{"id":"EUVD-2026-81585","enisaUuid":"d0fbd2d3-e6ea-3f33-a6db-e679335a19e7","description":"vm2 is a sandbox for running untrusted Node.js code. In versions \u003e\u003d 3.11.4 and \u003c\u003d 3.11.6, the NodeVM constructor computes `hasRealRequireConfig` with `typeof requireOpts \u003d\u003d\u003d \u0027object\u0027 \u0026\u0026 requireOpts !\u003d\u003d null`, so an array-shaped `require` value (for example `require: []`) satisfies the guard that is meant to reject nesting without an explicit require configuration. `makeResolverFromLegacyOptions()` then destructures the array into undefined option fields and returns a resolver containing only `NESTING_OVERRIDE.vm2`. As a result, an attacker who can supply JavaScript executed by a NodeVM configured with truthy `nesting` and an array-shaped `require` (e.g. `new NodeVM({nesting: true, require: []})`) can require the host `vm2` module, create an inner NodeVM with an attacker-chosen builtin allowlist (such as `child_process`), and execute arbitrary commands with the privileges of the host Node.js process, escaping the sandbox. Outer builtin restrictions do not constrain the attacker-created inner NodeVM. This issue is fixed in vm2 3.11.7.","datePublished":"Sep 17, 2026, 1:46:00 PM","dateUpdated":"Sep 17, 2026, 7:21:04 PM","baseScore":9.5,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H","references":"https://github.com/patriksimek/vm2/security/advisories/GHSA-8hr7-r645-pc6w\nhttps://github.com/patriksimek/vm2/commit/54b54b74a382577f0bcd0538c5bf99acdcd7f53b\nhttps://www.vulncheck.com/advisories/vm2-nodevm-remote-code-execution-via-array-shaped-require\n","aliases":"CVE-2026-92935\nGHSA-9fxx-mv6c-j5xp\nGHSA-8hr7-r645-pc6w\n","assigner":"VulnCheck","epss":0.64,"enisaIdProduct":[{"id":"65ee5937-d709-31aa-b34e-a189187d7ca2","product":{"name":"vm2","vendor":{"name":"patriksimek"}},"product_version":"3.11.4 \u003c3.11.7"}],"enisaIdVendor":[{"id":"e1c475d6-736e-38e8-bf05-a600e6396d0d","vendor":{"name":"patriksimek"}}],"enisaIdVulnerability":[{"id":"a73a7e94-ebbf-3604-9319-326cdaaae109","vulnerability":{"id":"CVE-2026-92935","description":"vm2 is a sandbox for running untrusted Node.js code. In versions \u003e\u003d 3.11.4 and \u003c\u003d 3.11.6, the NodeVM constructor computes `hasRealRequireConfig` with `typeof requireOpts \u003d\u003d\u003d \u0027object\u0027 \u0026\u0026 requireOpts !\u003d\u003d null`, so an array-shaped `require` value (for example `require: []`) satisfies the guard that is meant to reject nesting without an explicit require configuration. `makeResolverFromLegacyOptions()` then destructures the array into undefined option fields and returns a resolver containing only `NESTING_OVERRIDE.vm2`. As a result, an attacker who can supply JavaScript executed by a NodeVM configured with truthy `nesting` and an array-shaped `require` (e.g. `new NodeVM({nesting: true, require: []})`) can require the host `vm2` module, create an inner NodeVM with an attacker-chosen builtin allowlist (such as `child_process`), and execute arbitrary commands with the privileges of the host Node.js process, escaping the sandbox. Outer builtin restrictions do not constrain the attacker-created inner NodeVM. This issue is fixed in vm2 3.11.7.","datePublished":"Sep 17, 2026, 1:46:00 PM","dateUpdated":"Sep 17, 2026, 7:21:04 PM","status":"PUBLISHED","baseScore":9.5,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H","references":"https://github.com/patriksimek/vm2/security/advisories/GHSA-8hr7-r645-pc6w\nhttps://github.com/patriksimek/vm2/commit/54b54b74a382577f0bcd0538c5bf99acdcd7f53b\nhttps://www.vulncheck.com/advisories/vm2-nodevm-remote-code-execution-via-array-shaped-require\n","enisa_id":"EUVD-2026-81585\n","assigner":"VulnCheck","epss":0.64,"dataProcessed":"Nov 7, 2026, 7:24:07 AM","vulnerabilityProduct":[{"id":"3730ef9a-91c9-3bb6-8001-994373d3c12c","product":{"name":"vm2","vendor":{"name":"patriksimek"}},"product_version":"3.11.4 \u003c3.11.7"}],"vulnerabilityVendor":[{"id":"ad84b800-8e6e-324d-ab09-7b19abfce10f","vendor":{"name":"patriksimek"}}]}},{"id":"bc13014c-2e18-3389-bec2-4233b9e0677e","vulnerability":{"id":"GHSA-9fxx-mv6c-j5xp","description":"Duplicate Advisory: NodeVM nesting guard accepts array-shaped require and permits host RCE","datePublished":"Sep 17, 2026, 3:32:14 PM","dateUpdated":"Oct 1, 2026, 3:32:41 PM","baseScore":0.0,"references":"https://github.com/patriksimek/vm2/security/advisories/GHSA-8hr7-r645-pc6w\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-92935\nhttps://github.com/patriksimek/vm2/commit/54b54b74a382577f0bcd0538c5bf99acdcd7f53b\nhttps://www.vulncheck.com/advisories/vm2-nodevm-remote-code-execution-via-array-shaped-require\n","enisa_id":"EUVD-2026-81585\n","aliases":"GHSA-9fxx-mv6c-j5xp\n","epss":0.0,"dataProcessed":"Nov 1, 2026, 2:05:47 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"c82e4a62-21c1-3f31-aa3a-e8f7c987bfe2","vulnerability":{"id":"GHSA-8hr7-r645-pc6w","description":"vm2: NodeVM nesting guard accepts array-shaped require and permits host RCE","datePublished":"Oct 1, 2026, 3:34:58 PM","dateUpdated":"Oct 1, 2026, 3:34:58 PM","baseScore":0.0,"references":"https://github.com/patriksimek/vm2/security/advisories/GHSA-8hr7-r645-pc6w\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-92935\nhttps://github.com/patriksimek/vm2/commit/05894eca1dc6a2b1a986f312c88255288a983d22\nhttps://github.com/patriksimek/vm2/commit/54b54b74a382577f0bcd0538c5bf99acdcd7f53b\nhttps://github.com/patriksimek/vm2\nhttps://github.com/patriksimek/vm2/releases/tag/v3.11.7\nhttps://www.vulncheck.com/advisories/vm2-nodevm-remote-code-execution-via-array-shaped-require\n","enisa_id":"EUVD-2026-81585\n","aliases":"CVE-2026-92935\nGHSA-8hr7-r645-pc6w\n","epss":0.0,"dataProcessed":"Nov 1, 2026, 2:07:07 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[{"id":"12e3e4ba-8fce-39a9-93a5-b41ad028e236","advisory":{"id":"RHSA-2026:79088","description":"Red Hat Security Advisory: Red Hat Developer Hub 1.10.5 release.","summary":"Red Hat Developer Hub 1.10.5 has been released.","datePublished":"Oct 8, 2026, 7:56:41 AM","dateUpdated":"Nov 6, 2026, 10:25:18 PM","baseScore":0.0,"references":"https://access.redhat.com/errata/RHSA-2026:79088\nhttps://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_79088.json\n","aliases":"CVE-2026-13697\nCVE-2026-14456\nCVE-2026-18798\nCVE-2026-19534\nCVE-2026-47683\nCVE-2026-47686\nCVE-2026-47698\nCVE-2026-55553\nCVE-2026-63072\nCVE-2026-63076\nCVE-2026-67213\nCVE-2026-67214\nCVE-2026-67422\nCVE-2026-75899\nCVE-2026-75931\nCVE-2026-75975\nCVE-2026-76172\nCVE-2026-77037\nCVE-2026-77078\nCVE-2026-82333\nCVE-2026-82417\nCVE-2026-84292\nCVE-2026-84375\nCVE-2026-84394\nCVE-2026-84445\nCVE-2026-84961\nCVE-2026-87776\nCVE-2026-88932\nCVE-2026-89011\nCVE-2026-92934\nCVE-2026-92935\nCVE-2026-92937\nCVE-2026-92938\nCVE-2026-92939\nCVE-2026-92940\nCVE-2026-92941\nCVE-2026-92942\nCVE-2026-92944\nCVE-2026-92946\nCVE-2026-92947\nCVE-2026-92948\nCVE-2026-92950\nCVE-2026-92951\nCVE-2026-92953\nCVE-2026-92954\nCVE-2026-92955\nCVE-2026-92956\nCVE-2026-92957\nCVE-2026-92958\nCVE-2026-92959\nCVE-2026-92960\nCVE-2026-92961\nCVE-2026-93603\nCVE-2026-93604\nCVE-2026-93605\nCVE-2026-93606\n","source":{"id":9,"name":"csaf_redhat"},"advisoryProduct":[{"id":"06cbcb1e-68b7-35e4-a7c7-453d95844710","product":{"name":"registry.redhat.io/rhdh/rhdh-operator-bundle@sha256:f71a2783106a98ccbfb60f7219f8220cc778da946f0a800c2ce1d66384ed947a_amd64","vendor":{"name":"Red Hat"}}},{"id":"508477c2-1363-394b-bb5d-3facad96d5d0","product":{"name":"registry.redhat.io/rhdh/rhdh-rag-content-rhel9@sha256:2f71e0edb79f26d812edeb1754075159c9c9a0c8250c4d542e83a0725ad60725_amd64","vendor":{"name":"Red Hat"}}},{"id":"5636929f-17b0-3759-a7fe-08ca34a667d5","product":{"name":"registry.redhat.io/rhdh/rhdh-must-gather-rhel9@sha256:38374b57f1896ba7be54a5778ba55aa0e6766443c5421c6481a82f909cfacc51_amd64","vendor":{"name":"Red Hat"}}},{"id":"c2b0f25d-cb2e-34af-9e75-f837cebc386c","product":{"name":"registry.redhat.io/rhdh/rhdh-hub-rhel9@sha256:0f02ae0b8405912741a180af1c290feac2003e69d062bec9c7cd5d13f8732dc9_amd64","vendor":{"name":"Red Hat"}}},{"id":"cafb57df-e384-35d1-be1d-0e564954cb14","product":{"name":"registry.redhat.io/rhdh/rhdh-rhel9-operator@sha256:a20e789a899fcf4918db20426fce1d3d865391e7dee7c5c50e31533fbdd51fa0_amd64","vendor":{"name":"Red Hat"}}},{"id":"e910d332-380a-3bb6-bece-c3366490900c","product":{"name":"Red Hat Developer Hub 1.10","vendor":{"name":"Red Hat"}}}]}},{"id":"22e7bc71-f6fc-3c9e-a8a9-147de15a33dd","advisory":{"id":"RHSA-2026:80644","description":"Red Hat Security Advisory: Ansible plug-ins for Red Hat Developer Hub Product Release Update","summary":"Updated images are now available for Red Hat Ansible Automation Platform 2.2, which include new features, bug fixes, and enhancements for Red Hat Ansible Automation Platform integration with Red Hat Developer Hub.","datePublished":"Oct 12, 2026, 8:11:19 AM","dateUpdated":"Nov 6, 2026, 6:18:46 AM","baseScore":0.0,"references":"https://access.redhat.com/errata/RHSA-2026:80644\nhttps://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_80644.json\n","aliases":"CVE-2026-47686\nCVE-2026-47698\nCVE-2026-84961\nCVE-2026-85152\nCVE-2026-92934\nCVE-2026-92935\nCVE-2026-92937\nCVE-2026-92938\nCVE-2026-92939\nCVE-2026-92940\nCVE-2026-92941\nCVE-2026-92944\nCVE-2026-92946\nCVE-2026-92947\nCVE-2026-92948\nCVE-2026-92950\nCVE-2026-92951\nCVE-2026-92953\nCVE-2026-92954\nCVE-2026-92956\nCVE-2026-92957\nCVE-2026-92960\nCVE-2026-93603\nCVE-2026-93604\nCVE-2026-93605\nCVE-2026-93606\nCVE-2026-101916\n","source":{"id":9,"name":"csaf_redhat"},"advisoryProduct":[{"id":"72ca4aa8-50b6-3673-8001-4b7805b5a019","product":{"name":"Red Hat Ansible Automation Platform 2.2","vendor":{"name":"Red Hat"}}},{"id":"8d3bba85-f3ae-3273-847b-179b70760554","product":{"name":"registry.redhat.io/ansible-automation-platform/automation-portal@sha256:cd22d7068dc9cdc475f4cb097b9019f54d5adf51927a3773c483040224018e96_amd64","vendor":{"name":"Red Hat"}}}]}},{"id":"4ac04c2e-1f49-3bfc-8006-874e3b619d16","advisory":{"id":"RHSA-2026:82151","description":"Red Hat Security Advisory: Ansible automation portal Red Hat Enterprise Linux Images","summary":"Updated images are now available for Red Hat Ansible Automation Platform 2.2, which include new features, bug fixes, and enhancements for the Red Hat Ansible Automation Portal bootable container image.","datePublished":"Oct 13, 2026, 10:07:59 AM","dateUpdated":"Nov 6, 2026, 5:28:19 PM","baseScore":0.0,"references":"https://access.redhat.com/errata/RHSA-2026:82151\nhttps://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_82151.json\n","aliases":"CVE-2026-13697\nCVE-2026-19534\nCVE-2026-47683\nCVE-2026-47686\nCVE-2026-47698\nCVE-2026-54284\nCVE-2026-55553\nCVE-2026-59893\nCVE-2026-71491\nCVE-2026-75899\nCVE-2026-75931\nCVE-2026-75975\nCVE-2026-76172\nCVE-2026-77037\nCVE-2026-82333\nCVE-2026-82417\nCVE-2026-84292\nCVE-2026-84375\nCVE-2026-84394\nCVE-2026-84961\nCVE-2026-88932\nCVE-2026-92934\nCVE-2026-92935\nCVE-2026-92937\nCVE-2026-92938\nCVE-2026-92939\nCVE-2026-92940\nCVE-2026-92941\nCVE-2026-92942\nCVE-2026-92944\nCVE-2026-92946\nCVE-2026-92947\nCVE-2026-92948\nCVE-2026-92950\nCVE-2026-92951\nCVE-2026-92953\nCVE-2026-92954\nCVE-2026-92955\nCVE-2026-92956\nCVE-2026-92957\nCVE-2026-92958\nCVE-2026-92959\nCVE-2026-92960\nCVE-2026-92961\nCVE-2026-93603\nCVE-2026-93604\nCVE-2026-93605\nCVE-2026-93606\n","source":{"id":9,"name":"csaf_redhat"},"advisoryProduct":[{"id":"2280b8dc-2fd5-30b0-8231-555177763c6b","product":{"name":"registry.redhat.io/ansible-automation-platform/bootc-automation-portal-rhel9@sha256:8553c734145775879bdfe2befa9f2df1c22c6d7db2f2251401c3cc517a7e0394_amd64","vendor":{"name":"Red Hat"}}},{"id":"e47d596f-4737-3e57-a985-a89840767fcd","product":{"name":"Red Hat Ansible Automation Platform 2.2","vendor":{"name":"Red Hat"}}}]}},{"id":"7913972c-be86-3b3f-8ac7-e8cb57abb1e1","advisory":{"id":"RHSA-2026:76788","description":"Red Hat Security Advisory: Red Hat Developer Hub 1.10.5 Plugin Catalog GA plugins release.","summary":"Red Hat Developer Hub 1.10.5 Plugin Catalog GA plugins release.","datePublished":"Oct 6, 2026, 1:09:32 PM","dateUpdated":"Nov 4, 2026, 3:48:29 PM","baseScore":0.0,"references":"https://access.redhat.com/errata/RHSA-2026:76788\nhttps://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_76788.json\n","aliases":"CVE-2026-13697\nCVE-2026-19534\nCVE-2026-47683\nCVE-2026-47686\nCVE-2026-47698\nCVE-2026-55553\nCVE-2026-75899\nCVE-2026-75931\nCVE-2026-75975\nCVE-2026-76172\nCVE-2026-77037\nCVE-2026-77078\nCVE-2026-77413\nCVE-2026-77414\nCVE-2026-77415\nCVE-2026-82333\nCVE-2026-82417\nCVE-2026-84292\nCVE-2026-84375\nCVE-2026-84394\nCVE-2026-84961\nCVE-2026-87776\nCVE-2026-88932\nCVE-2026-89011\nCVE-2026-92934\nCVE-2026-92935\nCVE-2026-92937\nCVE-2026-92938\nCVE-2026-92939\nCVE-2026-92940\nCVE-2026-92941\nCVE-2026-92942\nCVE-2026-92944\nCVE-2026-92946\nCVE-2026-92947\nCVE-2026-92948\nCVE-2026-92950\nCVE-2026-92951\nCVE-2026-92953\nCVE-2026-92954\nCVE-2026-92955\nCVE-2026-92956\nCVE-2026-92957\nCVE-2026-92958\nCVE-2026-92959\nCVE-2026-92960\nCVE-2026-92961\nCVE-2026-93603\nCVE-2026-93604\nCVE-2026-93605\nCVE-2026-93606\n","source":{"id":9,"name":"csaf_redhat"},"advisoryProduct":[{"id":"180d3269-d15f-343c-82e8-83cb197e3acc","product":{"name":"registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-backend-module-loki@sha256:5549940696691cc087777c20f5d46b485d31e9fe3db896caa2eca7bfef3edb72_amd64","vendor":{"name":"Red Hat"}}},{"id":"49d020b5-3790-3915-8a55-d6e6d709f5f8","product":{"name":"Red Hat Developer Hub 1.10","vendor":{"name":"Red Hat"}}},{"id":"57ffb8cd-cfbe-3f7e-9c00-85aee590bf45","product":{"name":"registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-backend@sha256:c6a5e6d9c8f3ab900c2b29848273540f4a3e97d351faa338a66da46c0b59d04f_amd64","vendor":{"name":"Red Hat"}}},{"id":"9fc9309a-ed78-376e-9e98-7d17f6b24ec7","product":{"name":"registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator@sha256:3aa39a8c3b7bf33aeaae5b3f924d0a2f7625e64657ce9b5517a3a73620f142bb_amd64","vendor":{"name":"Red Hat"}}},{"id":"b7170e41-a20c-34cb-af94-29802c6e7b5f","product":{"name":"registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-lightspeed-backend@sha256:55b8b4e43f9dd474dee53d824591695012994daec86efee4dc08612b12425a46_amd64","vendor":{"name":"Red Hat"}}},{"id":"c0c3bef5-d9ee-3d1c-ae0d-0baec98a55b0","product":{"name":"registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-scaffolder-backend-module-orchestrator@sha256:924c4e5e8642438f3099272ff7edd746a66fcec4779aeafb9fd6b3ae0c594f72_amd64","vendor":{"name":"Red Hat"}}},{"id":"e4e2cfac-97a6-3481-8285-5dfb16156229","product":{"name":"registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-form-widgets@sha256:df55fd567640bcd54d8e0d19baa97a5e72429865ad342c94bb80c3a49a5c184e_amd64","vendor":{"name":"Red Hat"}}},{"id":"feec8110-5ed4-3c49-8e16-23feb910d9bc","product":{"name":"registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-lightspeed@sha256:0ca07bd2b15a85bfda16cbc0904fb4ee6c8620e18b891ba89ae792cf0a165095_amd64","vendor":{"name":"Red Hat"}}}]}},{"id":"bdec65ee-b58a-3e91-9b82-96452ae0e206","advisory":{"id":"RHSA-2026:91651","description":"Red Hat Security Advisory: Red Hat Developer Hub 1.9.10 release.","summary":"Red Hat Developer Hub 1.9.10 has been released.","datePublished":"Oct 28, 2026, 11:50:38 AM","dateUpdated":"Nov 6, 2026, 5:32:32 PM","baseScore":0.0,"references":"https://access.redhat.com/errata/RHSA-2026:91651\nhttps://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_91651.json\n","aliases":"CVE-2026-47683\nCVE-2026-47686\nCVE-2026-47698\nCVE-2026-84445\nCVE-2026-92934\nCVE-2026-92935\nCVE-2026-92937\nCVE-2026-92938\nCVE-2026-92939\nCVE-2026-92940\nCVE-2026-92941\nCVE-2026-92942\nCVE-2026-92944\nCVE-2026-92946\nCVE-2026-92947\nCVE-2026-92948\nCVE-2026-92950\nCVE-2026-92951\nCVE-2026-92953\nCVE-2026-92954\nCVE-2026-92955\nCVE-2026-92956\nCVE-2026-92957\nCVE-2026-92958\nCVE-2026-92959\nCVE-2026-92960\nCVE-2026-92961\nCVE-2026-93603\nCVE-2026-93604\nCVE-2026-93605\nCVE-2026-93606\nCVE-2026-111943\n","source":{"id":9,"name":"csaf_redhat"},"advisoryProduct":[{"id":"21fa6397-f7cf-3dcd-bfac-1b35c37b3cc2","product":{"name":"registry.redhat.io/rhdh/rhdh-rhel9-operator@sha256:b468b182954d3554b9b8934b65418233502ca24feb0ff66454c5f05e8055e35f_amd64","vendor":{"name":"Red Hat"}}},{"id":"ac6c8622-7e0c-3b6c-8cac-bf787eefa089","product":{"name":"registry.redhat.io/rhdh/rhdh-hub-rhel9@sha256:9dffcd643d4a9d3d5cea982ccec08cf50198920d9a08672c7b29994120d3e4fa_amd64","vendor":{"name":"Red Hat"}}},{"id":"d1d295ca-6505-31da-b8b3-5e30e16c3a0a","product":{"name":"registry.redhat.io/rhdh/rhdh-operator-bundle@sha256:bbb5c34eb78780efa7168ae8d53a711a121174c5d7b4ec5f1a9187aba6f9e7ab_amd64","vendor":{"name":"Red Hat"}}},{"id":"f63c7ed2-2550-3b7b-b138-a121fa8b5b4f","product":{"name":"Red Hat Developer Hub 1.9","vendor":{"name":"Red Hat"}}}]}},{"id":"e8ac5507-55dd-3f81-816c-5df5b65d6574","advisory":{"id":"RHSA-2026:80603","description":"Red Hat Security Advisory: Ansible plug-ins for Red Hat Developer Hub Product Release Update","summary":"Updated images are now available for Red Hat Ansible Automation Platform 2.1, which include new features, bug fixes, and enhancements for Red Hat Ansible Automation Platform integration with Red Hat Developer Hub.","datePublished":"Oct 12, 2026, 5:44:41 AM","dateUpdated":"Nov 6, 2026, 6:18:46 AM","baseScore":0.0,"references":"https://access.redhat.com/errata/RHSA-2026:80603\nhttps://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_80603.json\n","aliases":"CVE-2026-47686\nCVE-2026-47698\nCVE-2026-84961\nCVE-2026-85152\nCVE-2026-92934\nCVE-2026-92935\nCVE-2026-92937\nCVE-2026-92938\nCVE-2026-92939\nCVE-2026-92940\nCVE-2026-92941\nCVE-2026-92944\nCVE-2026-92946\nCVE-2026-92947\nCVE-2026-92948\nCVE-2026-92950\nCVE-2026-92951\nCVE-2026-92953\nCVE-2026-92954\nCVE-2026-92956\nCVE-2026-92957\nCVE-2026-92960\nCVE-2026-93603\nCVE-2026-93604\nCVE-2026-93605\nCVE-2026-93606\nCVE-2026-101916\n","source":{"id":9,"name":"csaf_redhat"},"advisoryProduct":[{"id":"345f9be6-2f62-3563-b654-79433799673a","product":{"name":"Red Hat Ansible Automation Platform 2.1","vendor":{"name":"Red Hat"}}},{"id":"d435b4ca-d802-3415-ba8a-e311b1155a03","product":{"name":"registry.redhat.io/ansible-automation-platform/automation-portal@sha256:f92d478c1fad9df93d573b3a4d4cc5904f57f33d65a308472265c8bfeb057f59_amd64","vendor":{"name":"Red Hat"}}}]}}]}