CVE-2026-47686 vm2: Missing Error.cause Sanitization Enables VM2 Sandbox Escape to RCE

vm2 is an open source vm/sandbox for Node.js. Prior to 3.11.6, handleException in lib/setup-sandbox.js sanitizes SuppressedError.error, SuppressedError.suppressed, and AggregateError.errors but does not sanitize Error.cause, allowing sandbox code to obtain a powerful host object such as process...

CVE-2026-47686

The GHSA advisory confirms vm2

CVE-2026-65974 ERPNext: Server-Side Template Injection leading to Remote Code Execution

ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.111.0 and 16.22.0, limited authenticated users can cross a permission boundary in Frappe safe execution because frappe.rendertemplate is exposed without forcing restrictglobals, allowing server-side template injectio...

GHSA-GHVC-7HP8-2G2V vulnerabilities

Vulnerabilities for packages: wso2is, apache-tika-fips, apache-tika...

MINI-CCCF-R95F-P74M

Bulletin has no description...

CVE-2026-74253

Joomla Extension - regularlabs.com - Unauthenticated RCE through unverified reflected user input in Sourcerer 16.0.0 - Regular Labs Sourcerer before 16.0.0 processes source blocks found in Joomla’s final rendered HTML without reliably determining where that code originated...

CVE-2026-50772

An issue in Squirro Cognitive Search 3.14.2 allows a remote attacker to execute arbitrary code via a crafted payload to the password reset function...

NPM: VM2 has Missing Error.cause Sanitization that Enables Sandbox Escape to RCE

NPM: VM2 has Missing Error.cause Sanitization that Enables Sandbox Escape to RCE vulnerability discovered by ? in WordPress Npm vm2 versions = 3.11.5...

VM2 has Missing Error.cause Sanitization that Enables Sandbox Escape to RCE

Affected: vm2 = 3.11.3 CVSS 3.1: 9.9 HIGH CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H CWE: CWE-693 Protection Mechanism Failure Prerequisite: Embedder exposes a host function that throws an Error with .cause referencing a powerful host object e.g., process Summary I found that handleException in...

CVE-2026-74253

Regular Labs Sourcerer before 14.0.0 processes {source} blocks in Joomla's final rendered HTML without verifying origin, allowing unauthenticated remote code execution (CVSS 10.0). CIRCL sightings confirm published proof-of-concept code on Telegram; upgrading to Sourcerer 14.0.0 or later is the r...

CVE-2026-74253

Joomla Extension - regularlabs.com - Unauthenticated RCE through unverified reflected user input in Sourcerer 14.0.0 - Regular Labs Sourcerer before 14.0.0 processes source blocks found in Joomla’s final rendered HTML without reliably determining where that code originated...

CVE-2025-27772 Uptrain vulnerable to remote code execution via `/new_run` endpoint

UpTrain is an open-source platform to evaluate and improve generative AI applications. In version 0.7.1 and prior, the /newrun endpoint is vulnerable to remote code execution via the checks and metadata parameters. Any user that has access to UpTrain and a valid authentication method may be able ...

CVE-2026-74997

In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, the cmdlearn driver of the markasjunk plugin is subject to remote code execution via crafted placeholder replacement values. This issue only affects Roundcube instances using the markasjunk plugin with its cmdlearn driver...

BIT-AIRFLOW-2026-58076 Apache Airflow: Unguarded import_string() of airflow_exc_ser / base_exc_ser exception nodes in BaseSerialization.deserialize enables DAG-author RCE on Scheduler / API Server

Apache Airflow's serialization layer reconstructed exception nodes by calling importstring on a class name taken from the serialized blob and instantiating it with arguments from the same blob, with no restriction on what could be imported. An operator's executorconfig reaches that branch, so a D...

CVE-2026-67919

Halo (open-source CMS) version 2.25.4 is vulnerable to remote code execution via the installFromUri method in PluginEndpoint.java and DefaultPluginApplicationContextFactory. The plugin installation endpoint fetches an arbitrary URL without scheme or host validation, downloads the JAR, and loads i...

CVE-2026-50772

An issue in Squirro Cognitive Search 3.14.2 allows a remote attacker to execute arbitrary code via a crafted payload to the password reset function...

CVE-2026-50772

An issue in Squirro Cognitive Search 3.14.2 allows a remote attacker to execute arbitrary code via a crafted payload to the password reset function...

CVE-2026-68004

OSSRS SRS versions below 5.0.213 allow unauthenticated remote code execution via the RTMP publish authorization path in SrsSecurity::check() (trunk/src/app/srs_app_security.cpp) when vhost-level security.enabled is disabled. A Python PoC at https://github.com/xuwu-xuwu/CVE-2026-68004 confirms exp...

The vulnerability of the Apache Tomcat application server, related to insufficient input validation, allows attackers to execute arbitrary code.

The vulnerability of the Apache Tomcat application server is related to insufficient validation of input data. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

Metabase < 0.46.6.1 - Remote Code Execution

Metabase open source before 0.46.6.1 and Metabase Enterprise before 1.46.6.1 allow attackers to execute arbitrary commands on the server, at the server's privilege level. Authentication is not required for exploitation. The other fixed versions are 0.45.4.1, 1.45.4.1, 0.44.7.1, 1.44.7.1, 0.43.7.2...