398008 matches found
CVE-2026-92959 vm2 before 3.11.8 allowAsync Bypass via Promise Thenable
vm2 before 3.11.8 does not fully enforce the allowAsync: false option in VM and NodeVM. While localPromise.prototype.then is replaced with a handler that throws 'Async not available', the sandbox's Promise static methods Promise.resolve, Promise.all, Promise.race, Promise.any, and...
CVE-2026-71568 BMCtest exposes Ironic without authentication and TLS during the test
In BMCtest, Ironic is started without authentication and TLS for the duration of the test. Exploiting the problem requires winning the race with bmctest itself, which reduces the attack window and significantly increases its complexity...
CVE-2026-92958 vm2 before 3.11.7 Denylist Bypass via fs/promises
vm2 through 3.11.6 contains a builtin-module denylist bypass in NodeVM. When the embedder uses the builtin wildcard together with negative entries e.g. require: builtin: '', '-fs', '-childprocess' , negative entries are matched by exact module name in lib/builtin.js, so -fs removes only the built...
CVE-2026-92956 vm2 3.10.1 through 3.11.6 Sandbox Escape via WebAssembly.compileStreaming
vm2 versions 3.10.1 through 3.11.6 contain a sandbox escape reachable from a default new VM sandbox when running on Node.js 26. WebAssembly.compileStreaming and WebAssembly.instantiateStreaming can produce a raw host-realm Promise that rejects with a host-realm error object; by controlling...
CVE-2026-92957 vm2 before 3.11.7 Authentication Bypass via node: Prefix
vm2 through 3.11.6 does not normalize node:-prefixed builtin specifiers when evaluating user-supplied negative deny entries in a NodeVM wildcard require policy. Although NodeVM strips the node: prefix during require resolution, negative wildcard entries are matched by exact string comparison...
CVE-2026-92955 vm2 before 3.11.8 Sandbox Escape via NodeVM
vm2 before 3.11.8 contains a sandbox escape vulnerability in NodeVM that allows attackers to access the host proto getter/setter through console.stdout and console.stderr. Attackers can overwrite EventEmitter.prototype.emit and trigger process events to execute code with process context, bypassin...
CVE-2026-92954 vm2 3.10.0 through 3.11.5 Denial of Service via Host Promise
vm2 is a sandbox library for running untrusted JavaScript in Node.js. In versions = 3.10.0 and = 3.11.7, Promises returned from the host realm into the sandbox are not marked as handled at the bridge boundary; only Promises created inside the sandbox are wrapped with a rejection-swallowing handle...
CVE-2026-92953 vm2 3.11.0 through 3.11.7 Prototype Pollution via TypedArray
vm2 versions from 3.11.0 before 3.11.8 fail to protect host TypedArray and ArrayBuffer prototypes from sandbox mutation. Attackers can use prototype-walking primitives to reach and modify host Uint8Array.prototype, %TypedArray%.prototype, and ArrayBuffer.prototype, causing host-created typed arra...
CVE-2026-92952 vm2 3.11.4 through 3.11.6 Sandbox Symbol Filtering Bypass
vm2 versions 3.11.4 through 3.11.6 incompletely filter Node.js registered internal symbols across the sandbox boundary. The extraction filters in lib/setup-sandbox.js and the cross-realm symbol checks and write traps in lib/bridge.js use a fixed list of known dangerous registered symbols that omi...
CVE-2026-92951 vm2 before 3.11.7 Module Allowlist Bypass via Custom Resolver
vm2 before 3.11.7 contains an incorrect authorization vulnerability in the external package allowlist check that uses non-exact substring matching instead of full package-name boundary validation. Attackers can bypass the allowlist by requiring a colliding package name that contains an allowliste...
CVE-2026-92950 vm2 before 3.11.7 Sandbox Escape via CLI require
vm2 before 3.11.7 contains a sandbox escape vulnerability in the CLI tool that allows attackers to execute arbitrary code in the host Node.js process. Attackers can supply a malicious script file to the vm2 CLI that uses requirefilename to re-execute itself in the host realm, bypassing sandbox...
CVE-2026-92949 vm2 3.9.6 before 3.11.7 Sandbox Bypass via Accessor Descriptor
vm2 versions from 3.9.6 before 3.11.7 fail to properly restrict access to accessor properties on frozen objects, allowing sandboxed scripts to bypass vm.freeze and vm.readonly protections. Attackers can use Object.getOwnPropertyDescriptor or lookupSetter to extract and invoke host object setters...
CVE-2026-92948 vm2 3.9.6 through 3.11.5 Sandbox Escape via node:test
vm2 versions = 3.9.6 and therefore executes arbitrary JavaScript in an unrestricted host Node process outside the NodeVM sandbox. Fixed in vm2 3.11.7...
CVE-2026-92947 vm2 before 3.11.7 Memory Disclosure via Buffer Pool
vm2 before 3.11.7 exposes Node's shared Buffer pool to sandboxed code, allowing disclosure of host memory used by Buffer.from, Buffer.concat, and related allocations. Sandboxed code can read and write to host-realm buffers by acquiring ArrayBuffers from small allocations, leading to sensitive dat...
CVE-2026-92946 vm2 before 3.11.7 Remote Code Execution via require.external
vm2 before 3.11.7 contains a remote code execution vulnerability when require.external is enabled without an explicit require.root that excludes nodemodules. Sandboxed code can require vm2's own package, instantiate an unrestricted NodeVM instance, and execute arbitrary host OS commands via...
CVE-2026-92945 vm2 before 3.11.7 Module Allowlist Bypass via Prefix Matching
vm2 before 3.11.7 contains a module allowlist bypass vulnerability in isPathAllowedForModule that uses raw string prefix matching instead of boundary-anchored comparison. Attackers can reach non-allowlisted packages sharing a prefix with allowlisted modules by performing relative requires from...
CVE-2026-92944 vm2 3.10.2 through 3.11.6 Sandbox Escape via Promise Protector
vm2 versions 3.10.2 through 3.11.6 contain a sandbox escape vulnerability on Node.js 26 where Promise.prototype.finally bypasses vm2's wrapper protections due to a stale PromiseThenLookupChain protector in V8 14.6. Attackers can exploit this by creating an async function that returns a Promise wi...
CVE-2026-92942 vm2 before 3.11.7 Timeout Bypass via FinalizationRegistry
vm2 before 3.11.7 affected versions = 3.11.6 does not enforce the VM timeout option on code executed outside the synchronous VMrun call. The timeout only wraps the single call to runScript via doWithTimeout in lib/vm.js, and FinalizationRegistry and WeakRef are exposed to sandboxed code unmodifie...
CVE-2026-92941 vm2 3.11.3 before 3.11.7 TLS Trust Store Manipulation
vm2 versions from 3.11.3 before 3.11.7 expose the host tls module to NodeVM sandbox code, allowing attackers to call tls.setDefaultCACertificates and replace process-wide certificate authorities. Attackers with access to allowed tls and url builtins can use URLSearchParams to create host-realm...
CVE-2026-92940 vm2 3.11.3 through 3.11.6 HTTPS Credential Exposure via globalAgent
vm2 versions 3.11.3 through 3.11.6 expose the host process's real https.globalAgent to sandboxed code when a NodeVM is explicitly configured to allow require'https'. The builtin loader wraps host modules in a read-only proxy, but method calls such as Agent.prototype.on are forwarded to the...
CVE-2026-92939 vm2 3.11.3 through 3.11.6 Native Code Execution via crypto.setEngine
vm2 3.11.3 through 3.11.6 exposes the host Node.js crypto module to a NodeVM sandbox when the crypto builtin is allowed. The module is presented via a recursive read-only proxy, but its callable exports still execute with host-process authority. Sandboxed JavaScript can therefore call...
CVE-2026-92937 vm2 3.11.6 Remote Code Execution via Promise call/apply
vm2 3.11.6 is vulnerable to a sandbox escape leading to remote code execution in the host Node.js process. The fix for GHSA-m283-3h24-438v is incomplete: the bridge gate at lib/bridge.js:1624 identity-checks only the direct call target when deciding whether to rebuild/sanitise a rejected host...
CVE-2026-92938 vm2 3.11.3 through 3.11.6 Remote Code Execution via node:sqlite
vm2 versions 3.11.3 through 3.11.6 expose Node.js's host node:sqlite module to code running in NodeVM when that builtin is permitted, either explicitly or through builtin: ''. The module is wrapped with vm.readonly, which prevents property assignment but leaves host-authority callables reachable;...
CVE-2026-92936 vm2 3.11.0 before 3.11.7 Information Disclosure via Error Stack
vm2 versions 3.11.0 through 3.11.6 leak absolute host filesystem paths to sandboxed code through error stack formatting. Attacker-supplied code can force the host-realm source transformer to throw a SyntaxError for example by calling eval with malformed source and then read the error's .stack...
CVE-2026-92935 vm2 NodeVM Remote Code Execution via Array-Shaped Require
vm2 is a sandbox for running untrusted Node.js code. In versions = 3.11.4 and = 3.11.6, the NodeVM constructor computes hasRealRequireConfig with typeof requireOpts === 'object' && requireOpts !== null, so an array-shaped require value for example require: satisfies the guard that is meant to...
CVE-2026-92934 vm2 before 3.11.8 Sandbox Escape RCE via AggregateError
vm2 before 3.11.8 contains an incomplete fix for Error.cause sanitization that allows sandbox escape when revisited host-wrapped AggregateError objects are caught within a single exception handler traversal. Attackers can exploit cycle detection bypass in handleException to access unsanitized hos...
CVE-2026-92933 vm2 before 3.11.8 Information Disclosure via util.getCallSites
vm2 is a sandbox for running untrusted Node.js code. In versions = 22.9 this hands sandboxed code util.getCallSites, a programmatic stack-introspection API that returns the host process's full call stack, including absolute file paths, function names, and line numbers for vm2 bridge internals and...
CVE-2026-92973 ansi2html 1.7.0a0 through 1.9.3 Cross-Site Scripting via OSC 8
ansi2html versions 1.7.0a0 through 1.9.3 contain a cross-site scripting vulnerability in OSC 8 hyperlink handling that fails to validate or escape URL targets. Attackers controlling ANSI text input can inject javascript: schemes or terminate href attributes to execute arbitrary scripts in the...
CVE-2026-92972 SGLang through 0.5.19 Unauthenticated Route Poisoning via PUT endpoint
SGLang through 0.5.19 in prefill/decode disaggregation mode contains an unauthenticated PUT /route endpoint on the prefill bootstrap service that allows attackers to poison the KV transfer routing table. Attackers can supply arbitrary rankip and rankport values to redirect decode workers to...
CVE-2026-92970 HUBzero CMS through 2.2.32 Path Traversal via File Upload
HUBzero CMS through 2.2.32 contains a path traversal vulnerability in project file upload handlers that allows authenticated project members to write arbitrary files outside the project repository. Attackers can supply traversal sequences in upload parameters to write files to attacker-chosen pat...
CVE-2026-92971 InternLM LMDeploy through 0.17.0 Assertion Denial of Service
InternLM LMDeploy through 0.17.0 contains a reachable assertion vulnerability in the DistServe decode migration loop that allows unauthenticated attackers to terminate the inference engine. Attackers can submit a migrationrequest with an empty remoteblockids list to trigger an AssertionError that...
CVE-2026-80355
Dell OpenManage Server Administrator, versions prior to 11.1.0.3, contains a Cross-Site Request Forgery CSRF vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Remote execution...
CVE-2026-89418 Uncontrolled Recursion leading to Denial of Service in protobuf-javascript (google-protobuf)
google-protobuf contains an unbounded recursion when parsing unknown protobuf group fields. An attacker can send a small crafted payload of deeply nested STARTGROUP wire bytes to any Node.js service that calls the generated deserializeBinary API, causing a RangeError: Maximum call stack size...
CVE-2026-14850 Weak password recovery mechanism for forgotten password in MobiAPParc
The password reset funcionality is vulnerable to unauthorized account modification due to improper validation of the userid parameter. An attacker can manipulate this predictable numeric identifier to reset passwords for arbitrary users without proving account ownership...
CVE-2026-90887 WordPress WP Inventory Manager plugin <= 2.5.4 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting XSS in WP Inventory Manager = 2.5.4 versions...
CVE-2026-78528 WordPress BerqWP plugin <= 4.1.15 - Broken Access Control vulnerability
Unauthenticated Broken Access Control in BerqWP = 4.1.15 versions...
CVE-2026-78295 WordPress Xagio SEO plugin <= 7.1.0.43 - Cross Site Request Forgery (CSRF) vulnerability
Unauthenticated Cross Site Request Forgery CSRF in Xagio SEO = 7.1.0.43 versions...
CVE-2026-78294 WordPress Geo Mashup plugin <= 1.13.21 - Cross Site Scripting (XSS) vulnerability
Contributor Cross Site Scripting XSS in Geo Mashup = 1.13.21 versions...
CVE-2026-74017 WordPress User Registration plugin <= 5.2.7 - Broken Access Control vulnerability
Unauthenticated Broken Access Control in User Registration = 5.2.7 versions...
CVE-2026-74005 WordPress PublishPress Series plugin <= 3.1.3 - Cross Site Request Forgery (CSRF) vulnerability
Unauthenticated Cross Site Request Forgery CSRF in PublishPress Series = 3.1.3 versions...
CVE-2026-74002 WordPress Booking Calendar plugin <= 11.7 - Broken Access Control vulnerability
Unauthenticated Broken Access Control in Booking Calendar = 11.7 versions...
CVE-2026-73999 WordPress Cooked plugin <= 1.16.0 - Insecure Direct Object References (IDOR) vulnerability
Contributor Insecure Direct Object References IDOR in Cooked = 1.16.0 versions...
CVE-2026-74000 WordPress Simple Membership plugin <= 4.8.2 - Broken Access Control vulnerability
Contributor Broken Access Control in Simple Membership = 4.8.2 versions...
CVE-2026-66676 WordPress Easy Invoice plugin <= 2.3.8 - Broken Access Control vulnerability
Unauthenticated Broken Access Control in Easy Invoice = 2.3.8 versions...
CVE-2026-66630 WordPress PublishPress Series plugin <= 3.1.3 - SQL Injection vulnerability
Administrator SQL Injection in PublishPress Series = 3.1.3 versions...
CVE-2026-66631 WordPress MC Woocommerce Wishlist plugin <= 1.9.21 - SQL Injection vulnerability
Administrator SQL Injection in MC Woocommerce Wishlist = 1.9.21 versions...
CVE-2026-66628 WordPress WP-Lister Lite for eBay plugin <= 3.8.11 - SQL Injection vulnerability
Shop manager SQL Injection in WP-Lister Lite for eBay = 3.8.11 versions...
CVE-2026-66625 WordPress WC Vendors Marketplace plugin <= 2.7.2.1 - SQL Injection vulnerability
Administrator SQL Injection in WC Vendors Marketplace = 2.7.2.1 versions...