Malware in ionic-youtube-streams

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malware in ionic-insta-search

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malware in appit-cordova-admob

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malware in ionic-youtube-search

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malware in cordova-plugin-geofence-appit

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malware in cert-infos

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malware in p12-pem

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malicious code in @eforms/forms-api (npm)

Source: ossf-package-analysis cbe6ac9c18c859c04807fb2bd866f2eda2b70a4aa2583096b7138ab2adc90540 The OpenSSF Package Analysis project identified '@eforms/forms-api' @ 2.0.0-SNAPSHOT npm as malicious. It is considered malicious because: - The package communicates with a domain associated with...

Malware in tailwind-base-buttons

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malware in noelc-css-blender

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malware in tailwindcss-theme-kit

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malware in overarch-windows-x64-yr

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malware in @liauto/win32-x64

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

filelock: ReadWriteLock on the hard-link route deletes any directory another user renames onto its .filelock-* link directory name

ReadWriteLock and AsyncReadWriteLock the SQLite-backed reader/writer lock remove their private .filelock- link directories with shutil.rmtree a recursive delete on a remembered path. They do not check that the path still names the directory they created. This happens on the hard-link route a hard...

filelock: ReadWriteLock on Windows acts on SQLite side files another local user places beside its database

On Windows, ReadWriteLock and AsyncReadWriteLock the SQLite-backed reader/writer lock connect SQLite to the lock database by its path, in every directory. SQLite derives three side files from that path: -journal, the rollback journal pages saved to undo an interrupted write; -wal, the write-ahead...

filelock: On Windows an oplock on a soft lock's marker holds SoftFileLock.acquire() past its timeout and blocks the stale break

On Windows the soft locks SoftFileLock, MarkerSoftFileLock, SoftFileLease, their async forms, and a FileLock that fell back to a soft lock read their marker by path. The marker is the lock file whose presence says a process holds the lock. Each acquire attempt that finds a marker opens it with...

virtualenv: Temporary app-data can leave dangling seed package links

Summary The app-data seeder can leave an environment linked to temporary package files that virtualenv deletes when creation finishes. The environment-variable and configuration-file forms of symlinkappdata can enable this state even though the command-line flag is disabled for temporary app-data...

virtualenv: Pip seeding with download omits wheel digest verification

Summary The pip seeder acquires bundled wheels with download=False and lets pip access the index when --download is selected. Index candidates on that path do not pass through virtualenv's wheel digest verification. Anthropic's OSS Scanner reported this as ANT-2026-74ALJBUF in...

virtualenv: Downloaded wheel selection and caching precede verification

Summary Wheel downloads go directly into the reusable wheelhouse, while the verification target is selected from pip's textual output. A verification failure does not remove the downloaded file from that cache. Anthropic's OSS Scanner reported this as ANT-2026-ST00DRO3 in virtualenv-20261015-005,...

virtualenv: Xonsh activation literals depend on the script decoding codec

Summary Caller-supplied prompt text can become executable syntax in the xonsh activation script. An attacker must influence the value passed to virtualenv, and a user must subsequently activate the environment. Affected area Xonsh reads a UTF-8 activation script using a legacy multibyte encoding...

virtualenv: Seeded files retain permissions from an older cache

Summary The app-data copy seeder uses shutil.copy, which preserves cached file modes independently of the current umask. A cache populated under permissive permissions can therefore produce files with wider access in later environments. Anthropic's OSS Scanner reported this as ANT-2026-487MH6OW i...

virtualenv: Bash prompt values can change meaning under older compatibility modes

Summary Caller-supplied prompt text can become executable syntax in the bash activation prompt. An attacker must influence the value passed to virtualenv, and a user must subsequently activate the environment and draw the prompt. Affected area Bash runs with compatibility level 4.2 and draws the...

virtualenv: Venv configuration readback can reinterpret path boundaries

Summary The venv creator reads the standard library's generated pyvenv.cfg with splitlines and merges all resulting keys over virtualenv's configuration. Line-boundary characters from destination data can therefore become configuration structure before output sanitization. Anthropic's OSS Scanner...

virtualenv: Seed replacement does not contain metadata deletion paths

Summary The app-data seeder joins paths from existing distribution metadata to site-packages and deletes the resulting paths without checking containment within the environment. Anthropic's OSS Scanner reported this as ANT-2026-SXOEHWP7 in virtualenv-20261015-005, received on 15 October 2026...

MSAL Node authorization code flow may disclose parameters to an attacker-controlled endpoint

Impact Origin validation error in Microsoft Authentication Library MSAL for Node.js allows an unauthorized attacker to disclose information over a network. This affects the authcode flow. Patches Version 7.1.0 and higher are patched. Workarounds Ensure you pass in only the authcode to to...

undici vulnerable to Denial of Service via unhandled error on excessive content-encodings

Impact undici's fetch crashes the Node.js process when a malicious server returns a response with more than five content codings and closes the connection before sending the body. undici rejects such responses a content-encoding limit, but it created the internal response stream before that check...

undici vulnerable to Denial of Service via unbounded memory in the EventSource parser

Impact undici's EventSource client can be driven to exhaust process memory by a malicious or compromised Server-Sent Events peer. By sending millions of tiny completed data: fields with no blank event separator, or a single unfinished line split across many chunks, the parser retains a growing...

undici vulnerable to Subresource Integrity bypass via non-lowercase algorithm tokens

Impact undici's fetch verifies Subresource Integrity SRI metadata by looking up the algorithm token in a lowercase-only set, but the SRI specification defines a valid token by its ASCII-lowercase form. A correct but non-lowercase token such as SHA256-... or Sha256-... is therefore treated as...

Serialize JavaScript: Cross-site scripting (XSS) via unescaped </script at the end of a serialized function body

Impact serialize-javascript escapes its output so it is safe to embed inside a element. Before 7.1.3 that guarantee did not hold for a function value whose source ends in a bare . A body ending exactly at followed by markup: js const serialize = require'serialize-javascript'; function f f.toStrin...

multer vulnerable to Denial of Service via a pending asynchronous fileFilter after request teardown

Impact When multer is configured with an asynchronous fileFilter, a single request can crash the Node.js process. If a request is aborted for example when one file is rejected while another file's async fileFilter is still pending, the pending callback later resumes a parsing stream that multer h...

MLflow: SSRF on unauthenticated MLflow servers via third-party scorer kwargs in the scorer invoke, register, and GenAI evaluate endpoints

Summary MLflow's tracking server exposes POST /ajax-api/3.0/mlflow/scorer/invoke with no authentication, and the handler reflectively instantiates an attacker-named class from attacker-supplied JSON with unconstrained constructor kwargs. With the optional trulens + trulens-providers-litellm...

LangGraph: Namespace labels containing `.` reach other namespaces in Postgres and SQLite stores

Summary The Postgres and SQLite stores save a namespace as its labels joined with ., so "tenant", "bob" and "tenant.bob", map to the same stored namespace. put rejected labels containing ., but get, search, delete, listnamespaces, their async versions, and ops passed directly to batch/abatch did...

Happy DOM: Incomplete fix for CVE-2026-33943: unsanitized import alias leads to host code execution

Summary The ESM compiler in [email protected] does not validate imported local binding aliases before interpolating them into generated JavaScript. As a result, an invalid ESM import alias can be transformed into a valid JavaScript destructuring default initializer and executed. This appears to b...

Malware in @k18k/entrypoint-sdk-darwin-arm64

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Wasmtime: Panic lowering a host-created component model stream into a guest that expects a different payload type

Summary Wasmtime may panic when the host lowers a component model stream or future into a guest, if the host created that stream or future with one payload type and the guest expects a different one. This can happen when an embedder creates a stream or future, passes it through a guest, receives ...

Wasmtime: Bit-packing in Cranelift compiler causes silent overflow and miscompilation

Summary In Wasmtime prior to v43, the Cranelift compiler backend bit-packs its SSA value indices in a way that can result in silent overflow in release builds, and result in incorrect value references in the IR resulting in arbitrary miscompilation. A very large Wasm function body, or one that is...

filelock: SoftFileLock evicts a fresh lock file whose watched age another local user's pre-dated file passed on through inode reuse

SoftFileLock and MarkerSoftFileLock evict an unparsable marker the lock file at , whose presence says a process holds the lock once a waiting contender has watched it unchanged for two seconds. SoftFileLease expires a lease the same way. The watch tells two looks apart by the marker's modificatio...

filelock: SoftFileLock stale-break restore follows a swapped-in symbolic link and hard-links a file of the user running the lock into the lock directory

When a soft-lock stale break finds that the marker the lock file at it renamed aside was a live one recreated by a successor, the restore branch of breaklockfile checks the break name with lstat a check that reads a name without following a symbolic link and then calls os.linkbreakpath, lockfile ...

filelock ReadWriteLock: SQLite reopens the lock database by name, so a planted symlink or journal file makes the lock user's process overwrite or unlink its own files

ReadWriteLock and AsyncReadWriteLock the SQLite-backed reader/writer lock hand SQLite a name they do not control. On Linux the lock validates its database through a descriptor the number the kernel gives a process for an open file. It then connects SQLite to /proc/self/fd/, a Linux path that name...

Fallow: A `.*` glob segment let an analyzed repository make Fallow test paths in the parent of the project root

Impact Fallow expands some globs from the analyzed repository on disk. Before 3.34.0, a segment such as ., .? or .. in such a glob also matched the special .. entry. The glob crate tests .. against a segment that starts with a literal .. Fallow validates plugin glob patterns and refuses absolute...

Fallow: Jest and Vitest `projects` entries let an analyzed repository make Fallow read files outside the project root

Impact Fallow reads the Jest and Vitest configs of the repository that it analyzes. A Jest projects entry or a Vitest test.projects entry can name a path. Fallow followed such an entry to a config file and read that file, also when the file was outside the project root. These forms reached outsid...

Pillow: Heap buffer overflow in FlashPix (FPX) JPEG decoding leads to code execution

Credits Researcher: Alex Bouffard [email protected] Summary A heap buffer overflow in Pillow's FlashPix FPX JPEG-tile decoder lets an attacker achieve arbitrary code execution by getting an application to open a single crafted file with Image.open. The file is recognized by content the OLE2...

postal-mime: Quadratic CPU consumption when decoding a header of many joinable RFC 2047 base64 encoded words

Impact Decoding a header that holds a long run of joinable RFC 2047 base64 encoded words, such as =?utf-8?B?QUJD?= repeated tens of thousands of times in a Subject, From, To, a filename or a description, took time quadratic in the number of words. The join check ran a regex over the text joined s...

Pillow: Arrow export leaks stale heap memory when PILLOW_ALIGNMENT > 1

Summary When PILLOWALIGNMENT is set above 1, exporting an image to Arrow returns uninitialized heap memory mixed in with the pixel data. That memory can include pixels from images the process freed earlier. Details With an alignment above 1, the default allocator pads each row up to alignedlinesi...

Nodemailer: A nested comment ends early in addressparser, releasing the rest of the comment as a recipient

Vulnerability summary RFC 5322 comments nest. addressparser ended a comment at the first , including the one that closes a nested comment, and parsed the rest of the outer comment as header text. Victim xy names [email protected] with xy as a comment, and Nodemailer read it as the address [email protected]...

Nodemailer: A ";" inside a quoted string or comment ends an address group early in addressparser, turning display text into a recipient

Vulnerability summary addressparser ends an RFC 5322 group at the first ;, including one inside a quoted display name or a comment. The text after it is parsed again as top level recipients with the quoting flipped, so text that every conformant parser reads as a display name or comment becomes a...

Nodemailer: A ">" inside a quoted local part ends an angle-addr early in addressparser, delivering to a domain the header does not name

Vulnerability summary addressparser ends an angle-addr at the first it sees, including one inside a quoted local part, a comment or a domain literal. The domain is then read off the text in front of that . "@good.com is the mailbox "[email protected]"@good.com under RFC 5322, and Nodemailer read it as a...

Malware in orqiva-runtime-win32-x64

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Laravel TokenGuard authentication bypass through non-string API credentials

Laravel's built-in TokenGuard, when configured with a standard token-based API guard, may be bypassed to authenticate as an arbitrary existing user without knowledge of their valid API token. Under certain database configurations MySQL/MariaDB an attacker can submit a specially crafted, non-strin...

Laravel relationship inclusion can trigger unauthorized data destruction

A vulnerability in how relationship inclusion is processed on certain read endpoints. Under specific conditions, a request to a read-only endpoint can be crafted to trigger a destructive database operation on a related table, rather than simply retrieving data. Impact A user with only read access...