Improper Privilege Management

Overview vm2 is a sandbox that can run untrusted code with whitelisted Node's built-in modules. Affected versions of this package are vulnerable to Improper Privilege Management in the require process. An attacker can gain unauthorized access to restricted filesystem operations by bypassing the...

Duplicate Advisory: vm2: NodeVM builtin denylist bypass via fs/promises despite -fs, allowing host filesystem writes

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-6rh5-qq4q-97xh. This link is maintained to preserve external references. Original Description vm2 through 3.11.6 contains a builtin-module denylist bypass in NodeVM. When the embedder uses the builtin wildcard...

Duplicate Advisory: NodeVM `require.external` without an explicit `require.root` grants unrestricted host filesystem access and full RCE

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-j3hm-6rg5-mchv. This link is maintained to preserve external references. Original Description vm2 before 3.11.7 contains a remote code execution vulnerability when require.external is enabled without an explicit...

CVE-2026-81453

Dell OpenManage Server Administrator, versions prior to 11.1.0.3, contains an Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Filesystem access for...

EUVD-2026-81618

Dell OpenManage Server Administrator, versions prior to 11.1.0.3, contains an Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Filesystem access for...

CVE-2026-81453

Dell OpenManage Server Administrator (OMSA) prior to version 11.1.0.3 is affected by a Path Traversal vulnerability that allows a low-privileged attacker with remote network access to gain filesystem access on the target system. The attack requires no user interaction and has low complexity, yiel...

CVE-2026-81453

Dell OpenManage Server Administrator, versions prior to 11.1.0.3, contains an Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Filesystem access for...

CVE-2026-81453

Dell OpenManage Server Administrator, versions prior to 11.1.0.3, contains an Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Filesystem access for...

CVE-2026-92936 vm2 3.11.0 before 3.11.7 Information Disclosure via Error Stack

vm2 versions 3.11.0 through 3.11.6 leak absolute host filesystem paths to sandboxed code through error stack formatting. Attacker-supplied code can force the host-realm source transformer to throw a SyntaxError for example by calling eval with malformed source and then read the error's .stack...

CVE-2026-81481

Dell OpenManage Server Administrator, versions prior to 11.1.0.3, contains an Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Filesystem access for...

CVE-2026-81481

Dell OpenManage Server Administrator, versions prior to 11.1.0.3, contains an Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Filesystem access for...

CVE-2026-81481

Dell OpenManage Server Administrator versions prior to 11.1.0.3 contain a Path Traversal vulnerability (improper limitation of a pathname to a restricted directory). An unauthenticated attacker with remote access could exploit this to gain filesystem access , with a HIGH confidentiality impact bu...

CVE-2026-81481

Dell OpenManage Server Administrator, versions prior to 11.1.0.3, contains an Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Filesystem access for...

EUVD-2026-81572

Dell OpenManage Server Administrator, versions prior to 11.1.0.3, contains an Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Filesystem access for...

CVE-2026-90982

@fastify/static is a Fastify plugin that serves static files from a configured root directory. In versions before 10.1.4, on a case-insensitive filesystem such as Windows or the default macOS volume, a route guard or allowedPath restriction can be bypassed by altering the letter case of a path...

CVE-2026-90982

CVE-2026-90982 affects the @fastify/static plugin (versions before 10.1.4 ). On case-insensitive filesystems such as Windows or the default macOS volume, a mismatch between the case-sensitive route matcher and the case-insensitive filesystem allows an unauthenticated attacker to bypass route guar...

CVE-2026-90982 @fastify/static vulnerable to route guard bypass via path case-folding

@fastify/static is a Fastify plugin that serves static files from a configured root directory. In versions before 10.1.4, on a case-insensitive filesystem such as Windows or the default macOS volume, a route guard or allowedPath restriction can be bypassed by altering the letter case of a path...

CVE-2026-90982 @fastify/static vulnerable to route guard bypass via path case-folding

@fastify/static is a Fastify plugin that serves static files from a configured root directory. In versions before 10.1.4, on a case-insensitive filesystem such as Windows or the default macOS volume, a route guard or allowedPath restriction can be bypassed by altering the letter case of a path...

CVE-2026-90982 @fastify/static vulnerable to route guard bypass via path case-folding

@fastify/static is a Fastify plugin that serves static files from a configured root directory. In versions before 10.1.4, on a case-insensitive filesystem such as Windows or the default macOS volume, a route guard or allowedPath restriction can be bypassed by altering the letter case of a path...

PT-2026-94247

Name of the Vulnerable Software and Affected Versions Dell OpenManage Server Administrator versions prior to 11.1.0.3 Description An improper limitation of a pathname to a restricted directory, known as Path Traversal, allows an unauthenticated remote attacker to gain unauthorized access to the...