Exploit for Improper Neutralization of Special Elements Used in a Template Engine in Craftcms Craft_Cms

CVE-2026-28695 patch bypass — Craft CMS ≤ 5.9.8 authenticated RC...

Duplicate Advisory: vm2: Host Promise rejection from an exposed constructor can terminate the vm2 host process

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-2v2p-6j97-cjg9. This link is maintained to preserve external references. Original Description vm2 before 3.12.2 does not apply host-side Promise rejection handling in the sandbox-to-host construct trap. In...

Uncaught Exception

Overview org.webjars.npm:vm2 is a sandbox that can run untrusted code with whitelisted Node's built-in modules. Affected versions of this package are vulnerable to Uncaught Exception via the host-to-sandbox promise delivery path in lib/bridge.js, where a host promise reaching the sandbox through...

CVE-2026-100722 vm2 before 3.12.2 Host Process Termination via Construct Trap

vm2 before 3.12.2 does not apply host-side Promise rejection handling in the sandbox-to-host construct trap. In BaseHandler, the apply trap calls markHostPromiseHandled on the returned value, but the adjacent construct path returns the result of Reflect.construct without the same sanitization. If...

CVE-2026-100722 vm2 before 3.12.2 Host Process Termination via Construct Trap

vm2 before 3.12.2 does not apply host-side Promise rejection handling in the sandbox-to-host construct trap. In BaseHandler, the apply trap calls markHostPromiseHandled on the returned value, but the adjacent construct path returns the result of Reflect.construct without the same sanitization. If...

CVE-2026-100722 vm2 before 3.12.2 Host Process Termination via Construct Trap

vm2 before 3.12.2 does not apply host-side Promise rejection handling in the sandbox-to-host construct trap. In BaseHandler, the apply trap calls markHostPromiseHandled on the returned value, but the adjacent construct path returns the result of Reflect.construct without the same sanitization. If...

CVE-2026-100722

The vm2 library before version 3.12.2 is vulnerable to a host process termination due to a flaw in the sandbox-to-host construct trap . Specifically, the BaseHandler fails to apply host-side Promise rejection handling when the apply trap calls markHostPromiseHandled() on a returned value, while t...

PT-2026-99713

Name of the Vulnerable Software and Affected Versions Nezha versions prior to 2.3.8 Description Authenticated non-administrator users can create malformed alert rules due to a lack of validation for alert rule types and duration bounds. By submitting a crafted alert rule via the 'POST...

PT-2026-107651

The parser and layout engine in affected versions of latex-rust recurse once per level of nesting with no limit. Deeply nested input, such as frac1…, braces, sqrt…, left, or superscripts nested hundreds or thousands of levels deep, exhausts the call stack. A stack overflow in Rust aborts the...

CVE-2026-100722: Uncaught Exception

vm2 before 3.12.2 does not apply host-side Promise rejection handling in the sandbox-to-host construct trap. In BaseHandler, the apply trap calls markHostPromiseHandled on the returned value, but the adjacent construct path returns the result of Reflect.construct without the same sanitization. If...

CVE-2026-100642

SiYuan versions from v2.1.0 before v3.8.4 contain a cross-site request forgery vulnerability in the CheckAuth lock-screen pass-through branch that grants administrator access to loopback requests without validating Origin headers. Attackers can craft malicious web pages that force victims to...

Symlink Attack

Overview froxlor/froxlor is a server administration software. Affected versions of this package are vulnerable to Symlink Attack via the DataDump cron process due to insufficient validation of intermediate path components in the export destination. An attacker can gain unauthorized ownership of...

CVE-2026-100701

Nodemailer versions 5.0.0 through 10.0.1 use a process-global DNS cache that is keyed only by the DNS host, while each cache entry also stores the caller-specific TLS servername. When two direct TLS/SMTPS transports secure: true resolve the same non-IP host with different tls.servername values, t...

CVE-2026-100642 SiYuan v2.1.0 before v3.8.4 Cross-Site Request Forgery via CheckAuth

SiYuan versions from v2.1.0 before v3.8.4 contain a cross-site request forgery vulnerability in the CheckAuth lock-screen pass-through branch that grants administrator access to loopback requests without validating Origin headers. Attackers can craft malicious web pages that force victims to...

CVE-2026-100634 SiYuan before v3.8.4 Missing Authorization via siyuan-send-windows

SiYuan before v3.8.4 does not validate the sender or restrict recipients in the 'siyuan-send-windows' IPC handler of the Electron main process app/electron/main.js. The handler ignores event.sender and forwards any received payload to every BrowserWindow returned by BrowserWindow.getAllWindows,...

EUVD-2026-87728

SiYuan before v3.8.4 does not validate the sender or restrict recipients in the 'siyuan-send-windows' IPC handler of the Electron main process app/electron/main.js. The handler ignores event.sender and forwards any received payload to every BrowserWindow returned by BrowserWindow.getAllWindows,...

Astra Linux – Vulnerability in Chromium

Insufficient validation of untrusted input in the UI of Google Chrome before version 151.0.7922.109 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape through a crafted HTML page. Chromium security severity: High...

Astra Linux – Vulnerability in Chromium

Before version 153.0.8010.36, an uninitialized resource in the GPU of Google Chrome allowed a remote attacker who had compromised the renderer process to read memory outside the sandbox through a crafted HTML page. Chromium security severity: High...

Astra Linux – Vulnerability in Chromium

Missing authorization in Extensions in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via crafted network traffic. Chromium security severity: Medium...

Astra Linux – Vulnerability in Chromium

Inappropriate implementation of CORS in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to leak cross-origin data through a crafted HTML page. Chromium security severity: Low...