2488 matches found
CVE-2026-47140
CVE-2026-47140 - vm2 NodeVM denylist bypass : The vm2 sandbox (NodeVM) before version 3.11.4 did not block certain host-access primitives: processing modules like process and inspector/promises could be required from sandboxed code to bypass restrictions and execute code in the host process. Root...
CVE-2026-47140 vm2: NodeVM builtin denylist bypass via process and inspector/promises allows host code execution
vm2 is an open source vm/sandbox for Node.js. Prior to version 3.11.4, NodeVM blocks several dangerous Node.js builtins such as module, workerthreads, cluster, vm, repl, and inspector. However, the denylist misses process and inspector/promises. Both can be used from sandboxed code to reach...
EUVD-2026-36446
vm2 is an open source vm/sandbox for Node.js. Prior to version 3.11.4, NodeVM blocks several dangerous Node.js builtins such as module, workerthreads, cluster, vm, repl, and inspector. However, the denylist misses process and inspector/promises. Both can be used from sandboxed code to reach...
Malicious code in @dktunited/anly-tracker-v2 (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8a8893b914c3ba3139a3c8cede191521742237aa7c1c5d64f7ee45dbc5f636a6 scripts/postinstall.js runs unconditionally during npm install and exfiltrates installer-side identifiers to an attacker-controlled out-of-band...
MAL-2026-5434 Malicious code in ac_calendar_ts (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d5b3fd92d67510aef112ac70c9af79a59b924eef29e20b1b127ea4c720182c63 On npm install, the package's canary.js postinstall script issues an HTTP GET to http://157.230.17.236/dc carrying the installer's os.hostname, packa...
MAL-2026-5388 Malicious code in @0xlr/stripe-checkout-js (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 65b2bf8dcdc0fc9b8fdbf14bbf58a011707a4425cf0029867e28067c08ef5566 On npm install, postinstall.js enumerates the full process.env keyspace plus host identifiers os.hostname, username, homedir, cwd, argv, OS details a...
Exploit for Missing Authentication for Critical Function in Mcpjam Inspector
MCPJam Inspector Authorized Security Validator A bounded proo...
CVE-2026-45577
Neotoma provides versioned records that persist across agent runs. From 0.6.0 to before 0.11.1, Neotoma can treat public reverse-proxied requests as local when the app receives them over a loopback socket and no Bearer token is present. In affected deployments, the REST auth middleware can resolv...
Exploit for Missing Authentication for Critical Function in Mcpjam Inspector
cve-2026...
ROOT-APP-NPM-CVE-2025-49596 CVE-2025-49596 in @rootio/modelcontextprotocol__inspector - Patched by Root
Root has patched CVE-2025-49596 in the @rootio/modelcontextprotocolinspector package for Root:npm. Multiple fixed versions available...
Exploit for Missing Authentication for Critical Function in Mcpjam Inspector
CVE-2026-23744 — MCPJam Unauthenticated Remote Code Execution...
MCPJam Inspector 1.4.2 Defensive API Security Assessment Tool
This Python-based defensive auditing tool evaluates the exposure and security posture of MCP-related API endpoints in a controlled and authorized environment. It is designed to assist security teams in identifying insecure API configurations, exposed execution interfaces, and potential operationa...
📄 MCPJam Inspector 1.4.2 Command Injection
This is an advanced Python proof of concept for CVE-2026-23744 demonstrating command injection through a vulnerable MCP API endpoint, leading to remote code execution and reverse shell access. The script supports multiple payload types, endpoint discovery, listener management, and several...
Exploit for Missing Authentication for Critical Function in Mcpjam Inspector
CVE-2026-23744 - MCPJam Inspector RCE PoC Proof of Concept ex...
Exploit for Missing Authentication for Critical Function in Mcpjam Inspector
CVE-2026-23744 --- Description MCPJam inspector is a loca...
Exploit for Missing Authentication for Critical Function in Mcpjam Inspector
No d...
Exploit for Missing Authentication for Critical Function in Mcpjam Inspector
on kali linux - terminal 1...
Exploit for Missing Authentication for Critical Function in Mcpjam Inspector
usage: exploit.py -h --lhost LHOST --lport LPOR...