Linux Distros Unpatched Vulnerability : CVE-2026-87269

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization component: Core. The supported version that is affected is 7.2.16. Easily exploitable...

PT-2026-94325

Name of the Vulnerable Software and Affected Versions vm2 versions 3.10.0 through 3.11.7 Description Promises returned from the host realm into the sandbox are not marked as handled at the bridge boundary. While Promises created inside the sandbox are wrapped with a rejection-swallowing handler i...

PT-2026-94394

Name of the Vulnerable Software and Affected Versions AsyncHttpClient versions 3.0.8 through 3.0.11 Description A connection permit leak occurs when TLS connection establishment fails before the handshake completes. This happens because the NettyConnectListener removes the partitionKeyLock permit...

PT-2026-95074

Name of the Vulnerable Software and Affected Versions AWS IoT Device SDK for Python versions 1.5.3 through 1.6.0 Description Improper validation of certificates with host mismatch occurs in the MQTT client TLS connection layer, specifically affecting X.509 mutual authentication on port 8883 and...

PT-2026-94308

Name of the Vulnerable Software and Affected Versions vm2 versions 3.11.0 through 3.11.6 Description Absolute host filesystem paths are leaked to sandboxed code via error stack formatting. An attacker can force the host-realm source transformer to throw a SyntaxError by calling eval with malforme...

CVE-2026-92946: Improper Control of Dynamically-Managed Code Resources

vm2 before 3.11.7 contains a remote code execution vulnerability when require.external is enabled without an explicit require.root that excludes nodemodules. Sandboxed code can require vm2's own package, instantiate an unrestricted NodeVM instance, and execute arbitrary host OS commands via...

CVE-2026-54355: Improper Neutralization of Input During Web Page Generation

MapServer is a system for developing web-based GIS applications. From 6.0 until 8.6.4, MapServer's OpenLayers HTML output for SERVICE=WMS&REQUEST=GetMap&FORMAT=application/openlayers reflects an attacker-controlled X-Forwarded-Host value received as HTTPXFORWARDEDHOST through msBuildOnlineResourc...

PT-2026-95102

Name of the Vulnerable Software and Affected Versions MapServer versions 6.0 through 8.6.3 Description MapServer's OpenLayers HTML output for the endpoint SERVICE=WMS&REQUEST=GetMap&FORMAT=application/openlayers reflects an attacker-controlled X-Forwarded-Host value received as HTTP X FORWARDED...

PT-2026-105475

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-647f-g98j-qq25. This link is maintained to preserve external references. Original Description vm2 3.11.6 is vulnerable to a sandbox escape leading to remote code execution in the host Node.js process. The fix fo...

PT-2026-105488

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-c48m-32m9-vx93. This link is maintained to preserve external references. Original Description vm2 before 3.11.7 contains an incorrect authorization vulnerability in the external package allowlist check that uses...

CVE-2026-92942: Uncontrolled Resource Consumption

vm2 before 3.11.7 affected versions = 3.11.6 does not enforce the VM timeout option on code executed outside the synchronous VMrun call. The timeout only wraps the single call to runScript via doWithTimeout in lib/vm.js, and FinalizationRegistry and WeakRef are exposed to sandboxed code unmodifie...

CVE-2026-92953: Improper Control of Dynamically-Managed Code Resources

vm2 versions from 3.11.0 before 3.11.8 fail to protect host TypedArray and ArrayBuffer prototypes from sandbox mutation. Attackers can use prototype-walking primitives to reach and modify host Uint8Array.prototype, %TypedArray%.prototype, and ArrayBuffer.prototype, causing host-created typed arra...

CVE-2026-92954: Uncaught Exception

vm2 is a sandbox library for running untrusted JavaScript in Node.js. In versions = 3.10.0 and = 3.11.7, Promises returned from the host realm into the sandbox are not marked as handled at the bridge boundary; only Promises created inside the sandbox are wrapped with a rejection-swallowing handle...

CVE-2026-92956: Protection Mechanism Failure

vm2 versions 3.10.1 through 3.11.6 contain a sandbox escape reachable from a default new VM sandbox when running on Node.js 26. WebAssembly.compileStreaming and WebAssembly.instantiateStreaming can produce a raw host-realm Promise that rejects with a host-realm error object; by controlling...

PT-2026-105546

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-qhwx-74w5-xhxq. This link is maintained to preserve external references. Original Description vm2 versions = 3.9.6 and therefore executes arbitrary JavaScript in an unrestricted host Node process outside the...

CVE-2026-92893: Incorrect Authorization

A flaw was found in the foremanansible plugin's Ansible inventory API. The controller builds its host query using an unscoped Host.where call that does not enforce the search filter associated with the caller's viewhosts permission. An authenticated user whose host visibility is restricted by a...

PT-2026-94225

Name of the Vulnerable Software and Affected Versions foreman ansible plugin affected versions not specified Description A flaw exists in the Ansible inventory API of the foreman ansible plugin. The controller utilizes an unscoped Host.where call to build host queries, which fails to enforce the...

CVE-2026-92941: Incorrect Permission Assignment for Critical Resource

vm2 versions from 3.11.3 before 3.11.7 expose the host tls module to NodeVM sandbox code, allowing attackers to call tls.setDefaultCACertificates and replace process-wide certificate authorities. Attackers with access to allowed tls and url builtins can use URLSearchParams to create host-realm...

CVE-2026-92938: Protection Mechanism Failure

vm2 versions 3.11.3 through 3.11.6 expose Node.js's host node:sqlite module to code running in NodeVM when that builtin is permitted, either explicitly or through builtin: ''. The module is wrapped with vm.readonly, which prevents property assignment but leaves host-authority callables reachable;...

PT-2026-94992

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A slab-use-after-free issue exists in the nvdimm component, specifically within the virtio pmem driver. The issue occurs when the virtio pmem host ack function attempts to wake a request...