CVE-2026-92935 vm2 NodeVM Remote Code Execution via Array-Shaped Require

vm2 is a sandbox for running untrusted Node.js code. In versions = 3.11.4 and = 3.11.6, the NodeVM constructor computes hasRealRequireConfig with typeof requireOpts === 'object' && requireOpts !== null, so an array-shaped require value for example require: satisfies the guard that is meant to...

CVE-2026-92935 vm2 NodeVM Remote Code Execution via Array-Shaped Require

vm2 is a sandbox for running untrusted Node.js code. In versions = 3.11.4 and = 3.11.6, the NodeVM constructor computes hasRealRequireConfig with typeof requireOpts === 'object' && requireOpts !== null, so an array-shaped require value for example require: satisfies the guard that is meant to...

CVE-2026-92934 vm2 before 3.11.8 Sandbox Escape RCE via AggregateError

vm2 before 3.11.8 contains an incomplete fix for Error.cause sanitization that allows sandbox escape when revisited host-wrapped AggregateError objects are caught within a single exception handler traversal. Attackers can exploit cycle detection bypass in handleException to access unsanitized hos...

CVE-2026-92934 vm2 before 3.11.8 Sandbox Escape RCE via AggregateError

vm2 before 3.11.8 contains an incomplete fix for Error.cause sanitization that allows sandbox escape when revisited host-wrapped AggregateError objects are caught within a single exception handler traversal. Attackers can exploit cycle detection bypass in handleException to access unsanitized hos...

CVE-2026-92935

vm2 is a sandbox for running untrusted Node.js code. In versions 3.11.4 through 3.11.6 , a flaw in the NodeVM constructor's guard (typeof requireOpts === 'object' && requireOpts !== null) allows an array-shaped require value (e.g., require: []) to pass, producing a resolver with only NESTING_OVER...

CVE-2026-92934

vm2 (a Node.js sandbox library) versions before 3.11.8 contain an incomplete fix for Error.cause sanitization . When a host-wrapped AggregateError object is revisited within a single exception handler traversal in handleException, the cycle detection bypass allows access to unsanitized host proxi...

CVE-2026-92917

Grav is a flat-file CMS. In versions 2.0.0-rc.1 through 2.0.21, the Twig content sandbox fails to restrict the dump and serialize filters printr, vardump, jsonencode, yamlencode, string: GravExtension::assertSandboxDumpSafe determines sandbox state by calling SandboxExtension::isSandboxed without...

CVE-2026-92917 Grav 2.0.0-rc.1 through 2.0.21 Configuration Disclosure via print_r

Grav is a flat-file CMS. In versions 2.0.0-rc.1 through 2.0.21, the Twig content sandbox fails to restrict the dump and serialize filters printr, vardump, jsonencode, yamlencode, string: GravExtension::assertSandboxDumpSafe determines sandbox state by calling SandboxExtension::isSandboxed without...

EUVD-2026-81439

Grav is a flat-file CMS. In versions 2.0.0-rc.1 through 2.0.21, the Twig content sandbox fails to restrict the dump and serialize filters printr, vardump, jsonencode, yamlencode, string: GravExtension::assertSandboxDumpSafe determines sandbox state by calling SandboxExtension::isSandboxed without...

CVE-2026-92917

In Grav (a flat-file CMS) versions 2.0.0-rc.1 through 2.0.21 , the Twig content sandbox fails to restrict dump and serialize filters (print_r, vardump, json_encode, yaml_encode, string). The guard GravExtension::assertSandboxDumpSafe() calls SandboxExtension::isSandboxed() without a Source argume...

CVE-2026-92917 Grav 2.0.0-rc.1 through 2.0.21 Configuration Disclosure via print_r

Grav is a flat-file CMS. In versions 2.0.0-rc.1 through 2.0.21, the Twig content sandbox fails to restrict the dump and serialize filters printr, vardump, jsonencode, yamlencode, string: GravExtension::assertSandboxDumpSafe determines sandbox state by calling SandboxExtension::isSandboxed without...

CVE-2026-92917 Grav 2.0.0-rc.1 through 2.0.21 Configuration Disclosure via print_r

Grav is a flat-file CMS. In versions 2.0.0-rc.1 through 2.0.21, the Twig content sandbox fails to restrict the dump and serialize filters printr, vardump, jsonencode, yamlencode, string: GravExtension::assertSandboxDumpSafe determines sandbox state by calling SandboxExtension::isSandboxed without...

CVE-2026-91729

A flaw was found in DigitalCredentials within Chromium. A remote attacker could exploit a use-after-free vulnerability by leveraging social engineering to entice a user to visit a specially crafted HTML page. Successful exploitation would allow the attacker to execute arbitrary code outside of th...

CVE-2026-91722

An use after free flaw was found in the Input component of the Chromium browser. Upstream bugs: https://code.google.com/p/chromium/issues/detail?id=554953456...

CVE-2026-91721

An use after free flaw was found in the Internals component of the Chromium browser. Upstream bugs: https://code.google.com/p/chromium/issues/detail?id=557320614...

CVE-2026-91749

An use after free flaw was found in the Workers component of the Chromium browser. Upstream bugs: https://code.google.com/p/chromium/issues/detail?id=558456602...

CVE-2026-92032

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Sandbox escape due to invalid pointer in the Graphics component...

Important: Red Hat Security Advisory: firefox security update

An update for firefox is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from t...

firefox: Sandbox escape due to use-after-free in the DOM: Navigation component

A flaw was found in Firefox. The Mozilla Foundation's Security Advisory describes the following issue: Sandbox escape due to use-after-free in the DOM: Navigation component...

firefox: Sandbox escape due to use-after-free in the DOM: Security component

A flaw was found in Firefox. The Mozilla Foundation's Security Advisory describes the following issue: Sandbox escape due to use-after-free in the DOM: Security component...