EUVD-2026-67306

Out of bounds read in V8 in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. Chromium security severity: Medium...

DEBIAN-CVE-2026-82072

Out of bounds read in V8 in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. Chromium security severity: Medium...

CVE-2026-6876

ServiceNow has remediated a sandbox escape security issue that was identified in the ServiceNow AI Platform. This security issue could allow an unauthenticated user to execute arbitrary code within the ServiceNow AI Platform, potentially leading to more access to the ServiceNow AI Platform than...

CVE-2026-6876 Sandbox Escape in ServiceNow AI Platform

ServiceNow has remediated a sandbox escape security issue that was identified in the ServiceNow AI Platform. This security issue could allow an unauthenticated user to execute arbitrary code within the ServiceNow AI Platform, potentially leading to more access to the ServiceNow AI Platform than...

CVE-2026-6876 Sandbox Escape in ServiceNow AI Platform

ServiceNow has remediated a sandbox escape security issue that was identified in the ServiceNow AI Platform. This security issue could allow an unauthenticated user to execute arbitrary code within the ServiceNow AI Platform, potentially leading to more access to the ServiceNow AI Platform than...

EUVD-2026-67218

ServiceNow has remediated a sandbox escape security issue that was identified in the Now Platform. This security issue could allow an unauthenticated user to execute arbitrary code within the Now Platform, potentially leading to more access to the Now Platform than intended. ServiceNow deployed a...

CVE-2026-6876

CVE-2026-6876 is a sandbox escape in the ServiceNow Now Platform (AI Platform) that allows an unauthenticated user to execute arbitrary code , potentially gaining access beyond intended permissions. ServiceNow assigned a CVSS 4.0 score of 10.0 (CRITICAL) via its CNA, with the vector indicating ne...

CVE-2026-81716

opensslencrypt pip: openssl-encrypt versions before 1.4.9 contain a path traversal flaw in PluginSandbox.issafepath, which authorized file access using a bare string-prefix match. A sandboxed plugin without the READFILES permission could read or write another plugin's directory that merely shares...

CVE-2026-81097

The executeruby tool is documented as a read-only Ruby sandbox and is enforced by a pattern denylist together with replacements for the process-spawning methods on Kernel. The pseudo-terminal library's spawn entry points are neither in the denylist nor replaced, so a normal tool call could reach...

CVE-2026-81096

ToolUniverse ran caller-supplied Python inside a sandbox that could be escaped, on a server that required no authentication. The executor behind the pythoncodeexecutor tool, in pythonexecutortool.py, inspected the submitted source for a denied list of attribute names and calls but left the...

CVE-2026-79988

The Twig sandbox mechanism in Craft CMS is configured to allow dangerous functionality from the Yii framework, leading to authenticated RCE similar to previously disclosed vulnerabilities...

CVE-2026-79988

CVE-2026-79988 affects Craft CMS , where the Twig sandbox mechanism is misconfigured to allow dangerous functionality from the Yii framework , enabling authenticated remote code execution (RCE) . The vulnerability is rated CVSS 8.7 (HIGH) with a low complexity, network-based attack vector requiri...

EUVD-2026-67081

The Twig sandbox mechanism in Craft CMS is configured to allow dangerous functionality from the Yii framework, leading to authenticated RCE similar to previously disclosed vulnerabilities...

CVE-2026-79988 Authenticated RCE through Twig sandbox escape

The Twig sandbox mechanism in Craft CMS is configured to allow dangerous functionality from the Yii framework, leading to authenticated RCE similar to previously disclosed vulnerabilities...

CVE-2026-79988 Authenticated RCE through Twig sandbox escape

The Twig sandbox mechanism in Craft CMS is configured to allow dangerous functionality from the Yii framework, leading to authenticated RCE similar to previously disclosed vulnerabilities...

EUVD-2026-67069

opensslencrypt before 1.4.9 executes untrusted third-party plugins with insufficient controls: the plugin signature policy defaulted to WARN, so an unsigned/unverifiable non-built-in plugin was compiled and executed in the host process at import time, before the runtime sandbox is installed. The...

CVE-2026-81719 openssl_encrypt before 1.4.9 Remote Code Execution via Plugin

opensslencrypt before 1.4.9 executes untrusted third-party plugins with insufficient controls: the plugin signature policy defaulted to WARN, so an unsigned/unverifiable non-built-in plugin was compiled and executed in the host process at import time, before the runtime sandbox is installed. The...

CVE-2026-81719

openssl_encrypt versions before 1.4.9 are vulnerable to arbitrary code execution via third-party plugins. The plugin signature policy defaulted to WARN , allowing unsigned or unverifiable non-built-in plugins to be compiled and executed in the host process at import time—before the runtime sandbo...

CVE-2026-81719 openssl_encrypt before 1.4.9 Remote Code Execution via Plugin

opensslencrypt before 1.4.9 executes untrusted third-party plugins with insufficient controls: the plugin signature policy defaulted to WARN, so an unsigned/unverifiable non-built-in plugin was compiled and executed in the host process at import time, before the runtime sandbox is installed. The...

EUVD-2026-67066

opensslencrypt pip: openssl-encrypt versions before 1.4.9 contain a path traversal flaw in PluginSandbox.issafepath, which authorized file access using a bare string-prefix match. A sandboxed plugin without the READFILES permission could read or write another plugin's directory that merely shares...