512 matches found
CVE-2026-22686 Sandbox Escape via Host Error Prototype Chain in enclave-vm
Enclave is a secure JavaScript sandbox designed for safe AI agent code execution. Prior to 2.7.0, there is a critical sandbox escape vulnerability in enclave-vm that allows untrusted, sandboxed JavaScript code to execute arbitrary code in the host Node.js runtime. When a tool invocation fails,...
CVE-2026-22686
The CVE-2026-22686 issue affects enclave-vm prior to version 2.7.0. A sandbox escape exists when a tool invocation fails and a host-side Error object is leaked into the sandbox, allowing traversal of the host realm prototype chain to reach the host Function constructor. This enables arbitrary cod...
CVE-2026-22686 Sandbox Escape via Host Error Prototype Chain in enclave-vm
Enclave is a secure JavaScript sandbox designed for safe AI agent code execution. Prior to 2.7.0, there is a critical sandbox escape vulnerability in enclave-vm that allows untrusted, sandboxed JavaScript code to execute arbitrary code in the host Node.js runtime. When a tool invocation fails,...
CVE-2026-22686 Sandbox Escape via Host Error Prototype Chain in enclave-vm
Enclave is a secure JavaScript sandbox designed for safe AI agent code execution. Prior to 2.7.0, there is a critical sandbox escape vulnerability in enclave-vm that allows untrusted, sandboxed JavaScript code to execute arbitrary code in the host Node.js runtime. When a tool invocation fails,...
CVE-2026-20935
Untrusted pointer dereference in Windows Virtualization-Based Security VBS Enclave allows an unauthorized attacker to disclose information locally...
CVE-2026-20938
Untrusted pointer dereference in Windows Virtualization-Based Security VBS Enclave allows an authorized attacker to elevate privileges locally...
CVE-2026-20935
Untrusted pointer dereference in Windows Virtualization-Based Security VBS Enclave allows an unauthorized attacker to disclose information locally...
CVE-2026-20938
Untrusted pointer dereference in Windows Virtualization-Based Security VBS Enclave allows an authorized attacker to elevate privileges locally...
CVE-2026-20876
Heap-based buffer overflow in Windows Virtualization-Based Security VBS Enclave allows an authorized attacker to elevate privileges locally...
CVE-2026-20876
Heap-based buffer overflow in Windows Virtualization-Based Security VBS Enclave allows an authorized attacker to elevate privileges locally...
CVE-2026-20819
Untrusted pointer dereference in Windows Virtualization-Based Security VBS Enclave allows an authorized attacker to disclose information locally...
CVE-2026-20819
Untrusted pointer dereference in Windows Virtualization-Based Security VBS Enclave allows an authorized attacker to disclose information locally...
CVE-2026-20935
Untrusted pointer dereference in Windows Virtualization-Based Security VBS Enclave allows an unauthorized attacker to disclose information locally...
CVE-2026-20935
This CVE (CVE-2026-20935) describes an information-disclosure vulnerability in Windows 11 VBS Enclave due to an untrusted pointer dereference. A local attacker could disclose data via the VBS Enclave. Affected product: Windows 11 (versions 23H2, 24H2, 25H2) with VBS Enclave. Root cause is a untru...
CVE-2026-20938 Windows Virtualization-Based Security (VBS) Enclave Elevation of Privilege Vulnerability
...
CVE-2026-20938
Untrusted pointer dereference in Windows Virtualization-Based Security VBS Enclave allows an authorized attacker to elevate privileges locally...
CVE-2026-20938
CVE-2026-20938 is a local elevation-of-privilege in Windows VBS Enclave caused by an untrusted pointer dereference. Affected: Windows 11 VBS Enclave implementations. Impact per sources: local privilege escalation with high confidentiality/integrity/availability impact (CVSS 7.8). Remediation: Mic...
CVE-2026-20938 Windows Virtualization-Based Security (VBS) Enclave Elevation of Privilege Vulnerability
...
CVE-2026-20876
CVE-2026-20876 is a heap-based buffer overflow in Windows Virtualization-Based Security (VBS) Enclave that enables a locally authorized attacker to elevate privileges. The vulnerability targets the VBS Enclave component and can lead to total compromise of the host if exploited. Microsoft has publ...