Crítica
CVE-2026-92935
Archivo de vulnerabilidades
Conoce las vulnerabilidades. Protege tus aplicaciones.
Descubre qué vulnerabilidades afectan a tus tecnologías y cómo solucionarlas. Encuentra explicaciones claras, versiones afectadas y recomendaciones prácticas - desde CMS y plugins hasta bibliotecas de aplicaciones.
Archivo de vulnerabilidades 89
Restablecer filtros
Crítica
CVE-2026-92937
vm2: GHSA-m283-3h24-438v fix bypass leads to host RCE via call/apply indirection
Crítica
CVE-2026-92938
vm2 allows a sandboxed plugin to execute native code through `node:sqlite`
Crítica
CVE-2026-92939
vm2 crypto builtin loads attacker native code through setEngine
Crítica
CVE-2026-92944
vm2 sandbox escape on Node.js 26 through a stale PromiseThenLookupChain protector
Crítica
CVE-2026-92941
vm2 NodeVM can replace the host process TLS trust store
Media
CVE-2026-92945
vm2: External module allowlist uses a raw prefix test, so a prefix-sharing sibling package is treated as allowlisted
Media
ghsa-96h4-vgxj-gvm2
Nest: Unbounded memory growth in the NestJS TCP microservice transport
Alta
CVE-2026-92961
vm2 has Memory Exhaustion DoS via bufferAllocLimit Bypass
Crítica
CVE-2026-92960
vm2: NodeVM `builtin: ['*']` exposes `os` and `dns` — process-wide observability reads AND writes that hijack the host (sibling class of GHSA-9g8x-92q2-p28f)
Crítica
CVE-2026-47698
vm2: Sandbox Breakout Using Dangerous Host Proto Mutators
Crítica
CVE-2026-47686
VM2 has Missing Error.cause Sanitization that Enables Sandbox Escape to RCE
Alta
CVE-2026-47683
vm2's bufferAllocLimit cap bypassed by Buffer.concat and Buffer.from arrayLike
Crítica
CVE-2026-69253
Flowise Sandbox Escape to RCE
Crítica
CVE-2026-69251
Flowise RCE via TypeORM DataSource
Media
CVE-2026-47141
NodeVM observability builtins leak host process and HTTP request data
Alta
CVE-2026-47139
NodeVM network builtin exclusions bypass via internal _http_client and _http_server
Crítica
CVE-2026-47140
NodeVM builtin denylist bypass via process and inspector/promises allows host code execution
Crítica
CVE-2026-47210
vm2 sandbox escape via JSPI-backed Promise `.finally()` species bypass
Crítica
CVE-2026-47137
vm2 has a CVE-2023-37903 patch bypass: nesting:true without explicit require still allows full RCE
Alta
CVE-2026-47209
vm2's Bridge Proxy set trap ignores receiver parameter, enabling host object property injection via prototype chain
Alta
CVE-2026-47135
vm2 has a sandbox escape via unblocked cross-realm Symbol.for keys + missing bridge write-trap symbol checks
Crítica
CVE-2026-47208
vm2 is Vulnerable to Sandbox Breakout Through Promise Species
Baja
CVE-2026-92962
vm2 setup-sandbox.js violates Defense Invariant #11 in stack-trace formatter
Identifica las vulnerabilidades de tu aplicación
Con la integración de DockRay y el inventario de software activado, DockRay compara las versiones notificadas de los componentes con las vulnerabilidades conocidas y avisa de las coincidencias confirmadas. La cobertura depende de la tecnología compatible y de los avisos disponibles.