vm2 has a NodeVM builtin allowlist bypass via `module` builtin's `Module._load` that allows sandbox escape
CVE-2026-43999
## Summary NodeVM's `builtin` allowlist can be bypassed when the `module` builtin is allowed (including via the `'*'` wi
#severity:critical
共收录 1443 条相关情报。
← 返回所有主题vm2: Mutable Proxies for Host Intrinsic Prototypes Allows Sandbox Escape
CVE-2026-44005
### Summary vm2's bridge exposes mutable proxies for real host-realm intrinsic prototypes and then forwards sandbox writ
vm2 Access to Host Object Enables Sandbox Escape
CVE-2026-43997
### Summary It is possible to obtain the host `Object`, https://github.com/patriksimek/vm2/commit/ebcfe94ad2f864f0bc35e
vm2 has a Sandbox Escape Vulnerability
CVE-2026-44006
### Summary It is possible to reach `BaseHandler.getPrototypeOf`, which can be used to get arbitrary prototypes ### De
FileBrowser Public Share DELETE API Path Traversal Allows Unauthenticated Arbitrary File Deletion
CVE-2026-44542
### **Summary** Attacker-controlled path input is joined with a trusted base path prior to sanitization, allowing trave
ArgoCD ServerSideDiff is vulnerable to Kubernetes Secret Extraction
CVE-2026-42880
### Summary There is a missing authorization and data-masking gap in Argo CD's ServerSideDiff endpoint that allows an at
Fleet: Helm impersonation bypass of `RESTClientGetter` retains `cluster-admin` during template rendering
CVE-2026-41050
### Impact Fleet's Helm deployer did not fully apply ServiceAccount impersonation in two code paths, allowing a tenant
Gotenberg vulnerable to unauthenticated SSRF via default deny-list bypass in downloadFrom and webhook
CVE-2026-42596
### Summary The default deny-lists used by Gotenberg's `downloadFrom` feature and `webhook` feature are bypassable. Beca
Gotenberg has Unauthenticated RCE via ExifTool Metadata Key Injection
CVE-2026-42589
# Unauthenticated RCE in Gotenberg via Metadata Key Newline Injection ## Summary Gotenberg's `/forms/pdfengines/metada
Compromise of PyTorch Lightning PyPi Package Versions
CVE-2026-44484
# Security Advisory: Compromise of PyTorch Lightning PyPI Package Versions **Published:** 2026-04-30 **Last Updated:*
Axonflow fixed bugs by implementing multi-tenant isolation and access-control hardening
## Summary Eight independently-filed bug fixes in the v7.1.3 → v7.5.0 release window collectively close a set of multi-
ArcadeDB vulnerable to cross-database authorization bypass and unsecured newly-created databases
CVE-2026-44221
### Impact Authenticated users and API tokens scoped to a specific database could read, write, and mutate schema on any
Grav has multiple RCE vectors: unsafe unserialize (x3), command injection in git clone, SSTI blocklist bypass
Multiple RCE vectors were found in Grav CMS. Three are critical, two are high. **1. Unsafe unserialize() in JobQueue —
Grav Vulnerable to Privilege Escalation via Missing Server-Side Validation of groups/access
CVE-2026-42613
# Bug Report: Registration Privilege Escalation via Missing Server-Side Validation of groups/access ## Summary The `Lo
Grav Vulnerable to Remote Code Execution (RCE) via Malicious Plugin ZIP Upload in Direct Install Feature
CVE-2026-42607
### Summary An authenticated user with administrative privileges can achieve Remote Code Execution (RCE) by uploading a
DevGuard has an unauthenticated identity assertion via `X-Admin-Token` header
CVE-2026-42300
### Impact The `SessionMiddleware` accepts a client-supplied `X-Admin-Token` HTTP request header and uses its raw string
MagicMirror vulnerable to unauthenticated SSRF via /cors endpoint
CVE-2026-42281
### Summary An unauthenticated Server-Side Request Forgery (SSRF) vulnerability in the `/cors` endpoint allows any remo
django-s3file is vulnerable to relative path traversal
CVE-2026-42196
### Impact `S3FileMiddleware` is vulnerable to relative path traversal attacks, where an attacker can use a modified req
Magento LTS has Weak API Session ID — Predictable MD5 of Time-Derived Inputs
CVE-2026-42155
Affected Version: OpenMage LTS ≤ 20.16.0 (confirmed on `20.16.0`) Affected File: `https://github.com/OpenMage/magento-l
The MoreConvert Pro plugin for WordPress is vulnerable to Authentication Bypass in all versions...
CVE-2026-5722
The MoreConvert Pro plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 1.