30785 matches found
CVE-2026-16796
Improper neutralization of argument delimiters in the installpackages method in AWS Bedrock AgentCore Python SDK before 1.18.1 might allow a remote authenticated user to execute arbitrary commands within the Code Interpreter sandbox via crafted package name arguments. To mitigate this issue, user...
SUSE-SU-2026:3221-1 Security update for MozillaFirefox
This update for MozillaFirefox fixes the following issue: - Firefox Extended Support Release 140.13.0 ESR MFSA 2026-70, bsc1271649: - CVE-2026-15718: Invalid pointer in the JavaScript: WebAssembly component. - CVE-2026-15719: Site isolation issue in the DOM: Navigation component. - CVE-2026-16349...
CVE-2026-44210 Kata Containers have VM Escape via virtiofsd Argument Injection through Default-Enabled Pod Annotations
Kata Containers is an open source project focusing on a standard implementation of lightweight Virtual Machines VMs that perform like containers. Versions prior to 3.31.0 ship with a default configuration that allows pod creators to inject arbitrary command-line arguments into the virtiofsd proce...
Claude Cowork Flaw Could Let AI Agent Escape Its VM and Access Mac Files
Cybersecurity researchers have uncovered a sandbox escape vulnerability in Anthropic's Claude Cowork that makes it possible to break out of the confines of a Linux virtual machine VM within which the agent runs to read or write files anywhere on the Mac. Accomplish AI, which shared details of the...
CVE-2026-65906
In JetBrains TeamCity before 2026.1.2, 2025.11.6 сode execution via Kotlin DSL sandbox escape was possible...
CVE-2026-65906
In JetBrains TeamCity before 2026.1.2, 2025.11.6 сode execution via Kotlin DSL sandbox escape was possible...
CVE-2026-65906
CVE-2026-65906 affects JetBrains TeamCity versions prior to 2026.1.2 and prior to 2025.11.6. The vulnerability enables remote code execution via a sandbox escape in the Kotlin DSL used for configuration. The root cause is a sandbox escape in the Kotlin DSL, allowing code execution with high impac...
EUVD-2026-48251
In JetBrains TeamCity before 2026.1.2, 2025.11.6 сode execution via Kotlin DSL sandbox escape was possible...
PYSEC-2026-3478 LiteLLM: Custom Code Guardrails production endpoints bypass code safety checks
Impact LiteLLM's Custom Code Guardrails production create/update paths did not apply the same sandboxing and validation used by the test endpoint. A privileged user with access to create or update guardrails could submit custom Python code that executed in the LiteLLM proxy environment. In...
PYSEC-2026-3533 PraisonAI: execute_code sandbox bypass: str.format C-level attribute access reads every blocklisted dunder
Summary The executecode tool's subprocess sandbox advertises a three-layer defense AST validation, text-pattern blocklist, restricted builtins. In sandbox mode the default only two layers are active — the text-pattern blocklist is skipped — and both remaining layers are bypassed by combining two...
openjdk: Enhance Jar handling (Oracle CPU 2026-07)
A flaw was found in OpenJDK. There exists a potential existential forgery vulnerability in CMS and protocols which use CMS. In Java, CMS is used to sign JAR files...
Astra Linux – Vulnerability in Chromium
Type Confusion in V8 in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. Chromium security severity: High...
Astra Linux – Vulnerability in Chromium
The “Type Confusion in Tint” vulnerability in Google Chrome before version 150.0.7871.46 allowed a remote attacker to potentially perform a sandbox escape through a crafted HTML page. Chromium security severity: High...
Astra Linux – Vulnerability in Chromium
Before version 150.0.7871.47, read and write access in ANGLE using Google Chrome allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape through a crafted HTML page. Chromium security severity: Low...
Astra Linux – Vulnerability in Chromium
Insufficient validation of untrusted input in Media in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted video file. Chromium security severity: Low...
Astra Linux – Vulnerability in Chromium
Integer overflow in V8 in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. Chromium security severity: High...
Astra Linux – Vulnerability in Chromium
The use of after-free in the Guest View component in Google Chrome before version 149.0.7827.103 allowed a remote attacker to execute arbitrary code within a sandbox through a crafted HTML page. Chromium security severity: High...
Astra Linux – Vulnerability in Chromium
In DevTools of Google Chrome before version 149.0.7827.197, it was possible for a remote attacker who had compromised the renderer process to potentially perform a sandbox escape through a crafted HTML page. Chromium security severity: High...
Astra Linux – Vulnerability in Chromium
The use of after-free in the Network mechanism in Google Chrome before version 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape through a crafted HTML page. Chromium security severity: High...
Astra Linux – Vulnerability in Chromium
The use of after-free in V8 in Google Chrome before 149.0.7827.53 allowed an attacker who convinced a user to install a malicious extension to execute arbitrary code inside a sandbox via a crafted Chrome Extension. Chromium security severity: Medium...