HCL AION 安全漏洞

HCL AION is an AI lifecycle management platform from HCL India. HCL AION suffers from a security vulnerability that stems from untrusted file parsing operations not being performed in an isolated sandboxed environment, which can be exploited by an attacker to cause unexpected behavior when...

OpenClaw has a sandbox network isolation bypass via docker.network=container:<id>

Summary In [email protected], sandbox network hardening blocks network=host but still allows network=container:. This can let a sandbox join another container's network namespace and reach services available in that namespace. Preconditions and Trust Model Context This issue requires a...

CVE-2026-27008 OpenClaw hardened the skill download target directory validation

OpenClaw is a personal AI assistant. Prior to version 2026.2.15, a bug in download skill installation allowed targetDir values from skill frontmatter to resolve outside the per-skill tools directory if not strictly validated. In the admin-only skills.install flow, this could write files outside t...

Remote Code Execution (RCE)

SandboxJS is vulnerable to Remote Code Execution RCE. The vulnerability is due to missing isolation and replacement of AsyncFunction and related function constructors, which allows an attacker to access the native host AsyncFunction via the .constructor property and execute arbitrary code outside...

DOJO Cross-Site Scripting Vulnerabilities

DOJO is a JavaScript toolkit open source by pwn.college. pwn.college’s DOJO has a cross-site scripting vulnerability; this vulnerability stems from the lack of sandbox isolation, which may lead to sandbox escape and arbitrary JavaScript execution...

Number withdrawal

Sandboxie-Plus is a sandbox isolation software developed by Sandboxie-Plus Inc. The CVE number has been withdrawn...

CVE-2026-22686

Enclave is a secure JavaScript sandbox designed for safe AI agent code execution. Prior to 2.7.0, there is a critical sandbox escape vulnerability in enclave-vm that allows untrusted, sandboxed JavaScript code to execute arbitrary code in the host Node.js runtime. When a tool invocation fails,...

Integer Overflow or Wraparound

Overview Magick.NET-Q8-x86 is a Magick.NET allows you can use ImageMagick without having to install ImageMagick on your server or desktop. More information about specific builds see the official docs https://github.com/dlemstra/Magick.NET/tree/main/docs Affected versions of this package are...

Integer Overflow or Wraparound

Overview Affected versions of this package are vulnerable to Integer Overflow or Wraparound in the WriteSVGImage function. An attacker can cause the application to crash or become unavailable by submitting a malicious MVG file that triggers an integer overflow and subsequent buffer overflow durin...

PT-2025-133: Local File Read in OpenPDF

The vulnerability was identified in OpenPDF, version 2.0.4. The discovered vulnerability allows an attacker to read arbitrary files on the server by inserting absolute paths or directory traversal sequences in the HTML‑tag attributes processed by OpenPDF. This enables the disclosure of confidenti...

CVE-2025-14928

A flaw was found in the Hugging Face Transformers library. The convertconfig function fails to validate a user-supplied string before using it to execute Python code. An attacker can exploit this flaw by providing a malicious HuBERT model checkpoint, causing arbitrary code execution in the contex...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the parser process. An attacker can cause excessive memory consumption by submitting a specially crafted XML document, resulting in service disruption due to resource exhaustion...

CVE-2025-54422

Sandboxie is a sandbox-based isolation software for 32-bit and 64-bit Windows NT-based operating systems. In versions 1.16.1 and below, a critical security vulnerability exists in password handling mechanisms. During encrypted sandbox creation, user passwords are transmitted via shared memory,...

FastGPT 安全漏洞

FastGPT is an open source knowledge base question and answer system based on a large language model from labring open source. A security vulnerability exists in FastGPT versions prior to 4.9.11, which stems from insufficient sandbox isolation and could result in file reads and writes...

Sandboxie 安全漏洞

Sandboxie is sandboxie-plus open source sandbox-based isolation software. A security vulnerability exists in Sandboxie versions prior to 1.3.0 through 1.15.12, which stems from an arithmetic overflow in APIGETSECUREPARAM that results in too small a memory allocation and oversized copy operations...

Improper Isolation or Compartmentalization

Overview Affected versions of this package are vulnerable to Improper Isolation or Compartmentalization that allows an attacker who can convince a user to follow a malicious link to escape sandbox protections, due to a logic error in the Mojo component. This vulnerability does not enable code...

PT-2024-24026 · Francoisjacquet · Rosariosis

Name of the Vulnerable Software and Affected Versions: francoisjacquet RosarioSIS version 11.5.1 Description: A disputed issue affects the Add Portal Note component, leading to cross-site scripting. The attack can be initiated remotely. The vendor notes that the PDF is opened by the browser app i...

SUSE CVE-2012-2816

Google Chrome before 20.0.1132.43 on Windows does not properly isolate sandboxed processes, which might allow remote attackers to cause a denial of service process interference via unspecified vectors...

CVE-2021-37086

There is a Improper Preservation of Permissions vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may lead to attackers which can isolate and read synchronization files of other applications across the UID sandbox...

The vulnerability of the pom.xml components and CpsGroovyShell.java plugin of the Jenkins Pipeline allows a hacker to execute arbitrary code.

The vulnerability of the pom.xml components and CpsGroovyShell.java src/main/java/org/jenkinsci/plugins/workflow/cps/CpsGroovyShell.java of the Jenkins Pipeline plugin is related to errors in processing input data during syntax analysis of the code. Exploiting this vulnerability can allow a...