678 matches found
Malicious code in massive (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 02d8dea3e47a2bd45fc796f33fc582956aec2be887add9672fd5eccc91c2135d Package self-describes as the 'Official Massive formerly Polygon.io REST and Websocket client,' a false rebrand claim — Polygon.io has not changed...
Malicious code in polygon-toolkit-validate (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 77c6fa5fc2aa45c8649c09e54e0f5b318b096a78a133380d18d5379621ba819c The package presents a Polygon/Polymarket validation/crypto utility but its exported APIs silently relay caller data to a hardcoded remote endpoint. ...
Malicious code in martinez-polygon-clipping-tony (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dabf04b2f99e28eb10740bd7459bf64513fac98a064b60071b1e7aabf8674dd0 Package name impersonates the legitimate martinez-polygon-clipping library: README, badges, and API surface are copied verbatim, while repository...
BIT-PILLOW-2026-42309 Pillow: Heap buffer overflow with nested list coordinates
Pillow is a Python imaging library. From version 11.2.1 to before version 12.2.0, passing nested lists as coordinates to APIs that accept coordinates such as ImagePath.Path, ImageDraw.ImageDraw.polygon and ImageDraw.ImageDraw.line could cause a heap buffer overflow, as nested lists were recursive...
PYSEC-2026-2251
Pillow is a Python imaging library. From version 11.2.1 to before version 12.2.0, passing nested lists as coordinates to APIs that accept coordinates such as ImagePath.Path, ImageDraw.ImageDraw.polygon and ImageDraw.ImageDraw.line could cause a heap buffer overflow, as nested lists were recursive...
GHSA-5XMW-VC9V-4WF2 Pillow has a heap buffer overflow with nested list coordinates
Passing nested lists as coordinates to APIs that accept coordinates such as ImagePath.Path, ImageDraw.ImageDraw.polygon and ImageDraw.ImageDraw.line could cause a heap buffer overflow, as nested lists were recursively unpacked beyond the allocated buffer. Coordinate lists are now validated to...
Canva Affinity EMF File EMR_POLYGON Count Out-Of-Bounds Read Vulnerability
Talos Vulnerability Report TALOS-2025-2320 Canva Affinity EMF File EMRPOLYGON Count Out-Of-Bounds Read Vulnerability March 17, 2026 CVE Number CVE-2025-65119 SUMMARY An out-of-bounds read vulnerability exists in the EMF functionality of Canva Affinity. By using a specially crafted EMF file, an...
MAL-2026-1333 Malicious code in polygon-gamma-api (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dbe3f588073fea9d33a70fcdffbe2466af2886a8bf5227c8e3256235aca46899 The package polygon-gamma-api was found to contain malicious code. Source: ghsa-malware...
Malicious code in polygon-gamma-api (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dbe3f588073fea9d33a70fcdffbe2466af2886a8bf5227c8e3256235aca46899 The package polygon-gamma-api was found to contain malicious code. Source: ghsa-malware...
Malicious Package
Overview polygon-gamma-api is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...
Malicious code in polygon-bitquery-api (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c1d6daf4d1c0048da15a68fd80e8793122e363078d90c68f3d596760c5ca0156 The package polygon-bitquery-api was found to contain malicious code. Source: ghsa-malware...
Malicious Package
Overview polygon-bitquery-api is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...
MAL-2026-1204 Malicious code in polygon-bitquery-api (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c1d6daf4d1c0048da15a68fd80e8793122e363078d90c68f3d596760c5ca0156 The package polygon-bitquery-api was found to contain malicious code. Source: ghsa-malware...
New Aeternum C2 Botnet Evades Takedowns via Polygon Blockchain
Qrator Research Lab has identified Aeternum C2, a botnet that uses the Polygon blockchain for commands, making it nearly impossible to shut down...
Aeternum C2 Botnet Stores Encrypted Commands on Polygon Blockchain to Evade Takedown
Cybersecurity researchers have disclosed details of a new botnet loader called Aeternum C2 that uses a blockchain-based command-and-control C2 infrastructure to make it resilient to takedown efforts. "Instead of relying on traditional servers or domains for command-and-control, Aeternum stores it...
EUVD-2025-206810
Stored Cross-Site Scripting XSS vulnerability type in Apidog in the version 2.7.15, where SVG image uploads are not properly sanitized. This allows attackers to embed malicious scripts in SVG files by sending a POST request to '/api/v1/user-avatar', which are then stored on the server and execute...
MAL-2025-192575 Malicious code in polygon-src (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2b975bdc3690d0deccba20490d0c56eec9e073ff48c7f949d5c9554489445ff2 The package polygon-src was found to contain malicious code. Source: ghsa-malware f3e7ff8566f8fc6fd21a8bcad4e3d2684026f6e9eb0a5ac2ccff5d46112ac99e An...
Malicious code in polygon-src (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2b975bdc3690d0deccba20490d0c56eec9e073ff48c7f949d5c9554489445ff2 The package polygon-src was found to contain malicious code. Source: ghsa-malware f3e7ff8566f8fc6fd21a8bcad4e3d2684026f6e9eb0a5ac2ccff5d46112ac99e An...
Malicious Package
Overview polygon-src is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorshi...