GHSA-jf8q-945g-9q4cPublished
vm2: Incomplete nodejs.* symbol filtering lets sandbox override host WebStream state checks
osv · CVE-2026-92952
npm: vm2
Security
Microsoft security updates and public advisory evidence: affected products, fixing updates, exploitation and source coverage.
Advisory catalog
Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.
Collected statements
698587 source statements · aliases may refer to the same vulnerabilityGHSA-qhwx-74w5-xhxqPublished
vm2: NodeVM builtin allowlist bypass via node:test.run() execArgv allows sandbox escape
osv · CVE-2026-92948
npm: vm2
GHSA-jxxv-8r27-vm4pPublished
vm2 CLI provides no sandbox isolation - host-realm require() is reachable from sandboxed scripts
osv · CVE-2026-92950
npm: vm2
GHSA-xxm9-w59q-m66xWithdrawn
Duplicate Advisory: getUniqueFilename passes an unvalidated client-supplied path to the filesystem, giving anonymous readers an existence oracle over the entire host filesystem
osv ·
Go: github.com/siyuan-note/siyuan/kernel
GHSA-5w4j-hchp-r332Withdrawn
Duplicate Advisory: Unauthenticated SQL injection in searchDocs via unescaped keyword (publish mode): cross-notebook read/write with statement stacking
osv ·
Go: github.com/siyuan-note/siyuan/kernel
GHSA-v372-phq5-6mx6Withdrawn
Duplicate Advisory: Outline state for any document, including documents forbidden to readers, is returned by /api/storage/getOutlineStorage with no access check
osv ·
Go: github.com/siyuan-note/siyuan/kernel
CVE-2026-76146Published
Genians, Inc Genian SSL PNS OS Command Injection
cve-program ·
Vendor product: Genian SSL PNS (xenics_auther)
CVE-2026-100514Published
WordPress REST API Log plugin <= 1.7.2 - Insecure Direct Object References (IDOR) vulnerability
cve-program ·
https://wordpress.org/plugins: wp-rest-api-log
CVE-2026-76142Published
Genians, Inc. Genian NAC/ZTNA Improper Access Control on the Internal Interface
cve-program ·
Vendor product: Genian NAC 5.0.75 LTS Release · Vendor product: Genian NAC 5.0.85 Release Stable · Vendor product: Genian NAC 5.0.86 Release
CVE-2026-103347Published
WordPress hCaptcha for WP plugin <= 5.3.0 - Bypass Vulnerability vulnerability
cve-program ·
https://wordpress.org/plugins: hcaptcha-for-forms-and-more
CVE-2026-97280Published
WordPress Review Schema plugin 3.1.0 - Broken Access Control vulnerability
cve-program ·
https://wordpress.org/plugins: review-schema
CVE-2026-78210Published
In affected versions of Octopus Server, users with certain scoped permission sets could execute arbitrary scripts in an environment without possessing the required authorization.
cve-program ·
Vendor product: Octopus Server
CVE-2026-100821Published
Site isolation issue in the Panning and Zooming component
cve-program ·
Vendor product: Firefox · Vendor product: Thunderbird
CVE-2026-103585Published
attacker-controlled javascript license URL via XSS
cve-program ·
Vendor product: MediaWiki MediaSearch extension
CVE-2026-103584Published
attacker-controlled javascript license URL via XSS
cve-program ·
Vendor product: MediaWiki CommonsMetadata extension
CVE-2026-102805Published
Nothings stb Image Encoding stb_image_write.h stbi_write_tga_core integer overflow
cve-program ·
Vendor product: stb
CVE-2026-101283Published
iperf3 3.20–3.21 (esnet/iperf) has a pre-auth heap buffer overflow in decrypt_rsa_message(): a 256-byte RSA buffer is BIO_read with the attacker-controlled ciphertext length (guard warns only), so an unauthenticated client overflows the hea…
cve-program ·
Vendor product: iperf3
CVE-2026-102793Published
Ziroom ZHOME A0101 set_time_zone command injection
cve-program ·
Vendor product: ZHOME A0101
CVE-2026-100817Published
Other issue in the JavaScript: WebAssembly component
cve-program ·
Vendor product: Thunderbird · Vendor product: Firefox
CVE-2026-101276Published
iperf3 3.21 (esnet/iperf) contains a remote, unauthenticated heap use-after-free: the server's per-test watchdog server_timer_proc() frees streams without cancelling/joining their worker threads, so a blocked worker dereferences a freed ipe…
cve-program ·
Vendor product: iperf3
CVE-2026-76145Published
Genians, Inc Genian SSL PNS Improper Privilege Management
cve-program ·
Vendor product: Genian SSL PNS (frodo-core) · Vendor product: Genian SSL PNS (watchcat-ui)
CVE-2026-76147Published
Genians, Inc Genian NAC/ZTNA Remote Code Execution
cve-program ·
Vendor product: Genian NAC 4.0.175 Release · Vendor product: Genian NAC 5.0.65 LTS Release · Vendor product: Genian NAC 5.0.75 LTS Release
CVE-2026-82829Published
Hidden accounts or hard-coded credentials may permit unauthorized access without the legitimate authentication process
cve-program ·
Vendor product: Hitachi Coding Software Suite
CVE-2026-82828Published
Improper authorization may allow a general user to perform operations equivalent to those available with administrator privileges
cve-program ·
Vendor product: Hitachi Coding Software Suite
CVE-2026-100830Published
Mitigation bypass in the DOM: Navigation component
cve-program ·
Vendor product: Firefox · Vendor product: Thunderbird
GHSA-633r-hq9m-c4ffPublished
vm2: vm.freeze()/vm.readonly() bypass via accessor descriptor
osv · CVE-2026-92949
npm: vm2
GHSA-6w8r-xxw2-g3hxPublished
vm2 allows a sandboxed plugin to execute native code through `node:sqlite`
osv · CVE-2026-92938
npm: vm2
GHSA-647f-g98j-qq25Published
vm2: GHSA-m283-3h24-438v fix bypass leads to host RCE via call/apply indirection
osv · CVE-2026-92937
npm: vm2
GHSA-6rh5-qq4q-97xhPublished
vm2: NodeVM builtin denylist bypass via fs/promises despite -fs, allowing host filesystem writes
osv · CVE-2026-92958
npm: vm2
GHSA-98xx-8mx4-x7cmPublished
vm2 NodeVM can replace the host process TLS trust store
osv · CVE-2026-92941
npm: vm2
GHSA-8hr7-r645-pc6wPublished
vm2: NodeVM nesting guard accepts array-shaped require and permits host RCE
osv · CVE-2026-92935
npm: vm2
GHSA-27g9-p43v-cw3vPublished
vm2 sandbox escape on Node.js 26 through a stale PromiseThenLookupChain protector
osv · CVE-2026-92944
npm: vm2
GHSA-c48m-32m9-vx93Published
vm2 Custom Module Resolver Can Bypass the External Package Allowlist by Loading a Colliding Host Package
osv · CVE-2026-92951
npm: vm2
GHSA-7q3f-wx44-378mPublished
vm2: External module allowlist uses a raw prefix test, so a prefix-sharing sibling package is treated as allowlisted
osv · CVE-2026-92945
npm: vm2
GHSA-xq74-c7jx-8w5jWithdrawn
Duplicate Advisory: vm2 NodeVM can replace the host process TLS trust store
osv ·
npm: vm2
GHSA-46pr-c5wc-xffxPublished
vm2 crypto builtin loads attacker native code through setEngine
osv · CVE-2026-92939
npm: vm2
GHSA-h85j-hv3c-qfgqPublished
vm2 exposes host HTTPS credentials and TLS traffic through globalAgent
osv · CVE-2026-92940
npm: vm2
A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.