vm2: NodeVM custom resolution bypasses external path boundaries
CVE-2026-100721
## Summary At source revision `91034466bfb7f56b95fd48083ec6ca36d058f164` of vm2 3.11.8, an untrusted `NodeVM` guest can
#advisory
共收录 23210 条相关情报。
← 返回所有主题vm2: Host Promise rejection from an exposed constructor can terminate the vm2 host process
CVE-2026-100722
## Summary An untrusted script run by `VM.run` can construct an embedder-exposed host function that returns a rejected
vm2: NodeVM zlib Buffers expose pooled host memory across the VM boundary
CVE-2026-100723
## Summary When an application explicitly exposes Node's `zlib` module through vm2's `NodeVM` builtin allowlist, an unt
GraphQL Tools: TLS Certificate Validation Disabled in Legacy GraphQL WebSocket Executor
CVE-2026-103921
## Impact `buildWSLegacyExecutor()` in `@graphql-tools/executor-legacy-ws` previously hardcoded `rejectUnauthorized: fa
GraphQL Tools has prototype pollution in well-established utility function `mergeDeep`
CVE-2026-104852
Closed by https://github.com/ardatan/graphql-tools/pull/8423 Mitigated in Hive Gateway by https://github.com/graphql-hiv
Snowflake drivers writes sensitive information to logs
CVE-2026-86597
Insertion of sensitive information into log files in the Snowflake Python, Go, JDBC, Node.js, PHP PDO, and ODBC drivers
Plane: Hardcoded SECRET_KEY and LIVE_SERVER_SECRET_KEY shipped in aio/cli community deployment manifests — session forgery and live-server auth bypass
CVE-2026-105641
Plane is an open-source project management tool. Prior to 1.4.0, the deployments/aio/community/ and deployments/cli/comm
Plane: Account Takeover via Unverified OAuth Email Match (Gitea, self-managed GitLab)
CVE-2026-105640
Plane is an open-source project management tool. Prior to 1.4.0, Plane trusts email addresses returned by Gitea OAuth an
Plane: Pre-auth workspace invitation hijack via email-squat and self-served invitation token leak in Plane
CVE-2026-105639
Plane is an open-source project management tool. Prior to 1.4.0, Plane's signup flow creates a logged-in User row for an
Plane: Magic-code verifier endpoint has no rate limit, enabling 6-digit OTP brute force
CVE-2026-105638
Plane is an open-source project management tool. Prior to 1.4.0, Plane's magic-code email login uses a six-digit numeric
Plane: Cross-Project Asset Hijacking via 'ProjectBulkAssetEndpoint' (sibling of CVE-2026-46558)
CVE-2026-105637
Plane is an open-source project management tool. Prior to 1.4.0, ProjectBulkAssetEndpoint.post in apps/api/plane/app/vie
Plane: SSRF via HTTP redirect in webhook delivery (allow_redirects not set)
CVE-2026-105636
Plane is an open-source project management tool. Prior to 1.4.0, the webhook delivery task in apps/api/plane/bgtasks/web
Plane: Unauthenticated Project Invitation Email Disclosure Enables Unauthorized Project Join Without Token
CVE-2026-105635
Plane is an open-source project management tool. Prior to 1.4.0, ProjectJoinEndpoint at GET /api/workspaces/{slug}/proje
Plane: Privilege Escalation: Project Guest Can Demote Admin/Member Roles
CVE-2026-105634
Plane is an open-source project management tool. Prior to 1.3.0, the ProjectMemberViewSet.partial_update method allows a
Plane: Issue Attachment Ownership Hijacking via Missing `issue_id` Scope
CVE-2026-105633
Plane is an open-source project management tool. Prior to 1.4.0, the V2 issue-attachment PATCH endpoint accepts issue_id
Plane: Broken Access Control - joinProject GraphQL mutation allows self-join into private (secret) projects
CVE-2026-105632
Plane is an open-source project management tool. Prior to 1.4.0, the GraphQL joinProject mutation lets any workspace mem
Oversized Dockerfile or .dockerignore can exhaust buildkitd memory
CVE-2026-93323
The Dockerfile frontend loaded the Dockerfile and .dockerignore files of a build context into memory without a size limi
Plane: asset download endpoints scope file lookups to the workspace (not the project / published entity) → cross-project & unauthenticated private-file disclosure
CVE-2026-105631
Plane is an open-source project management tool. Prior to 1.4.0, WorkspaceFileAssetEndpoint.get and WorkspaceAssetDownlo
Plane: Stored XSS via SVG attachment served inline on the application origin (account takeover)
CVE-2026-105630
Plane is an open-source project management tool. Prior to 1.4.0, an authenticated low-privilege workspace member, includ
Malformed MergeOp can crash the BuildKit daemon
CVE-2026-93322
A malicious frontend can submit an LLB definition that causes buildkitd to panic and terminate, interrupting all builds