Sudo through 1.9.17p2 Intercept Policy Bypass via execveat
CVE-2026-82474
Sudo through 1.9.17p2 fails to apply intercept policy checks to the execveat system call in ptrace-based intercept mode.
#cwe-693
共收录 445 条相关情报。
← 返回所有主题Kimai versions before 2.56.0 fail to restrict the config() Twig function in sandboxed invoice and...
CVE-2026-80198
Kimai versions before 2.56.0 fail to restrict the config() Twig function in sandboxed invoice and export templates, allo
ServiceNow has remediated a sandbox escape security issue that was identified in the Now Platform. This security issue could allow an unauthenticated user to execute arbitrary c...
CVE-2026-6876
ServiceNow has remediated a sandbox escape security issue that was identified in the Now Platform. This security issue c
Spring Security's InetAddressMatchers utility provides matchInternal() and matchExternal() builders for constructing an InetAddressMatcher that classifies a given IP address as ...
CVE-2026-59277
Spring Security's InetAddressMatchers utility provides matchInternal() and matchExternal() builders for constructing an
The Twig sandbox mechanism in Craft CMS is configured to allow dangerous functionality from the Yii framework, leading to authenticated RCE similar to previously disclosed vulne...
CVE-2026-79988
The Twig sandbox mechanism in Craft CMS is configured to allow dangerous functionality from the Yii framework, leading t
Authenticated RCE through Twig sandbox escape
CVE-2026-79988
The Twig sandbox mechanism in Craft CMS is configured to allow dangerous functionality from the Yii framework, leading t
Protection mechanism failure in HttpsUpgrades in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to bypass web origin policy via crafted network traffic. (Chromiu...
CVE-2026-79006
Protection mechanism failure in HttpsUpgrades in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to bypas
NVIDIA DGX Spark contains a vulnerability in UEFI where a Attacker may cause a/an CWE-693 by privileged local user. A successful exploit of this vulnerability may allow an attac...
CVE-2026-47624
NVIDIA DGX Spark contains a vulnerability in UEFI where a Attacker may cause a/an CWE-693 by privileged local user. A su
Winter CMS versions before 1.2.13 contain an incomplete fix for a Twig sandbox escape vulnerability in System\\Twig\\SecurityPolicy that allows authenticated backend users with ...
CVE-2026-79774
Winter CMS versions before 1.2.13 contain an incomplete fix for a Twig sandbox escape vulnerability in System\\Twig\\Sec
VeraCrypt provides disk encryption with strong security based on TrueCrypt. From 1.26.6 until 1.26.29, file-hosted hidden volume creation forces quick format and the FormatNoFs ...
CVE-2026-54073
VeraCrypt provides disk encryption with strong security based on TrueCrypt. From 1.26.6 until 1.26.29, file-hosted hidde
Winter: Authenticated Twig sandbox escape in CMS SecurityPolicy (bypass of CVE-2024-54149)
### Impact Affected versions of Winter CMS allow authenticated backend users with CMS template-editing permissions to e
A flaw was found in search-indexer. This vulnerability allows a registered and authenticated managed cluster to tamper with or delete another cluster's indexed search data. This...
CVE-2026-76827
A flaw was found in search-indexer. This vulnerability allows a registered and authenticated managed cluster to tamper w
Streambert is a cross-platform Electron Desktop App to stream and download video content. From version 2.5.0 until version 2.6.0, the wyzie-open-redeem IPC handler in index.js c...
CVE-2026-52873
Streambert is a cross-platform Electron Desktop App to stream and download video content. From version 2.5.0 until versi
Trilium Notes is a cross-platform, hierarchical note taking application focused on building large personal knowledge bases. Prior to 0.103.0, the #iconClass label value is retur...
CVE-2026-45733
Trilium Notes is a cross-platform, hierarchical note taking application focused on building large personal knowledge bas
Sandbox escape in the Remote Settings Client component. This vulnerability was fixed in Firefox 154 and Thunderbird 154.
CVE-2026-75874
Sandbox escape in the Remote Settings Client component. This vulnerability was fixed in Firefox 154 and Thunderbird 154.
Mitigation bypass in the JavaScript: GC component. This vulnerability was fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153.1.
CVE-2026-74938
Mitigation bypass in the JavaScript: GC component. This vulnerability was fixed in Firefox 154, Firefox ESR 153.1, Thund
A logic issue was addressed with improved checks. This issue is fixed in iOS 26.6.1 and iPadOS 26.6.1, macOS Tahoe 26.6.2. An app may be able to leak sensitive user information.
CVE-2026-65339
A logic issue was addressed with improved checks. This issue is fixed in iOS 26.6.1 and iPadOS 26.6.1, macOS Tahoe 26.6.
vm2 is an open source vm/sandbox for Node.js. Prior to 3.11.6, handleException() in lib/setup-sandbox.js sanitizes SuppressedError.error, SuppressedError.suppressed, and Aggrega...
CVE-2026-47686
vm2 is an open source vm/sandbox for Node.js. Prior to 3.11.6, handleException() in lib/setup-sandbox.js sanitizes Suppr
VM2 has Missing Error.cause Sanitization that Enables Sandbox Escape to RCE
CVE-2026-47686
**Affected:** vm2 { throw new Error('fail', { cause: process }); } } }); const result = vm.run
Scriban before 7.0.0 caches TypedObjectAccessor by Type only without considering MemberFilter...
CVE-2026-74790
Scriban before 7.0.0 caches TypedObjectAccessor by Type only without considering MemberFilter changes, allowing reused T