CVE Database
1963 results
| CVE ID | Severity | CVSS | Description | MITRE TTPs | Flags | Published |
|---|---|---|---|---|---|---|
| CVE-2026-92947 | CRITICAL | 10.0 | vm2 before 3.11.7 exposes Node's shared Buffer pool to sandboxed code, allowing disclosure of host m… |
T1190
T1203
|
|
2026-09-17 |
| CVE-2026-92946 | CRITICAL | 10.0 | vm2 before 3.11.7 contains a remote code execution vulnerability when require.external is enabled wi… |
T1190
T1059
+1
|
|
2026-09-17 |
| CVE-2026-92944 | CRITICAL | 9.8 | vm2 versions 3.10.2 through 3.11.6 contain a sandbox escape vulnerability on Node.js 26 where Promis… |
T1190
T1203
|
|
2026-09-17 |
| CVE-2026-92941 | CRITICAL | 10.0 | vm2 versions from 3.11.3 before 3.11.7 expose the host tls module to NodeVM sandbox code, allowing a… |
T1190
T1203
|
|
2026-09-17 |
| CVE-2026-92940 | CRITICAL | 10.0 | vm2 versions 3.11.3 through 3.11.6 expose the host process's real https.globalAgent to sandboxed cod… |
T1190
T1203
|
|
2026-09-17 |
| CVE-2026-92939 | CRITICAL | 9.9 | vm2 3.11.3 through 3.11.6 exposes the host Node.js crypto module to a NodeVM sandbox when the crypto… |
T1190
T1203
|
|
2026-09-17 |
| CVE-2026-92938 | CRITICAL | 9.9 | vm2 versions 3.11.3 through 3.11.6 expose Node.js's host node:sqlite module to code running in NodeV… |
T1190
T1005
+1
|
|
2026-09-17 |
| CVE-2026-92937 | CRITICAL | 10.0 | vm2 3.11.6 is vulnerable to a sandbox escape leading to remote code execution in the host Node.js pr… |
T1190
T1059
+1
|
|
2026-09-17 |
| CVE-2026-92935 | CRITICAL | 9.0 | vm2 is a sandbox for running untrusted Node.js code. In versions >= 3.11.4 and <= 3.11.6, the NodeVM… |
T1190
T1059
+1
|
|
2026-09-17 |
| CVE-2026-92934 | CRITICAL | 9.0 | vm2 before 3.11.8 contains an incomplete fix for Error.cause sanitization that allows sandbox escape… |
T1190
T1059
+1
|
|
2026-09-17 |
| CVE-2026-62108 | CRITICAL | 9.8 | Unauthenticated Broken Authentication in Headless Single Sign On <= 1.7.0 versions. |
T1078
T1548
|
|
2026-09-17 |
| CVE-2026-62104 | CRITICAL | 10.0 | Unauthenticated Remote Code Execution (RCE) in Migratico Lite <= 2.6.8 versions. |
T1190
T1059
+1
|
|
2026-09-17 |
| CVE-2026-62101 | CRITICAL | 9.8 | Unauthenticated Broken Authentication in EduAdmin Booking <= 5.4.2 versions. |
T1078
T1548
|
|
2026-09-17 |
| CVE-2026-92860 | CRITICAL | 9.1 | A security flaw has been discovered in rcourtman Pulse up to 6.0.4/6.1.0-rc.4. Affected by this issu… |
T1190
T1203
|
|
2026-09-17 |
| CVE-2026-90823 | CRITICAL | 9.8 | FatPipe MPVPN, WARP, and IPVPN appliances running the end-of-life firmware version 10.1.2r60p100 con… |
T1190
T1059
+1
|
|
2026-09-17 |
| CVE-2026-90822 | CRITICAL | 9.8 | FatPipe MPVPN, WARP, and IPVPN appliances running the end-of-life firmware version 10.1.2r60p100 con… |
T1190
T1059
+1
|
|
2026-09-17 |
| CVE-2026-88795 | CRITICAL | 9.0 | The wpShopGermany IT-RECHT KANZLEI WordPress plugin before 2.4 does not generate its API authenticat… |
T1190
T1059
+1
|
|
2026-09-17 |
| CVE-2026-86710 | CRITICAL | 9.8 | The Login with QR WordPress plugin through 1.0.0 does not verify that the code used to log a user in… |
T1078
T1548
|
|
2026-09-17 |
| CVE-2026-86709 | CRITICAL | 9.8 | The Pressengine WordPress plugin through 1.0 does not stop its login handler from issuing a session … |
T1078
T1548
|
|
2026-09-17 |
| CVE-2026-86707 | CRITICAL | 9.8 | The Private Feed Key WordPress plugin through 0.1 does not verify that the key used to authenticate … |
T1078
T1548
|
|
2026-09-17 |