CVE-2025-5419

CVE-2025-5419 An uninitialized read vulnerability by incorrect Turboshaft Store-Store Elimination in V8. This repository contains analysis and stablized exploit to escalate this vulnerability to achieve in-V8-sandbox Arbitrary Read / Write, AddressOf & FakeObject primitives. Analysis:...

CVE-2026-95702

A flaw was found in Google gVisor's Virtual File System VFS. A local attacker with standard container privileges can exploit this vulnerability to achieve arbitrary code execution within the host sentry process. By improperly releasing a backing memory file multiple times from an in-sandbox overl...

CVE-2026-91731

Type confusion in Compositing in Google Chrome prior to 153.0.8010.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. Chromium security severity: High...

CVE-2026-78891

Buffer overflow in WebRTC in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. Chromium security severity: Medium...

EUVD-2026-65860

Use after free in Compositing in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. Chromium security severity: Medium...

Craft CMS: Authenticated RCE through Twig sandbox escape

The Twig sandbox mechanism in Craft CMS is configured to allow dangerous functionality from the Yii framework, leading to authenticated RCE in a manner similar to previously disclosed vulnerabilities. The Twig sandbox in Craft CMS works by implementing Twig's SecurityPolicyInterface. The resultin...

GHSA-F5WM-88JV-G5HX Craft CMS: Authenticated RCE through Twig sandbox escape

The Twig sandbox mechanism in Craft CMS is configured to allow dangerous functionality from the Yii framework, leading to authenticated RCE in a manner similar to previously disclosed vulnerabilities. The Twig sandbox in Craft CMS works by implementing Twig's SecurityPolicyInterface. The resultin...

Exploit for Out-of-bounds Write in Google Chrome

CVE-2025-5419 An uninitialized read vulnerability by incorrec...

PT-2023-11812 · Unknown +1 · Trampgeek Jobe +1

Name of the Vulnerable Software and Affected Versions: trampgeek jobe versions 1.6.x and earlier Description: A critical issue affects the function run in sandbox of the file application/libraries/LanguageTask.php, leading to command injection. Recommendations: For trampgeek jobe versions 1.6.x a...

Mozilla: evalInSanbox location context incorrectly applied (MFSA 2012-93)

The evalInSandbox implementation in Mozilla Firefox before 17.0, Firefox ESR 10.x before 10.0.11, Thunderbird before 17.0, Thunderbird ESR 10.x before 10.0.11, and SeaMonkey before 2.14 uses an incorrect context during the handling of JavaScript code that sets the location.href property, which...

DEBIAN-CVE-2006-2787

EvalInSandbox in Mozilla Firefox and Thunderbird before 1.5.0.4 allows remote attackers to gain privileges via javascript that calls the valueOf method on objects that were created outside of the sandbox...