MSC-2026-12437

This package has been identified by Mend as containing potential malicious functionality. The severity of the functionality can change depending on where the library is running user's machine or backend server. The following risks were identified: • Contacting external host – this package sends...

CVE-2026-92956

A flaw was found in vm2. When running untrusted code within a sandbox, improper isolation in WebAssembly streaming functions allows host error objects to leak into the sandbox environment. An attacker capable of running code inside the sandbox can exploit this flaw to escape sandbox containment a...

CVE-2026-92954

A flaw was found in vm2. An attacker capable of running untrusted code within the sandbox can trigger a Denial of Service DoS by causing the host application process to terminate. This vulnerability exists because asynchronous operations Promises returned from the host environment are not properl...

CVE-2026-92953

A flaw was found in vm2. The sandbox fails to properly isolate host object structures from untrusted code running inside the virtual machine. An attacker can exploit this issue by manipulating object prototype chains to modify shared host prototypes, resulting in prototype pollution the...

CVE-2026-92946

A flaw was found in vm2. This vulnerability allows an attacker executing untrusted code within the sandbox to escape isolation and achieve arbitrary code execution on the host system. When external module loading is permitted without restricting access to dependency directories, sandboxed code ca...

CVE-2026-92944

A flaw was found in vm2. An attacker capable of running code within the sandbox environment can bypass security wrappers by supplying a crafted asynchronous Promise object. This flaw allows the attacker to escape the sandbox and access host system objects, leading to arbitrary code execution on t...

CVE-2026-92937

A flaw was found in vm2. This vulnerability allows an attacker to escape the sandbox environment and achieve arbitrary code execution on the host system. The issue occurs because the sandbox bridge fails to properly sanitize rejected Promise errors when handlers are registered through indirect...

CVE-2026-92934

A flaw was found in vm2. A remote attacker able to run code within the sandbox can bypass environment isolation by exploiting an error handling flaw that fails to properly sanitize host objects. By accessing these unprotected host objects, an attacker can achieve arbitrary code execution and acce...

CVE-2026-47698

A flaw was found in vm2. This vulnerability allows arbitrary code execution on the host system through a sandbox breakout. An attacker capable of running code inside the sandbox can manipulate host object properties using indirect function calls to bypass isolation boundaries and execute arbitrar...

CVE-2026-47686

A flaw was found in vm2. The sandbox fails to properly sanitize the error cause property when handling exceptions thrown by host functions. An attacker capable of running untrusted code within the sandbox can exploit this issue to access privileged host objects and bypass isolation boundaries...

China-nexus UAT-11587 targets government and policy organizations across Asia with Antino backdoor

Cisco Talos uncovered a cluster of activity we track as UAT-11587 targeting government and policy organizations across Asia, including in Taiwan, India, the Philippines, and Cambodia, to deliver a previously undocumented backdoor referred to as "Antino" in developer artifacts. Talos first observe...

CVE-2026-102577

A flaw was found in Moodle. Incorrect handling of IPv4-mapped IPv6 addresses within the URL downloader's host-blocking logic allows an authenticated remote user to bypass blocked-host restrictions. By supplying a crafted URL, an attacker can induce the server to make requests to restricted...

UBUNTU-CVE-2026-102577

A flaw was found in Moodle. Incorrect handling of IPv4-mapped IPv6 addresses within the URL downloader's host-blocking logic allows an authenticated remote user to bypass blocked-host restrictions. By supplying a crafted URL, an attacker can induce the server to make requests to restricted...

CVE-2026-102577

A flaw was found in Moodle. Incorrect handling of IPv4-mapped IPv6 addresses within the URL downloader's host-blocking logic allows an authenticated remote user to bypass blocked-host restrictions. By supplying a crafted URL, an attacker can induce the server to make requests to restricted...

EUVD-2026-89716

A flaw was found in Moodle. Incorrect handling of IPv4-mapped IPv6 addresses within the URL downloader's host-blocking logic allows an authenticated remote user to bypass blocked-host restrictions. By supplying a crafted URL, an attacker can induce the server to make requests to restricted...

CVE-2026-102577

A flaw in Moodle 's URL downloader allows an authenticated remote user to bypass host-blocking restrictions. The root cause is the incorrect handling of IPv4-mapped IPv6 addresses , which enables an attacker to provide a crafted URL that forces the server to make requests to restricted destinatio...

CVE-2026-102577 Moodle: ssrf risk in url downloader via ipv4-mapped ipv6 address bypass

A flaw was found in Moodle. Incorrect handling of IPv4-mapped IPv6 addresses within the URL downloader's host-blocking logic allows an authenticated remote user to bypass blocked-host restrictions. By supplying a crafted URL, an attacker can induce the server to make requests to restricted...

CVE-2026-102577 Moodle: ssrf risk in url downloader via ipv4-mapped ipv6 address bypass

A flaw was found in Moodle. Incorrect handling of IPv4-mapped IPv6 addresses within the URL downloader's host-blocking logic allows an authenticated remote user to bypass blocked-host restrictions. By supplying a crafted URL, an attacker can induce the server to make requests to restricted...

CVE-2026-102577

A flaw was found in Moodle. Incorrect handling of IPv4-mapped IPv6 addresses within the URL downloader's host-blocking logic allows an authenticated remote user to bypass blocked-host restrictions. By supplying a crafted URL, an attacker can induce the server to make requests to restricted...

Security Bulletin: This Power System update is being released to address CVE-2026-96263

Summary Power Systems Firmware is affected by a vulnerability in the host firmware boot process image validation path. An attacker with service access to the service processor can supply a maliciously crafted code update image, allowing arbitrary code to be executed on the host system. Successful...