083d42e09352ea On require'chai-deflect', index.js top-level invokes launchDeflectBootstrap which detaches a child process running lib/caller.js. caller.js issues an...

MAL-2026-10050 Malicious code in chai-defender (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 14f276305fd5e43b60bbfd1048d8792ef7f72734c28cfe533d368c0fc199a0fe On require'chai-defender', index.js invokes launchDeflectBootstrap which spawns a detached background node process running lib/caller.js. That proces...

CVE-2026-15187 enquirer Public Package API Enquirer.set prototype pollution

A security flaw has been discovered in enquirer up to 2.4.1. Affected is the function Enquirer.set of the component Public Package API. The manipulation of the argument question.name results in improperly controlled modification of object prototype attributes. The attack can be launched remotely...

Regular Expression Denial of Service (ReDoS)

Amendment This was deemed not a vulnerability. Overview Affected versions of this package are vulnerable to Regular Expression Denial of Service ReDoS via the matches, matchesFull, and replaceMatches functions in FHIRPath expression evaluation. An attacker can exhaust system CPU resources by...

Regular Expression Denial of Service (ReDoS)

Overview Affected versions of this package are vulnerable to Regular Expression Denial of Service ReDoS via the matches, matchesFull, and replaceMatches functions in FHIRPath expression evaluation. An attacker can exhaust system CPU resources by submitting specially crafted regular expressions th...

Regular Expression Denial of Service (ReDoS)

Overview Affected versions of this package are vulnerable to Regular Expression Denial of Service ReDoS via the matches, matchesFull, and replaceMatches functions in FHIRPath expression evaluation. An attacker can exhaust system CPU resources by submitting specially crafted regular expressions th...

Regular Expression Denial of Service (ReDoS)

Overview Affected versions of this package are vulnerable to Regular Expression Denial of Service ReDoS via the matches, matchesFull, and replaceMatches functions in FHIRPath expression evaluation. An attacker can exhaust system CPU resources by submitting specially crafted regular expressions th...

Regular Expression Denial of Service (ReDoS)

Overview Affected versions of this package are vulnerable to Regular Expression Denial of Service ReDoS via the matches, matchesFull, and replaceMatches functions in FHIRPath expression evaluation. An attacker can exhaust system CPU resources by submitting specially crafted regular expressions th...

GHSA-7CMJ-V6X8-FRVV org.hl7.fhir.core: ReDoS via FHIRPath matches()/replaceMatches() in FHIR Validator HTTP Endpoint

Summary All implementations of FHIRPathEngine accept arbitrary FHIRPath expressions and evaluate them without input validation. The utility intended to secure this evaluation did so incorrectly, and did not fully cover all places in which evaluation was being done. An attacker can send a resource...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the compile function. An attacker can cause excessive memory consumption by supplying a large comma-separated selector list, leading to process termination or degraded system...

io.micronaut:micronaut-function-client (2.0.3), io.micronaut:micronaut-tracing (2.0.3) potentially affected by unknown CVE via io.micronaut:micronaut-http-client (2.0.3)

io.micronaut:micronaut-http-client MAVEN version 2.0.3 is affected by a known vulnerability. The following packages have a transitive dependency on io.micronaut:micronaut-http-client and may be impacted: - io.micronaut:micronaut-function-client 2.0.3 - io.micronaut:micronaut-tracing 2.0.3 Source...

io.eventuate.messaging.http:eventuate-tram-consumer-http-micronaut (0.2.0.release), io.micronaut.kubernetes:micronaut-kubernetes-discovery-client (>=1.0.2, <=1.0.3) +3 more potentially affected by unknown CVE via io.micronaut:micronaut-http-client (1.2.4)

io.micronaut:micronaut-http-client MAVEN version 1.2.4 is affected by a known vulnerability. The following packages have a transitive dependency on io.micronaut:micronaut-http-client and may be impacted: - io.eventuate.messaging.http:eventuate-tram-consumer-http-micronaut 0.2.0.release -...

io.micronaut:micronaut-discovery-client (1.1.0.m2), io.micronaut:micronaut-function-client (1.1.0.m2) +1 more potentially affected by unknown CVE via io.micronaut:micronaut-http-client (1.1.0.m2)

io.micronaut:micronaut-http-client MAVEN version 1.1.0.m2 is affected by a known vulnerability. The following packages have a transitive dependency on io.micronaut:micronaut-http-client and may be impacted: - io.micronaut:micronaut-discovery-client 1.1.0.m2 - io.micronaut:micronaut-function-clien...

io.micronaut:micronaut-function-client (2.5.2), io.micronaut:micronaut-tracing (2.5.2) potentially affected by unknown CVE via io.micronaut:micronaut-http-client (2.5.2)

io.micronaut:micronaut-http-client MAVEN version 2.5.2 is affected by a known vulnerability. The following packages have a transitive dependency on io.micronaut:micronaut-http-client and may be impacted: - io.micronaut:micronaut-function-client 2.5.2 - io.micronaut:micronaut-tracing 2.5.2 Source...

io.micronaut.configuration:micronaut-aws-common (1.0.0), io.micronaut.configuration:micronaut-netflix-ribbon (1.0.0) +3 more potentially affected by unknown CVE via io.micronaut:micronaut-http-client (1.0.0)

io.micronaut:micronaut-http-client MAVEN version 1.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on io.micronaut:micronaut-http-client and may be impacted: - io.micronaut.configuration:micronaut-aws-common 1.0.0 -...

info.novatec:micronaut-camunda-bpm-feature (0.6.0), io.micronaut:micronaut-function-client (2.1.0) +1 more potentially affected by unknown CVE via io.micronaut:micronaut-http-client (2.1.0)

io.micronaut:micronaut-http-client MAVEN version 2.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on io.micronaut:micronaut-http-client and may be impacted: - info.novatec:micronaut-camunda-bpm-feature 0.6.0 - io.micronaut:micronaut-function-client...