EUVD-2026-93418

Oracle VM VirtualBox before 7.2.8 allows guest OS users to cause an out-of-bounds write in the host OS in pcnetReceiveNoSync in DevPCNet.cpp in the PCNet Am79C970A network device model...

Brocade Fabric OS authentication and access control bypass via HTTP host header spoofing

: An authentication and access control bypass vulnerability exists in the web server management interface of Brocade Fabric OS versions before 10.0.1. The web dispatcher routine evaluates internal management VLAN trust decisions using the client-supplied HTTP host header instead of the actual...

CVE-2026-104636: Server-Side Request Forgery (SSRF)

Gitea validated the initial remote URL for push mirrors, wiki remote checks, and fetches of migrated pull request heads, but the subsequent raw Git operations followed HTTP redirects without revalidating the destination. A repository administrator using a policy-allowed endpoint that redirects...

sudo security update

1.9.17-7 - CVE-2026-96512 sudo: sudo: TZ environment variable allows bypass of NOTBEFORE/NOTAFTER time-based authorization rhel-10.2.z 1.9.17-6 - Fix CVE-2026-82474: execveat2 intercept/logsubcmds bypass 1.9.17-5.p2 - Resolves: RHEL-212546 - Use canonicalized path if user path contains '..'...

Arbitrary file manipulation vulnerability exists in the Brocade Fabric OS WebTools management

: An arbitrary file manipulation vulnerability exists in the WebTools management interface of Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1. When processing configuration transfer requests, the application fails to properly validate and sanitize a user-supplied status file...

Linux Distros Unpatched Vulnerability : CVE-2026-98367

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - RDMA/siw: Clear association under lock if siwqpmodify fails in siwaccept We need to clear cep before release statelock as siwqpllpclose and...

PyMongo: PYTHON-5986 Host injection in PyMongo connection string parsing via percent-encoded delimiters

Summary PyMongo percent-decoded the entire host section of a connection string before splitting it into individual host:port entries. A percent-encoded , or : in a hostname therefore decoded into a real delimiter, injecting an additional attacker-chosen host and port into the client's seed list...

GHSA-VP6J-J7W5-5XJJ PyMongo: PYTHON-5986 Host injection in PyMongo connection string parsing via percent-encoded delimiters

Summary PyMongo percent-decoded the entire host section of a connection string before splitting it into individual host:port entries. A percent-encoded , or : in a hostname therefore decoded into a real delimiter, injecting an additional attacker-chosen host and port into the client's seed list...

EUVD-2026-86347

PyMongo: PYTHON-5986 Host injection in PyMongo connection string parsing via percent-encoded delimiters...

EUVD-2026-87858

vm2: NodeVM custom resolution bypasses external path boundaries...

NPM: vm2: Host Promise rejection from an exposed constructor can terminate the vm2 host process

NPM: vm2: Host Promise rejection from an exposed constructor can terminate the vm2 host process vulnerability discovered by ? in WordPress Npm vm2 versions = 3.12.1...

vm2: Host Promise rejection from an exposed constructor can terminate the vm2 host process

Summary An untrusted script run by VM.run can construct an embedder-exposed host function that returns a rejected native Promise and ignore the result. The sandbox-to-host construct trap forwards that Promise without applying the host-side rejection handling already used by the neighboring apply...

GHSA-2V2P-6J97-CJG9 vm2: Host Promise rejection from an exposed constructor can terminate the vm2 host process

Summary An untrusted script run by VM.run can construct an embedder-exposed host function that returns a rejected native Promise and ignore the result. The sandbox-to-host construct trap forwards that Promise without applying the host-side rejection handling already used by the neighboring apply...

vm2: NodeVM zlib Buffers expose pooled host memory across the VM boundary

Summary When an application explicitly exposes Node's zlib module through vm2's NodeVM builtin allowlist, an untrusted guest can obtain a pool-backed host Buffer from zlib.deflateSync, create a full-width view of its backing ArrayBuffer, read bytes outside the compressed result, and flip a byte i...

GHSA-489W-W794-JQ94 vm2: NodeVM zlib Buffers expose pooled host memory across the VM boundary

Summary When an application explicitly exposes Node's zlib module through vm2's NodeVM builtin allowlist, an untrusted guest can obtain a pool-backed host Buffer from zlib.deflateSync, create a full-width view of its backing ArrayBuffer, read bytes outside the compressed result, and flip a byte i...

EUVD-2026-87856

vm2: NodeVM zlib Buffers expose pooled host memory across the VM boundary...

vm2: Host-returned Promise rejection can bypass vm2's unhandled-rejection hardening and terminate the host process

Summary vm2 current head v3.11.5, commit 7a1f5100b96f48d34e0fe104ab37c0acc5944f92 can still be used to terminate the host Node.js process when sandbox code calls a host-realm function that returns a rejected host Promise and then ignores the returned value. This is an incomplete-fix variant of th...

GHSA-GJQ8-XM47-88RC vm2: Host-returned Promise rejection can bypass vm2's unhandled-rejection hardening and terminate the host process

Summary vm2 current head v3.11.5, commit 7a1f5100b96f48d34e0fe104ab37c0acc5944f92 can still be used to terminate the host Node.js process when sandbox code calls a host-realm function that returns a rejected host Promise and then ignores the returned value. This is an incomplete-fix variant of th...

vm2: Default VM can mutate host TypedArray and ArrayBuffer intrinsics after the host-prototype pollution fix

Summary vm2's current host-intrinsic prototype protection is incomplete. The fix for GHSA-vwrp-x96c-mhwq blocks sandbox writes into classic host intrinsics such as Object.prototype, Array.prototype, and Function.prototype, but current head still lets sandbox code in a default VM reach and mutate...

GHSA-3VGF-8M4Q-Q4QR vm2: Default VM can mutate host TypedArray and ArrayBuffer intrinsics after the host-prototype pollution fix

Summary vm2's current host-intrinsic prototype protection is incomplete. The fix for GHSA-vwrp-x96c-mhwq blocks sandbox writes into classic host intrinsics such as Object.prototype, Array.prototype, and Function.prototype, but current head still lets sandbox code in a default VM reach and mutate...