PT-2026-107086

Name of the Vulnerable Software and Affected Versions Google Chrome on iOS versions prior to 155.0.8059.39 Description Improper input validation allows a remote attacker to potentially execute arbitrary code outside the sandbox. This is achieved by leveraging social engineering to entice a user t...

PT-2026-106995

Name of the Vulnerable Software and Affected Versions Google Chrome for iOS versions prior to 155.0.8059.39 Description Missing authorization allows a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. This attack requires the use of social...

SUSE SLES16: MozillaFirefox / MozillaFirefox-devel / etc (SUSE-SU-2026:23981-1)

The remote SUSE Linux SLES16 / SLESSAP16 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:23981-1 advisory. Update to Firefox Extended Support Release 153.4.0 ESR MFSA 2026-100, bsc1282929: - CVE-2026-96869: Information disclosure in the...

EUVD-2026-87858

vm2: NodeVM custom resolution bypasses external path boundaries...

EUVD-2026-87856

vm2: NodeVM zlib Buffers expose pooled host memory across the VM boundary...

vm2: Sandbox Escape (NodeVM)

Summary It being possible to obtain the host proto getter/setter, has been used in many reports: - https://github.com/patriksimek/vm2/security/advisories/GHSA-vwrp-x96c-mhwq - https://github.com/patriksimek/vm2/security/advisories/GHSA-v6mx-mf47-r5wg -...

EUVD-2026-81604

vm2: Sandbox Escape NodeVM...

NPM: vm2: Sandbox Escape (NodeVM)

NPM: vm2: Sandbox Escape NodeVM vulnerability discovered by ? in WordPress Npm vm2 versions = 3.11.7...

GHSA-88HF-G992-JG85 vm2: Sandbox Escape (NodeVM)

Summary It being possible to obtain the host proto getter/setter, has been used in many reports: - https://github.com/patriksimek/vm2/security/advisories/GHSA-vwrp-x96c-mhwq - https://github.com/patriksimek/vm2/security/advisories/GHSA-v6mx-mf47-r5wg -...

vm2 sandbox escape to host RCE via revisited host-wrapped AggregateError bypassing Error sanitization cycle short-circuit

Summary vm2 3.11.6 this fork's latest release contains an incomplete-fix bypass of the Error.cause host-reference sanitization added in GHSA-m283-3h24-438v commit 7e3faaf. Sandbox code that catches a host-wrapped AggregateError which is revisited within a single handleException traversal...

GHSA-X965-FC75-JPQH vm2 sandbox escape to host RCE via revisited host-wrapped AggregateError bypassing Error sanitization cycle short-circuit

Summary vm2 3.11.6 this fork's latest release contains an incomplete-fix bypass of the Error.cause host-reference sanitization added in GHSA-m283-3h24-438v commit 7e3faaf. Sandbox code that catches a host-wrapped AggregateError which is revisited within a single handleException traversal...

NPM: vm2 sandbox escape to host RCE via revisited host-wrapped AggregateError bypassing Error sanitization cycle short-circuit

NPM: vm2 sandbox escape to host RCE via revisited host-wrapped AggregateError bypassing Error sanitization cycle short-circuit vulnerability discovered by ? in WordPress Npm vm2 versions = 3.11.7...

EUVD-2026-81584

vm2 sandbox escape to host RCE via revisited host-wrapped AggregateError bypassing Error sanitization cycle short-circuit...

EUVD-2026-81596

vm2: Sandboxed code can read and write host-realm memory via Node's shared Buffer pool...

vm2 sandbox escape via WebAssembly.compileStreaming Promise species bypass

Summary There is a sandbox escape in vm2 3.11.5 / current HEAD when it is used on Node.js 26. The issue is reachable from a default new VM sandbox. No NodeVM, require permission, host object injection, or intentionally unsafe configuration is required. The escape is a patch-bypass of the same...

GHSA-WJWH-QQVP-G4P4 vm2 sandbox escape via WebAssembly.compileStreaming Promise species bypass

Summary There is a sandbox escape in vm2 3.11.5 / current HEAD when it is used on Node.js 26. The issue is reachable from a default new VM sandbox. No NodeVM, require permission, host object injection, or intentionally unsafe configuration is required. The escape is a patch-bypass of the same...

EUVD-2026-81605

vm2 sandbox escape via WebAssembly.compileStreaming Promise species bypass...

NPM: vm2 sandbox escape via WebAssembly.compileStreaming Promise species bypass

NPM: vm2 sandbox escape via WebAssembly.compileStreaming Promise species bypass vulnerability discovered by ? in WordPress Npm vm2 versions = 3.10.1, = 3.11.6...

CVE-2026-105744

Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecosystem. From 2.94.0 until 2.132.0, callers that opt into LatexBackendOptionstikzengine="tectonic" invoke docling/backend/latex/engines/tectonic.py to compile an untrusted TikZ bo...

PYSEC-2026-4191

Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecosystem. From 2.94.0 until 2.132.0, callers that opt into LatexBackendOptionstikzengine="tectonic" invoke docling/backend/latex/engines/tectonic.py to compile an untrusted TikZ bo...