CVE-2026-92970

HUBzero CMS through 2.2.32 contains a path traversal vulnerability in project file upload handlers that allows authenticated project members to write arbitrary files outside the project repository. Attackers can supply traversal sequences in upload parameters to write files to attacker-chosen pat...

CVE-2026-92957

vm2 through 3.11.6 does not normalize node:-prefixed builtin specifiers when evaluating user-supplied negative deny entries in a NodeVM wildcard require policy. Although NodeVM strips the node: prefix during require resolution, negative wildcard entries are matched by exact string comparison...

CVE-2026-92955

vm2 before 3.11.8 contains a sandbox escape vulnerability in NodeVM that allows attackers to access the host proto getter/setter through console.stdout and console.stderr. Attackers can overwrite EventEmitter.prototype.emit and trigger process events to execute code with process context, bypassin...

CVE-2026-92950

vm2 before 3.11.7 contains a sandbox escape vulnerability in the CLI tool that allows attackers to execute arbitrary code in the host Node.js process. Attackers can supply a malicious script file to the vm2 CLI that uses requirefilename to re-execute itself in the host realm, bypassing sandbox...

CVE-2026-92948

vm2 versions = 3.9.6 and therefore executes arbitrary JavaScript in an unrestricted host Node process outside the NodeVM sandbox. Fixed in vm2 3.11.7...

CVE-2026-92938

vm2 versions 3.11.3 through 3.11.6 expose Node.js's host node:sqlite module to code running in NodeVM when that builtin is permitted, either explicitly or through builtin: ''. The module is wrapped with vm.readonly, which prevents property assignment but leaves host-authority callables reachable;...

CVE-2026-92939

vm2 3.11.3 through 3.11.6 exposes the host Node.js crypto module to a NodeVM sandbox when the crypto builtin is allowed. The module is presented via a recursive read-only proxy, but its callable exports still execute with host-process authority. Sandboxed JavaScript can therefore call...

CVE-2026-92934

vm2 before 3.11.8 contains an incomplete fix for Error.cause sanitization that allows sandbox escape when revisited host-wrapped AggregateError objects are caught within a single exception handler traversal. Attackers can exploit cycle detection bypass in handleException to access unsanitized hos...

cve-2025-53770-research

cve-2025-53770-research 🚨 Threat intel & incident response research on SharePoint "ToolShell" RCE zero-day CVE-2025-53770. 🕵️‍♂️ Covers root-cause deserialization flaws, attack timelines, risk metrics, and defensive EDR validation playbooks. 🛡️ 🕵️ CVE-2025-53770 — SharePoint "ToolShell" Zero-Day...

CVE-2026-22006-XSLT-Server-Side-Injection-via-xsl-script-

CVE-2026-22006 – XSLT Server‑Side Injection via xsl:script Program Code Python + XSLT root@kitploit: xsltserver.py - Applies user-supplied XSLT to XML from lxml import etree from flask import Flask, request app = Flaskname @app.route'/transform', methods='POST' def transform: xml =...

CVE-2026-21016-Malicious-PyPI-Package-Install-Hook-setup.py-Execution-

CVE-2026-21016 – Malicious PyPI Package Install Hook setup.py Execution Program Code Python root@kitploit: setup.py - Malicious package that executes during install from setuptools import setup import os This runs on pip install os.system'id /tmp/pwnedbypackage' setup name='harmless-pkg',...

EUVD-2026-81606

vm2 through 3.11.6 does not normalize node:-prefixed builtin specifiers when evaluating user-supplied negative deny entries in a NodeVM wildcard require policy. Although NodeVM strips the node: prefix during require resolution, negative wildcard entries are matched by exact string comparison...

CVE-2026-92957 vm2 before 3.11.7 Authentication Bypass via node: Prefix

vm2 through 3.11.6 does not normalize node:-prefixed builtin specifiers when evaluating user-supplied negative deny entries in a NodeVM wildcard require policy. Although NodeVM strips the node: prefix during require resolution, negative wildcard entries are matched by exact string comparison...

CVE-2026-92957 vm2 before 3.11.7 Authentication Bypass via node: Prefix

vm2 through 3.11.6 does not normalize node:-prefixed builtin specifiers when evaluating user-supplied negative deny entries in a NodeVM wildcard require policy. Although NodeVM strips the node: prefix during require resolution, negative wildcard entries are matched by exact string comparison...

CVE-2026-92957

vm2 (a Node.js sandboxing library) through version 3.11.6 fails to normalize node:-prefixed builtin specifiers when matching negative entries in a NodeVM wildcard require policy. Because deny-list entries are compared by exact string against canonical builtin names, a policy like ['*', '-node:chi...

CVE-2026-92957 vm2 before 3.11.7 Authentication Bypass via node: Prefix

vm2 through 3.11.6 does not normalize node:-prefixed builtin specifiers when evaluating user-supplied negative deny entries in a NodeVM wildcard require policy. Although NodeVM strips the node: prefix during require resolution, negative wildcard entries are matched by exact string comparison...

CVE-2026-92955 vm2 before 3.11.8 Sandbox Escape via NodeVM

vm2 before 3.11.8 contains a sandbox escape vulnerability in NodeVM that allows attackers to access the host proto getter/setter through console.stdout and console.stderr. Attackers can overwrite EventEmitter.prototype.emit and trigger process events to execute code with process context, bypassin...

CVE-2026-92955 vm2 before 3.11.8 Sandbox Escape via NodeVM

vm2 before 3.11.8 contains a sandbox escape vulnerability in NodeVM that allows attackers to access the host proto getter/setter through console.stdout and console.stderr. Attackers can overwrite EventEmitter.prototype.emit and trigger process events to execute code with process context, bypassin...

CVE-2026-92955 vm2 before 3.11.8 Sandbox Escape via NodeVM

vm2 before 3.11.8 contains a sandbox escape vulnerability in NodeVM that allows attackers to access the host proto getter/setter through console.stdout and console.stderr. Attackers can overwrite EventEmitter.prototype.emit and trigger process events to execute code with process context, bypassin...

CVE-2026-92955

vm2 before 3.11.8 contains a sandbox escape in its NodeVM component. Attackers can reach the host __proto__ getter/setter via console._stdout and console._stderr, then overwrite EventEmitter.prototype.emit and trigger process events to execute code with process context , bypassing code generation...