Malicious code in ng-search-api (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 095a335a93f1ebe0047f2cdf56c2d52551d7c8602ade2e850486a6e19f514545 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in polygon-gama-apis (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f0e5efa9d57dae04a6082dfa776d2c2664f3ce5a838ed9cf56f40656937b7e92 polygon-gama-apis exports getPlugin, which fetches JSON from https://bet.slotgambit.com/icons/111 and passes the response field data.credits directly...

MAL-2026-10111 Malicious code in nodepack-daemon (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b976e6ab638a52663d25f360bffec6706dc82991ad27c552788a5a4d785ff89f The package presents itself as the popular pino logger README badges, file layout mirroring pino's lib/proto.js, lib/redaction.js, lib/transport.js,...

PYSEC-2026-2814 Out-of-bounds Write in OpenCV.

In OpenCV 3.3.1 corresponding with OpenCV-Python 3.3.1.11, a heap-based buffer overflow happens in cv::Jpeg2KDecoder::readComponent8u in modules/imgcodecs/src/grfmtjpeg2000.cpp when parsing a crafted image file...

PYSEC-2026-2796 Out-of-bounds Write in OpenCV

In opencv calls that use libpng, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges required. User interaction is not required for exploitation. Product: AndroidVersions: Android-10Android...

PYSEC-2026-2833 Out-of-bounds Read in OpenCV

OpenCV 4.1.1 has an out-of-bounds read in halbaseline::vload in core/hal/intrinsse.hpp when called from computeSSDMeanNorm in modules/video/src/disflow.cpp...

Out-of-bounds Read in OpenCV

An out-of-bounds read was discovered in OpenCV before 4.1.1 OpenCV-Python before 4.1.0.25. Specifically, variable coarsestscale is assumed to be greater than or equal to finestscale within the calc/oclcalc functions in disflow.cpp. However, this is not true when dealing with small images, leading...

PYSEC-2026-2837 Out-of-bounds Read and Out-of-bounds Write in OpenCV

An issue was discovered in OpenCV before 3.4.7 and 4.x before 4.1.1 OpenCV-Python before 3.4.7.28 and 4.x before 4.1.1.26. There is an out of bounds read/write in the function HaarEvaluator::OptFeature::calc in modules/objdetect/src/cascadedetect.hpp, which leads to denial of service...

PYSEC-2026-2810 Out-of-bounds Read in OpenCV

In OpenCV 3.3.1 corresponding with OpenCV-Python 3.3.1.11, a heap-based buffer over-read exists in the function cv::HdrDecoder::checkSignature in modules/imgcodecs/src/grfmthdr.cpp...

PYSEC-2026-2805 Out-of-bounds Read in OpenCV

OpenCV Open Source Computer Vision Library through 3.3 corresponding to OpenCV-Python 3.3.0.9 has an out-of-bounds read error in the cv::RBaseStream::readBlock function in modules/imgcodecs/src/bitstrm.cpp when reading an image file by using cv::imread, as demonstrated by the...

PYSEC-2026-2815 Out-of-bounds Write in OpenCV

OpenCV Open Source Computer Vision Library through 3.3 corresponding to OpenCV-Python and OpenCV-Contrib-Python 3.3.0.9 has an out-of-bounds write error in the FillUniColor function in utils.cpp when reading an image file by using cv::imread...

MAL-2026-10015 Malicious code in poc-node-npm (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 1b010fdf55177f6b23e6c31ef24746e64ea73a1783480a2e207c9bfddcc9e46e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-10010 Malicious code in feedback-api (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b010aedb75591ab2ecad503373bbb8f0bb2bd98637c2e7c68aff89ec3ab26a1b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in qlkube (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 51bbdab9d33c291290e2f871acd2ebf7bf64c2c66c5124592055669771b6301e The package's package.json declares a preinstall lifecycle script that runs curl https://cwcie03pzedo62twgbs3x6e9l0rsfk39.oastify.com on npm install...

Malicious code in tailwind-core (npm)

The npm package tailwind-core versions 4.3.1 and 4.3.2 contain remote code execution payloads hidden in the exported Tailwind-style runtime. The package root export reaches code that fingerprints the host, communicates with attacker-controlled Google Apps Script/Drive or Sheets resources, decodes...

MAL-2026-6965 Malicious code in na-rony-test (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 73b485b2a162e7940eb348df343cb7bc4a1a84ab2533e71df742204df778e4b5 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-6963 Malicious code in karem-dp (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c16a2d6eecaab10a4c75e9b3b79f0c63c202b8acc31fd1d47a3651c7fa3cf10f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in na-rony-test-karem (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware cd6a8602ce62a88124613cbe7eb85e19a1ae122a0ee98c71676fe4969359888f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in gas-log (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 36241e999d92bad738082bf420fc144391735f9f3707bc4baa0153b4cb0eec8a gas-log impersonates the legitimate eth-gas-reporter package: it reuses that project's README, keywords, badges, and CHANGELOG, and the README even...

MAL-2026-6957 Malicious code in nodemon-node (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3900c92378db76295f8a47683d86e58b24625758b938f4cd89ac779f86ed5260 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...