SUSE CVE-2026-93377

Type confusion in V8 in Google Chrome prior to 153.0.8010.52 allowed a remote attacker leveraging social engineering to execute arbitrary code inside the sandbox via a crafted HTML page. Chromium security severity: High...

SUSE CVE-2026-93435

redis-parser through 3.0.0 contains a denial of service vulnerability in the RESP protocol parser that allows malicious Redis endpoints to crash the client process through unbounded recursion on nested arrays. Attackers can send crafted RESP byte streams with repeated array headers that exhaust t...

Improper Control of Dynamically-Managed Code Resources

Overview vm2 is a sandbox that can run untrusted code with whitelisted Node's built-in modules. Affected versions of this package are vulnerable to Improper Control of Dynamically-Managed Code Resources via a sloppy-mode host function invoked from the sandbox with a nullish receiver. When sandbox...

CVE-2026-93603 vm2 before 3.12.1 Sandbox Escape RCE via Non-Strict Host Function

vm2 through 3.12.0 fixed in 3.12.1 does not correctly handle a nullish this receiver in the apply trap of its bridge lib/bridge.js: when sandboxed code calls a host-provided non-strict sloppy-mode function without a receiver — e.g. fn, a detached method, fn.call, fn.applyundefined, Reflect.applyf...

Linux Distros Unpatched Vulnerability : CVE-2026-93377

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Type confusion in V8 in Google Chrome prior to 153.0.8010.52 allowed a remote attacker leveraging social engineering to execute arbitrary code inside the sandbo...

DEBIAN-CVE-2026-93377

Type confusion in V8 in Google Chrome prior to 153.0.8010.52 allowed a remote attacker leveraging social engineering to execute arbitrary code inside the sandbox via a crafted HTML page. Chromium security severity: High...

CVE-2026-93377

Type confusion in V8 in Google Chrome prior to 153.0.8010.52 allowed a remote attacker leveraging social engineering to execute arbitrary code inside the sandbox via a crafted HTML page. Chromium security severity: High...

CVE-2026-93377

Type confusion in V8 in Google Chrome prior to 153.0.8010.52 allowed a remote attacker leveraging social engineering to execute arbitrary code inside the sandbox via a crafted HTML page. Chromium security severity: High...

EUVD-2026-82483

Type confusion in V8 in Google Chrome prior to 153.0.8010.52 allowed a remote attacker leveraging social engineering to execute arbitrary code inside the sandbox via a crafted HTML page. Chromium security severity: High...

CVE-2026-93377

A type confusion vulnerability exists in the V8 engine of Google Chrome prior to version 153.0.8010.52 . A remote attacker can leverage social engineering to execute arbitrary code inside the sandbox by navigating a victim to a crafted HTML page. This issue is addressed in the version 153.0.8010....

CVE-2026-93377

Type confusion in V8 in Google Chrome prior to 153.0.8010.52 allowed a remote attacker leveraging social engineering to execute arbitrary code inside the sandbox via a crafted HTML page. Chromium security severity: High...

CVE-2026-93377

Type confusion in V8 in Google Chrome prior to 153.0.8010.52 allowed a remote attacker leveraging social engineering to execute arbitrary code inside the sandbox via a crafted HTML page. Chromium security severity: High...

CVE-2026-93377

Type confusion in V8 in Google Chrome prior to 153.0.8010.52 allowed a remote attacker leveraging social engineering to execute arbitrary code inside the sandbox via a crafted HTML page. Chromium security severity: High...

CVE-2026-92961

vm2 before 3.11.6 fails to enforce its bufferAllocLimit cap on ArrayBuffer , SharedArrayBuffer , and TypedArray constructors. Attackers can exploit this by leveraging these V8 intrinsics to allocate arbitrary host process memory, bypassing the intended allocation ceiling and triggering an out-of-...

CVE-2026-92961 vm2 before 3.11.6 Memory Exhaustion DoS via bufferAllocLimit Bypass

vm2 before 3.11.6 fails to enforce bufferAllocLimit on ArrayBuffer, SharedArrayBuffer, and TypedArray constructors, allowing attackers to allocate arbitrary host memory. Attackers can bypass the buffer allocation cap by using these V8 intrinsics to exhaust host process memory and trigger...

CVE-2026-92961 vm2 before 3.11.6 Memory Exhaustion DoS via bufferAllocLimit Bypass

vm2 before 3.11.6 fails to enforce bufferAllocLimit on ArrayBuffer, SharedArrayBuffer, and TypedArray constructors, allowing attackers to allocate arbitrary host memory. Attackers can bypass the buffer allocation cap by using these V8 intrinsics to exhaust host process memory and trigger...

PT-2026-95078

Name of the Vulnerable Software and Affected Versions SAIL versions prior to 1.0.0 Description A heap overwrite occurs in the sail codec load frame v8 xbm function within src/sail-codecs/xbm/xbm.c when processing X10 static short files. The issue arises because the decoded pixel buffer is allocat...

CVE-2026-92944: Protection Mechanism Failure

vm2 versions 3.10.2 through 3.11.6 contain a sandbox escape vulnerability on Node.js 26 where Promise.prototype.finally bypasses vm2's wrapper protections due to a stale PromiseThenLookupChain protector in V8 14.6. Attackers can exploit this by creating an async function that returns a Promise wi...

CVE-2026-92961: Allocation of Resources Without Limits or Throttling

vm2 before 3.11.6 fails to enforce bufferAllocLimit on ArrayBuffer, SharedArrayBuffer, and TypedArray constructors, allowing attackers to allocate arbitrary host memory. Attackers can bypass the buffer allocation cap by using these V8 intrinsics to exhaust host process memory and trigger...

KLA91293 Multiple vulnerabilities in Microsoft Browser

Multiple vulnerabilities were found in Microsoft Browser. Malicious users can exploit these vulnerabilities to bypass security restrictions, cause denial of service, execute arbitrary code. Below is a complete list of vulnerabilities: 1. A remote code execution vulnerability in Network can be...