Use of Incorrectly-Resolved Name or Reference

Overview vm2 is a sandbox that can run untrusted code with whitelisted Node's built-in modules. Affected versions of this package are vulnerable to Use of Incorrectly-Resolved Name or Reference via the allowlist process. An attacker can execute unauthorized code in the host context by requiring a...

Duplicate Advisory: vm2 Custom Module Resolver Can Bypass the External Package Allowlist by Loading a Colliding Host Package

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-c48m-32m9-vx93. This link is maintained to preserve external references. Original Description vm2 before 3.11.7 contains an incorrect authorization vulnerability in the external package allowlist check that uses...

CVE-2026-92951

vm2 prior to version 3.11.7 is affected by an incorrect authorization flaw in its external package allowlist mechanism. The root cause is the use of non-exact substring matching instead of full package-name boundary validation, allowing an attacker to require a colliding package name that merely ...

CVE-2026-92951 vm2 before 3.11.7 Module Allowlist Bypass via Custom Resolver

vm2 before 3.11.7 contains an incorrect authorization vulnerability in the external package allowlist check that uses non-exact substring matching instead of full package-name boundary validation. Attackers can bypass the allowlist by requiring a colliding package name that contains an allowliste...

CVE-2026-92951 vm2 before 3.11.7 Module Allowlist Bypass via Custom Resolver

vm2 before 3.11.7 contains an incorrect authorization vulnerability in the external package allowlist check that uses non-exact substring matching instead of full package-name boundary validation. Attackers can bypass the allowlist by requiring a colliding package name that contains an allowliste...

CVE-2026-92951 vm2 before 3.11.7 Module Allowlist Bypass via Custom Resolver

vm2 before 3.11.7 contains an incorrect authorization vulnerability in the external package allowlist check that uses non-exact substring matching instead of full package-name boundary validation. Attackers can bypass the allowlist by requiring a colliding package name that contains an allowliste...

CVE-2026-92955: Improper Control of Dynamically-Managed Code Resources

vm2 before 3.11.8 contains a sandbox escape vulnerability in NodeVM that allows attackers to access the host proto getter/setter through console.stdout and console.stderr. Attackers can overwrite EventEmitter.prototype.emit and trigger process events to execute code with process context, bypassin...

CVE-2026-90305: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: ARM: 9483/1: select HAVEPOSIXCPUTIMERSTASKWORK Commit c6e61c06d606 "ARM: 9463/1: Allow to enable RT" enabled PREEMPTRT on ARM but did not select HAVEPOSIXCPUTIMERSTASKWORK. This leaves CONFIGPOSIXCPUTIMERSTASKWORK disabled, so CP...

CVE-2026-90240: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: iommu/vt-d: Flush context cache with correct SID when tearing down aliases domaincontextclearone and devicepasidtableteardown are both invoked once per DMA alias of a device. Each function locates the context entry using the...

CVE-2026-90098: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: net: sparx5: fix sleep in atomic context in MAC table access sparx5setrxmode runs with netifaddrlockbh held and iterates dev-mc via devmcsync, which per address calls sparx5mcsync / sparx5mcunsync - sparx5mactlearn /...

CVE-2026-92951: Use of Incorrectly-Resolved Name or Reference

vm2 before 3.11.7 contains an incorrect authorization vulnerability in the external package allowlist check that uses non-exact substring matching instead of full package-name boundary validation. Attackers can bypass the allowlist by requiring a colliding package name that contains an allowliste...

CVE-2026-90094: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: arm64: process: Fix context switching MTE store-only tag check SCTLREL1.TCSO0 is set when user opt-in for MTE store-only tag check mode. However, it is not part of SCTLRUSERMASK which imply that on context switch we never clear...

CVE-2026-93096: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: cxl/features: Serialize multi-part Get/Set Feature transfers A Get or Set Feature payload larger than the mailbox payload size is split into several mailbox commands. mboxmutex only serializes individual mailbox commands and is...

CVE-2026-93158: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: crypto: sa2ul - stop probe if context pool creation fails saulprobe calls sainitmem to create the DMA pool used for security context buffers, but ignores its return value. If pool creation fails, probe still continues with DMA...

CVE-2026-90338: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: serial: amba-pl011: keep console clock enabled for atomic writes pl011consolewriteatomic runs from nbcon atomic context, where sleeping is not allowed. It calls clkenable, which takes the common-clk enablelock. Under PREEMPTRT th...

CVE-2026-90383: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: misc: sgi-gru: remove interrupt-context page-table walks The GRU TLB miss handler walks a process's page tables without holding page-table locks or a reference to the mapped page. It also uses a kernel page-table accessor on user...

CVE-2026-90208: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: clocksource/drivers/samsungpwm: Switch to rawspinlockt type Samsung PWM timer might be used as a clock source on some legacy systems. When PREEMPTRT is enabled on ARM, regular spinlock is converted to a sleeping lock mutex-based,...

CVE-2026-63127

A flaw was found in rmcp, a Rust SDK for the Model Context Protocol. The OAuth implementation in rmcp omits the RFC 9728 resource field from ResourceServerMetadata. This allows a malicious Model Context Protocol MCP server to publish metadata for a different legitimate MCP resource. Consequently,...

Updated aom packages fix security vulnerabilities

Heap buffer overflow in av1 encoder first-pass stats buffer via lap mode. CVE-2026-56208 Arbitrary address write via svc layer context oob and cyclic refresh map pointer hijack. CVE-2026-56209 Heap-buffer-overflow read via missing bounds check in ctrlsetlayerid. CVE-2026-56210 Remote code executi...

MGASA-2026-0410 Updated aom packages fix security vulnerabilities

Heap buffer overflow in av1 encoder first-pass stats buffer via lap mode. CVE-2026-56208 Arbitrary address write via svc layer context oob and cyclic refresh map pointer hijack. CVE-2026-56209 Heap-buffer-overflow read via missing bounds check in ctrlsetlayerid. CVE-2026-56210 Remote code executi...