vm2: Host Promise rejection from an exposed constructor can terminate the vm2 host process

Summary An untrusted script run by VM.run can construct an embedder-exposed host function that returns a rejected native Promise and ignore the result. The sandbox-to-host construct trap forwards that Promise without applying the host-side rejection handling already used by the neighboring apply...

CVE-2026-94625

A flaw was found in vLLM. A remote attacker can exploit this vulnerability by sending rejected prefill requests to the MooncakeConnector. This action creates ownerless transfer placeholders that are not properly reclaimed, leading to resource exhaustion. Consequently, legitimate requests may...

EUVD-2026-84219

vLLM through 0.29.0 contains a resource exhaustion vulnerability in MooncakeConnector where rejected prefill requests create ownerless transfer placeholders that are never reclaimed. Attackers can send rejected requests to exhaust sender task pools, causing valid requests to be delayed by up to 4...

PYSEC-2026-4007

vLLM through 0.29.0 contains a resource exhaustion vulnerability in MooncakeConnector where rejected prefill requests create ownerless transfer placeholders that are never reclaimed. Attackers can send rejected requests to exhaust sender task pools, causing valid requests to be delayed by up to 4...

PYSEC-2026-4007

vLLM through 0.29.0 contains a resource exhaustion vulnerability in MooncakeConnector where rejected prefill requests create ownerless transfer placeholders that are never reclaimed. Attackers can send rejected requests to exhaust sender task pools, causing valid requests to be delayed by up to 4...

CVE-2026-94625 vLLM through 0.29.0 Resource Exhaustion via Ownerless Mooncake Transfer Placeholders

vLLM through 0.29.0 contains a resource exhaustion vulnerability in MooncakeConnector where rejected prefill requests create ownerless transfer placeholders that are never reclaimed. Attackers can send rejected requests to exhaust sender task pools, causing valid requests to be delayed by up to 4...

CVE-2026-94625: Missing Release of Resource after Effective Lifetime

vLLM through 0.29.0 contains a resource exhaustion vulnerability in MooncakeConnector where rejected prefill requests create ownerless transfer placeholders that are never reclaimed. Attackers can send rejected requests to exhaust sender task pools, causing valid requests to be delayed by up to 4...

Arbitrary Code Injection

Overview vm2 is a sandbox that can run untrusted code with whitelisted Node's built-in modules. Affected versions of this package are vulnerable to Arbitrary Code Injection in the handling of rejected host Promises via call or apply indirection. An attacker can execute arbitrary commands with the...

Uncaught Exception

Overview vm2 is a sandbox that can run untrusted code with whitelisted Node's built-in modules. Affected versions of this package are vulnerable to Uncaught Exception in the handling of Promises returned from the host realm into the sandbox. An attacker can cause the host process to terminate...

Astra Linux – Vulnerabilities in Linux, Linux-5.10, Linux-5.15, Linux-6.1

Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15, Linux 6.1

Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority...

Astra Linux – Vulnerability in Linux 6.1, Linux, Linux 5.15

Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority...

Astra Linux – Vulnerability in Linux

Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority...

golang.org/x/crypto/ssh: golang: golang.org/x/crypto/ssh: Denial of Service via repeated rejected channel openings

A flaw was found in golang.org/x/crypto/ssh. An authenticated SSH client can cause a Denial of Service DoS by repeatedly opening channels that are rejected by the server. This leads to unbounded memory growth, eventually crashing the server process and affecting all connected users...

CVE-2024-58377

Rejected CVE Nokogiri before 1.16.5, when using bundled libxml2, is affected by the libxml2 flaw CVE-2024-34459...

SUSE CVE-2026-69159

REJECT DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2026-67306. Reason: This candidate is a duplicate of CVE-2026-67306. Notes: All CVE users should reference CVE-2026-67306 instead of this candidate...

PT-2026-83425

CVE-2026-18823 - Rejected reason: This CVE ID has been rejected or CVE ID :CVE-2026-18823 Published : Aug. 26, 2026, 11:17 p.m. | 22 minutes ago Description :Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. Severity: 0.0 | NA Visit the link for more...

PT-2026-83391

CVE-2026-80153 - Rejected reason: This CVE ID has been rejected or CVE ID :CVE-2026-80153 Published : Aug. 26, 2026, 5:17 p.m. | 19 minutes ago Description :Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. Severity: 0.0 | NA Visit the link for more...

PT-2026-81917

CVE-2026-16249 - Rejected reason: This CVE ID is a duplicate of CVE CVE ID :CVE-2026-16249 Published : Aug. 24, 2026, 10:16 a.m. | 35 minutes ago Description :Rejected reason: This CVE ID is a duplicate of CVE-2026-15303 and was never published. Both IDs were assigned to the same vulnerability in...

PT-2026-81079

CVE-2026-5723 - Rejected reason: This CVE ID has been rejected or CVE ID :CVE-2026-5723 Published : Aug. 23, 2026, 12:16 a.m. | 2 hours, 34 minutes ago Description :Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. Severity: 0.0 | NA Visit the link for mo...