452134 matches found
EUVD-2026-81592
vm2 before 3.11.7 affected versions = 3.11.6 does not enforce the VM timeout option on code executed outside the synchronous VMrun call. The timeout only wraps the single call to runScript via doWithTimeout in lib/vm.js, and FinalizationRegistry and WeakRef are exposed to sandboxed code unmodifie...
EUVD-2026-81591
vm2 versions from 3.11.3 before 3.11.7 expose the host tls module to NodeVM sandbox code, allowing attackers to call tls.setDefaultCACertificates and replace process-wide certificate authorities. Attackers with access to allowed tls and url builtins can use URLSearchParams to create host-realm...
EUVD-2026-81590
vm2 versions 3.11.3 through 3.11.6 expose the host process's real https.globalAgent to sandboxed code when a NodeVM is explicitly configured to allow require'https'. The builtin loader wraps host modules in a read-only proxy, but method calls such as Agent.prototype.on are forwarded to the...
EUVD-2026-81589
vm2 3.11.3 through 3.11.6 exposes the host Node.js crypto module to a NodeVM sandbox when the crypto builtin is allowed. The module is presented via a recursive read-only proxy, but its callable exports still execute with host-process authority. Sandboxed JavaScript can therefore call...
EUVD-2026-81588
vm2 versions 3.11.3 through 3.11.6 expose Node.js's host node:sqlite module to code running in NodeVM when that builtin is permitted, either explicitly or through builtin: ''. The module is wrapped with vm.readonly, which prevents property assignment but leaves host-authority callables reachable;...
EUVD-2026-81587
vm2 3.11.6 is vulnerable to a sandbox escape leading to remote code execution in the host Node.js process. The fix for GHSA-m283-3h24-438v is incomplete: the bridge gate at lib/bridge.js:1624 identity-checks only the direct call target when deciding whether to rebuild/sanitise a rejected host...
EUVD-2026-81586
vm2 versions 3.11.0 through 3.11.6 leak absolute host filesystem paths to sandboxed code through error stack formatting. Attacker-supplied code can force the host-realm source transformer to throw a SyntaxError for example by calling eval with malformed source and then read the error's .stack...
EUVD-2026-81584
vm2 before 3.11.8 contains an incomplete fix for Error.cause sanitization that allows sandbox escape when revisited host-wrapped AggregateError objects are caught within a single exception handler traversal. Attackers can exploit cycle detection bypass in handleException to access unsanitized hos...
EUVD-2026-81585
vm2 is a sandbox for running untrusted Node.js code. In versions = 3.11.4 and = 3.11.6, the NodeVM constructor computes hasRealRequireConfig with typeof requireOpts === 'object' && requireOpts !== null, so an array-shaped require value for example require: satisfies the guard that is meant to...
EUVD-2026-81583
vm2 is a sandbox for running untrusted Node.js code. In versions = 22.9 this hands sandboxed code util.getCallSites, a programmatic stack-introspection API that returns the host process's full call stack, including absolute file paths, function names, and line numbers for vm2 bridge internals and...
EUVD-2026-81582
ansi2html versions 1.7.0a0 through 1.9.3 contain a cross-site scripting vulnerability in OSC 8 hyperlink handling that fails to validate or escape URL targets. Attackers controlling ANSI text input can inject javascript: schemes or terminate href attributes to execute arbitrary scripts in the...
EUVD-2026-81581
SGLang through 0.5.19 in prefill/decode disaggregation mode contains an unauthenticated PUT /route endpoint on the prefill bootstrap service that allows attackers to poison the KV transfer routing table. Attackers can supply arbitrary rankip and rankport values to redirect decode workers to...
EUVD-2026-81580
InternLM LMDeploy through 0.17.0 contains a reachable assertion vulnerability in the DistServe decode migration loop that allows unauthenticated attackers to terminate the inference engine. Attackers can submit a migrationrequest with an empty remoteblockids list to trigger an AssertionError that...
EUVD-2026-81579
HUBzero CMS through 2.2.32 contains a path traversal vulnerability in project file upload handlers that allows authenticated project members to write arbitrary files outside the project repository. Attackers can supply traversal sequences in upload parameters to write files to attacker-chosen pat...
EUVD-2026-81578
Dell OpenManage Server Administrator, versions prior to 11.1.0.3, contains a Cross-Site Request Forgery CSRF vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Remote execution...
EUVD-2026-81523
google-protobuf contains an unbounded recursion when parsing unknown protobuf group fields. An attacker can send a small crafted payload of deeply nested STARTGROUP wire bytes to any Node.js service that calls the generated deserializeBinary API, causing a RangeError: Maximum call stack size...
EUVD-2026-81522
The password reset funcionality is vulnerable to unauthorized account modification due to improper validation of the userid parameter. An attacker can manipulate this predictable numeric identifier to reset passwords for arbitrary users without proving account ownership...
EUVD-2026-81521
Unauthenticated Cross Site Scripting XSS in WP Inventory Manager = 2.5.4 versions...
EUVD-2026-81520
Unauthenticated Broken Access Control in BerqWP = 4.1.15 versions...
EUVD-2026-81519
Unauthenticated Cross Site Request Forgery CSRF in Xagio SEO = 7.1.0.43 versions...
EUVD-2026-81518
Contributor Cross Site Scripting XSS in Geo Mashup = 1.13.21 versions...
EUVD-2026-81517
Unauthenticated Broken Access Control in User Registration = 5.2.7 versions...
EUVD-2026-81516
Unauthenticated Cross Site Request Forgery CSRF in PublishPress Series = 3.1.3 versions...
EUVD-2026-81515
Unauthenticated Broken Access Control in Booking Calendar = 11.7 versions...
EUVD-2026-81513
Contributor Insecure Direct Object References IDOR in Cooked = 1.16.0 versions...
EUVD-2026-81514
Contributor Broken Access Control in Simple Membership = 4.8.2 versions...
EUVD-2026-81512
Unauthenticated Broken Access Control in Easy Invoice = 2.3.8 versions...
EUVD-2026-81511
Administrator SQL Injection in MC Woocommerce Wishlist = 1.9.21 versions...
EUVD-2026-81510
Administrator SQL Injection in PublishPress Series = 3.1.3 versions...
EUVD-2026-81509
Shop manager SQL Injection in WP-Lister Lite for eBay = 3.8.11 versions...
EUVD-2026-81507
Administrator SQL Injection in WC Vendors Marketplace = 2.7.2.1 versions...
EUVD-2026-81508
Editor SQL Injection in SKT Addons for Elementor = 4.0 versions...
EUVD-2026-81506
Administrator SQL Injection in WPMasterToolKit = 2.22.0 versions...
EUVD-2026-81505
Administrator SQL Injection in Newsletters = 4.18 versions...
EUVD-2026-81504
Administrator SQL Injection in WP Maps = 4.9.9 versions...
EUVD-2026-81503
Contributor Cross Site Scripting XSS in PublishPress Series = 3.1.3 versions...
EUVD-2026-81502
Contributor Server Side Request Forgery SSRF in Unlimited Elements For Elementor Free Widgets, Addons, Templates = 2.0.19 versions...
EUVD-2026-81501
Contributor SQL Injection in Product Feed Manager = 7.12.0 versions...
EUVD-2026-81500
Contributor Cross Site Scripting XSS in JetElements For Elementor = 2.9.2.1 versions...
EUVD-2026-81499
Contributor Cross Site Scripting XSS in PropertyHive = 2.2.6 versions...
EUVD-2026-81498
Contributor Cross Site Scripting XSS in JetSearch = 3.6.3 versions...
EUVD-2026-81496
Unauthenticated Insecure Direct Object References IDOR in King Addons for Elementor = 51.1.81 versions...
EUVD-2026-81497
Contributor Cross Site Scripting XSS in JetBlocks For Elementor = 1.5.2 versions...
EUVD-2026-81495
Contributor Cross Site Scripting XSS in Element Pack Elementor Addons = 8.8.3 versions...
EUVD-2026-81493
Contributor Cross Site Scripting XSS in JetBlog = 2.4.10 versions...
EUVD-2026-81494
Contributor Cross Site Scripting XSS in JetTabs = 2.3.3.1 versions...
EUVD-2026-81492
Unauthenticated Cross Site Request Forgery CSRF in Asset CleanUp: Page Speed Booster = 1.4.0.5 versions...
EUVD-2026-81491
Unauthenticated Broken Authentication in Headless Single Sign On = 1.7.0 versions...