CVE-2026-92939: Process Control

vm2 3.11.3 through 3.11.6 exposes the host Node.js crypto module to a NodeVM sandbox when the crypto builtin is allowed. The module is presented via a recursive read-only proxy, but its callable exports still execute with host-process authority. Sandboxed JavaScript can therefore call...

CVE-2026-92937: Improper Control of Generation of Code

vm2 3.11.6 is vulnerable to a sandbox escape leading to remote code execution in the host Node.js process. The fix for GHSA-m283-3h24-438v is incomplete: the bridge gate at lib/bridge.js:1624 identity-checks only the direct call target when deciding whether to rebuild/sanitise a rejected host...

CVE-2026-92935: Improper Control of Dynamically-Managed Code Resources

vm2 is a sandbox for running untrusted Node.js code. In versions = 3.11.4 and = 3.11.6, the NodeVM constructor computes hasRealRequireConfig with typeof requireOpts === 'object' && requireOpts !== null, so an array-shaped require value for example require: satisfies the guard that is meant to...

ALSA-2026:68549 Important: firefox security update

Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability. Security Fixes: firefox: thunderbird: Privilege escalation in the DOM: Workers component CVE-2026-16365 firefox: thunderbird: Sandbox escape in the Remote Settings Client component...

Important: firefox security update

Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability. Security Fixes: firefox: thunderbird: Privilege escalation in the DOM: Workers component CVE-2026-16365 firefox: thunderbird: Sandbox escape in the Remote Settings Client component...

CVE-2026-25280: Out-of-bounds Write

Memory corruption when processing escape handling flow with insufficient user buffer sizes...

CVE-2026-90231: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: apparmor: fix unconfined user namespace restriction forced stack If a task is already confined by a stack the unprivileged transition restriction on unconfined is not correctly, applied. This results in an escape if two transitio...

CVE-2026-92950: Insecure Default Variable Initialization

vm2 before 3.11.7 contains a sandbox escape vulnerability in the CLI tool that allows attackers to execute arbitrary code in the host Node.js process. Attackers can supply a malicious script file to the vm2 CLI that uses requirefilename to re-execute itself in the host realm, bypassing sandbox...

CVE-2026-92952: Incorrect Resource Transfer Between Spheres

vm2 versions 3.11.4 through 3.11.6 incompletely filter Node.js registered internal symbols across the sandbox boundary. The extraction filters in lib/setup-sandbox.js and the cross-realm symbol checks and write traps in lib/bridge.js use a fixed list of known dangerous registered symbols that omi...

CVE-2026-92934: Protection Mechanism Failure

vm2 before 3.11.8 contains an incomplete fix for Error.cause sanitization that allows sandbox escape when revisited host-wrapped AggregateError objects are caught within a single exception handler traversal. Attackers can exploit cycle detection bypass in handleException to access unsanitized hos...

Linux Distros Unpatched Vulnerability : CVE-2026-76825

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - RestrictedPython is a tool that helps define a subset of the Python language for accepting program input in a trusted environment. Prior to 8.4, RestrictedPytho...

CVE-2026-92948: Protection Mechanism Failure

vm2 versions = 3.9.6 and = 3.11.6 are affected by a NodeVM builtin allowlist bypass that permits a sandbox escape on Node.js 24 and newer when the embedder explicitly allows the node:test builtin e.g. require: builtin: 'node:test' . On Node.js 24+, module.builtinModules exposes the scheme-only ke...

CVE-2026-92587

n8n is a workflow automation platform. In versions before 1.123.76, 2.37.7, and 2.38.2, the Git node validated a relative remote URL against the configured repositoryPath but then invoked git with that path as its working directory; git walked up to the enclosing repository's top level and resolv...

CVE-2026-92587 n8n before 1.123.76 Sandbox Escape via Git Relative URL

n8n is a workflow automation platform. In versions before 1.123.76, 2.37.7, and 2.38.2, the Git node validated a relative remote URL against the configured repositoryPath but then invoked git with that path as its working directory; git walked up to the enclosing repository's top level and resolv...

CVE-2026-92587 n8n before 1.123.76 Sandbox Escape via Git Relative URL

n8n is a workflow automation platform. In versions before 1.123.76, 2.37.7, and 2.38.2, the Git node validated a relative remote URL against the configured repositoryPath but then invoked git with that path as its working directory; git walked up to the enclosing repository's top level and resolv...

CVE-2026-92587 n8n before 1.123.76 Sandbox Escape via Git Relative URL

n8n is a workflow automation platform. In versions before 1.123.76, 2.37.7, and 2.38.2, the Git node validated a relative remote URL against the configured repositoryPath but then invoked git with that path as its working directory; git walked up to the enclosing repository's top level and resolv...

CVE-2026-92587

n8n (workflow automation platform) contains a sandbox escape in its Git node affecting versions before 1.123.76 , 2.37.7 , and 2.38.2 . The root cause is a validation/resolution mismatch: a relative remote URL is checked against the configured repositoryPath, but git actually resolves it from its...

Container_escape

Linux container escape PoCs Target-specific proof-of-concept...

CVE-2026-92018

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Sandbox escape in the DOM: Core & HTML component...

CVE-2026-86071 Junrar: LocalFolderExtractor mkdir escape allows directory creation outside extraction root

Junrar is an open source Java RAR archive library. Prior to version 7.6.1, LocalFolderExtractor in src/main/java/com/github/junrar/LocalFolderExtractor.java can create directories outside the intended extraction root when processing a crafted archive entry. LocalFolderExtractor.createFile validat...