ROOT-APP-NPM-CVE-2026-47137 CVE-2026-47137 in @rootio/vm2 - Patched by Root

Root has patched CVE-2026-47137 in the @rootio/vm2 package for Root:npm. Multiple fixed versions available...

CVE-2026-47137

creationtimestamp| type| source ---|---|--- 2026-06-14 08:00:32+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3moachcwmfn2c 2026-07-09 07:52:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mq75n7h44f2r...

CVE-2026-47137 vm2: GHSA-8hg8-63c5-gwmx patch bypass: nesting:true without explicit require still allows full RCE

vm2 is an open source vm/sandbox for Node.js. Prior to version 3.11.4, the fix for GHSA-8hg8-63c5-gwmx CVE-2023-37903 introduced a check in nodevm.js line 263 that blocks the combination nesting: true + require: false. However, the check uses strict equality options.require === false, which is...

@accordproject/cicero-cli (>=0.3.4, <=0.24.1-20231019080841), @accordproject/cicero-core (>=0.12.5-20190619040852, <=0.24.1-20230627140514) +288 more potentially affected by CVE-2026-47137 via vm2 (>=3.0.0, <=3.11.3)

vm2 NPM version =3.0.0, =0.3.4, =0.12.5-20190619040852, =0.3.12-20180525105709, =0.3.4, =0.11.2-20190326183124, =0.22.2-20210714131804, =0.0.51-20180524154814, =0.0.51-20180524154814, =0.7.4-20190326150718, =2.0.0-rc.8.0.29, =0.1.0, =2.1.1, =0.1.1, =1.0.0, =1.4.0 and more Source cves:...

@accordproject/cicero-cli (>=0.3.4, <=0.24.1-20231019080841), @accordproject/cicero-core (>=0.12.5-20190619040852, <=0.24.1-20230627140514) +288 more potentially affected by CVE-2026-47137 via vm2 (>=3.0.0, <=3.11.3)

vm2 NPM version =3.0.0, =0.3.4, =0.12.5-20190619040852, =0.3.12-20180525105709, =0.3.4, =0.11.2-20190326183124, =0.22.2-20210714131804, =0.0.51-20180524154814, =0.0.51-20180524154814, =0.7.4-20190326150718, =2.0.0-rc.8.0.29, =0.1.0, =2.1.1, =0.1.1, =1.0.0, =1.4.0 and more Source cves:...

EUVD-2025-47137

Malicious code in indah-sego36-sukiwir npm...

CVE-2022-47137

Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in WPManageNinja LLC Ninja Tables plugin = 4.3.4 versions...

CVE-2024-47137

creationtimestamp| type| source ---|---|--- 2024-11-05 09:40:45+00:00| seen| https://t.me/cvedetector/9826 2026-07-16 20:37:06+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mqs3nnfqng2u...

CVE-2024-47137 Liteos_a has an out-of-bounds Write vulnerability

in OpenHarmony v4.1.0 and prior versions allow a local attacker cause the common permission is upgraded to root and sensitive information leak through out-of-bounds write...

CVE-2024-47137 Liteos_a has an out-of-bounds Write vulnerability

in OpenHarmony v4.1.0 and prior versions allow a local attacker cause the common permission is upgraded to root and sensitive information leak through out-of-bounds write...

CVE-2024-47137

CVE-2024-47137 affects OpenHarmony v4.1.0 and earlier. The issue is an out-of-bounds write in the affected component that enables a local attacker to elevate privileges to root and cause a sensitive information leak. Publicly documented across multiple sources (NVD/Red Hat/CVE lists) confirm loca...

CVE-2021-47137

In the Linux kernel, the following vulnerability has been resolved: net: lantiq: fix memory corruption in RX ring In a situation where memory allocation or dma mapping fails, an invalid address is programmed into the descriptor. This can lead to memory corruption. If the memory allocation fails,...

CVE-2021-47137

In the Linux kernel, the following vulnerability has been resolved: net: lantiq: fix memory corruption in RX ring In a situation where memory allocation or dma mapping fails, an invalid address is programmed into the descriptor. This can lead to memory corruption. If the memory allocation fails,...

CVE-2021-47137

In the Linux kernel, the following vulnerability has been resolved: net: lantiq: fix memory corruption in RX ring In a situation where memory allocation or dma mapping fails, an invalid address is programmed into the descriptor. This can lead to memory corruption. If the memory allocation fails,...

CVE-2021-47137 net: lantiq: fix memory corruption in RX ring

In the Linux kernel, the following vulnerability has been resolved: net: lantiq: fix memory corruption in RX ring In a situation where memory allocation or dma mapping fails, an invalid address is programmed into the descriptor. This can lead to memory corruption. If the memory allocation fails,...

CVE-2022-47137

creationtimestamp| type| source ---|---|--- 2023-05-10 14:14:16+00:00| seen| https://t.me/cibsecurity/63731...

CVE-2022-47137

Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in WPManageNinja LLC Ninja Tables plugin = 4.3.4 versions...

CVE-2022-47137

CVE-2022-47137 affects the Ninja Tables WordPress plugin (WPManageNinja Ninja Tables) up to version 4.3.4. The issue is an admin+ authenticated Stored XSS caused by insufficient sanitization/escaping of plugin settings. The vulnerability could allow an attacker with admin privileges to inject arb...

WordPress Ninja Tables Plugin <= 4.3.4 is vulnerable to Cross Site Scripting (XSS)

Software Ninja Tables Type Plugin Vulnerable versions = 4.3.4 Fixed in 4.3.5 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2022-47137 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID 1abe583c6f01 Credits Muhammad Daffa Required...

YCCMS suffers from a file upload vulnerability (CNVD-2021-47137)

YCCMS is a PHP version of a lightweight CMS builder. YCCMS has a file upload vulnerability that can be exploited by attackers to gain server control privileges...