vm2

CVE-2026-47686 (CVSS 9.9): PoC Hijacks Host via vm2 Escape

vm2 sandbox escape CVE-2026-47686 CVSS 9.9 proof-of-concept exploit hijacks the host via Error.cause

CVE-2026-47686 (CVSS 9.9): PoC Hijacks Host via vm2 Escape

Do Son August 20, 2026

A vm2 sandbox escape (CVE-2026-47686, CVSS 9.9) with public PoC lets attackers hijack the host. Two more critical flaws patched in 3.11.6.

5.7 Million Users at Risk: Multiple 9.8 CVSS Breakthroughs Enable Remote Code Execution in vm2 Sandbox

shell-quote command injection AI-Driven Vulnerabilities Q1 2026 Cyber Threats vm2 Sandbox Escape Node.js RCE upKeeper Privilege Escalation CVE-2026-2449 Pharos Controls Vulnerability Root Access Exploit Cybersecurity Vulnerability Roundup CVSS 10.0 Flaws Shadow Archives CVE-2026-0866 MS-Agent Prompt Injection CVE-2026-2256 basic-ftp Path Traversal CVE-2026-27699 telnetd Root Vulnerability CVE-1999-0073 Regression USR-W610 Vulnerabilities End-of-Life IoT Security IceWarp Security Update IceWarp Vulnerabilities Airleader Master Vulnerability CVE-2026-1358 ZLAN5143D Vulnerability CISA ICS Advisory Acronis Cyber Protect Vulnerability CVE-2025-30411 WAGO 852 Vulnerability OT Network Security SandboxJS Vulnerability Sandbox Escape (CVSS 10.0) Kubernetes Local Path Provisioner CVE-2025-62878 CISA Unresponsive Vendors Avation & RISS Vulnerabilities KiloView Vulnerability CVE-2026-1453 OpenClaw RCE vulnerability Johnson Controls Vulnerability CVE-2025-26385 SandboxJS Vulnerability CVE-2026-23830 ibaPDA Vulnerability CVE-2025-14988 Protobuf Vulnerability CVE-2026-0994 AVEVA Process Optimization Vulnerability CVE-2025-61937 ConnectWise PSA Vulnerability CVE-2026-0695 Aruba VIA Vulnerability CVE-2025-37186 aiohttp v3.13.3, Denial of Service (DoS) SmarterMail RCE, CVE-2025-52691 Airoha RACE, Headphone Jacking HPE OneView RCE CVE-2025-37164 FreePBX Auth Bypass, PBX Takeover ScreenConnect Config Flaw, Untrusted Extensions Ruby SAML Auth Bypass, XML Parser Differential Devolutions SQL Injection, Password Manager Flaw Vivotek Unauthenticated RCE, EOL IP Camera Flaw Lynx+ Critical Flaw, Unauthenticated Reset Firebox Default Credentials, CVE-2025-59396 Veeder-Root RCE, Critical ATG Flaw ArcGIS Server SQLi Watchdoc RCE, CVE-2025-58384 Delta DIALink Daikin Security Gateway, authentication bypass Frostbyte10, industrial controller security SunPower, vulnerability Ubiquiti UniFi Connect, EV Station Vulnerabilities Adobe Experience Manager, RCE Vulnerability UniFi Access, Command Injection LDAPNightmare - CVE-2025-1316

5.7 Million Users at Risk: Multiple 9.8 CVSS Breakthroughs Enable Remote Code Execution in vm2 Sandbox

Do Son May 6, 2026

Critical 9.8 CVSS flaws in vm2 affect 5.7M monthly users, allowing RCE via WASM and Promise bypasses. Upgrade to vm2 v3.11.0 immediately to secure your host.

CVSS 9.8 Sandbox Escape: Critical vm2 Flaw Exposes Millions of Apps Lockbit ransomware vm2 Vulnerability Sandbox Escape

Lockbit ransomware vm2 Vulnerability Sandbox Escape

CVSS 9.8 Sandbox Escape: Critical vm2 Flaw Exposes Millions of Apps

Do Son January 27, 2026

CVSS 9.8 vm2 flaw (CVE-2026-22709) affects 3.7 million users, allowing total sandbox escape via async functions. Update to v3.10.2 immediately.

Exploit available for critical RCE (CVE-2023-32314) bug in VM2 sandbox library

CVE-2023-32314

Exploit available for critical RCE (CVE-2023-32314) bug in VM2 sandbox library

Do Son May 15, 2023

CVE-2023-32314, (CVSS score of 9.8) vulnerability could allow a malicious entity to bypass the sandbox protections.

CVE-2023-30547: Critical Security Flaw in Popular JavaScript Sandbox Module vm2

CVE-2023-30547

CVE-2023-30547: Critical Security Flaw in Popular JavaScript Sandbox Module vm2

Do Son April 18, 2023

CVE-2023-30547 flaw could enable attackers to break out of security boundaries and execute arbitrary shellcodes.

CVE-2023-29017: Critical RCE Flaw in Popular vm2 JavaScript Sandbox

CVE-2023-29017

CVE-2023-29017: Critical RCE Flaw in Popular vm2 JavaScript Sandbox

Do Son April 6, 2023

With a CVSS score of 10, the CVE-2023-29017 vulnerability is a significant concern for users of this popular sandboxing tool.

📈

EPSS Spike Alerts
Catch risk spikes before they make headlines.

🎯

Custom EPSS/CVSS
Set score thresholds to effectively filter noise.

🛡️

Exploit Intel
Real-world exploit signals beyond the KEV catalog.

🐙

GitHub Issues
Auto-create alert tickets without duplication.

📬

Weekly Digest
Clean summaries, eliminating email spam.

🏷️

Watchlist Groups
Tag vulnerabilities by team (Infra/AppSec/SOC).

🔀

Smart Routing
Route chat channels based on severity levels.

🚨

RBP Tracker
Early warning detection and tracking system.

or try free for 14 days →

CVE-2026-125350
Use after free in XML. Reported by anonymous on 2026-11-06. Google is aware that an exploit for CVE-2026-125350...
Admin intel📅 Updated: Nov 10, 2026
CVE-2026-123751CVSS 9.8
The WP Duplicate WordPress plugin through 1.1.11 does not properly verify a request authentication value and does not...
Watchtower Verified📅 Updated: Nov 9, 2026
CVE-2026-111793CVSS 4.3
Openwave Webtop Media Transcoder does not enforce administrator-defined file type restrictions to restrict the file-types to be converted....
Admin intel📅 Updated: Nov 9, 2026
CVE-2026-114713CVSS 8.6
The labeled-response module in UnrealIRCd 6.0.0 before 6.2.7.1 does not escape the IRCv3 "label" message tag when echoing...
Admin intel📅 Updated: Nov 9, 2026
CVE-2026-116779CVSS 9.8
Summary `sofia_presence_handle_sip_i_message()` splits the To user of an inbound SIP MESSAGE on `+` and treats the left half...
CISA KEV📅 Added to KEV: Nov 9, 2026
CVE-2026-102895CVSS 9.8
GPUStack is an open-source GPU cluster manager for AI model serving and GPU instance provisioning. Prior to 2.2.0,...
CISA KEV📅 Added to KEV: Nov 9, 2026
CVE-2026-123158CVSS 8.1
sshd in OpenSSH before 10.6p2 on Linux, when musl libc is used without PAM, lacks a workaround for...
CISA KEV📅 Added to KEV: Nov 9, 2026
CVE-2026-19868CVSS 7.5
An authentication enforcement vulnerability in SonicOS SSLVPN service may allow a user with valid credentials for an alternate...
CISA KEV📅 Added to KEV: Nov 6, 2026

CVE-2026-125383CVSS 9.3
INDOTALENT WHMS (Asp.Net-Core-Inventory-Order-Management-System) before 10.20261109 contains an authentication bypass vulnerability caused by a hard-coded JWT signing key, issuer...
📅 Updated: Nov 9, 2026
CVE-2026-125384CVSS 9.3
INDOTALENT WHMS before 10.20261109 contains a default credentials vulnerability that allows unauthenticated attackers to gain administrator access because...
📅 Updated: Nov 9, 2026
CVE-2026-125370CVSS 9.3
Kubero 3.0.0 through 3.1.1 contains an authentication bypass vulnerability that allows unauthenticated remote attackers to forge administrative JWTs...
📅 Updated: Nov 9, 2026
CVE-2026-85295CVSS 9.8
Chartbrew is an open-source web application that can connect directly to databases and APIs and use the data...
📅 Updated: Nov 9, 2026
CVE-2026-54143CVSS 9.8
OpenHuman is an open-source agent harness available as a desktop application and Rust library. Before version 0.57.13, an...
📅 Updated: Nov 9, 2026
CVE-2026-54141CVSS 9.0
OpenHuman is an open-source agent harness available as a desktop application and Rust library. Before 0.57.13, a remote...
📅 Updated: Nov 9, 2026
CVE-2026-125120CVSS 9.8
Mongoose is a MongoDB object modeling tool designed to work in an asynchronous environment. Prior to 6.13.11, 7.8.12,...
📅 Updated: Nov 9, 2026
CVE-2026-115934CVSS 9.3
An unauthenticated SQL injection can occur on the front end of any site that uses craft.search to perform a search,...
📅 Updated: Nov 9, 2026