CVE records Every CVE as the CVE Program publishes it, refreshed every ten minutes, with NVD's analysis, CISA's known-exploited status and a healthcare tag. Subscribers get the CVEs that match their own systems on My program , by email as they are published. Where the data comes from: sources .
Updated under an hour ago (2026-10-19 09:00 UTC )
This week: 5,435 CVEs published, 355 critical, and 7 newly confirmed exploited. Add your stack to see whether any of them hit you.
Published in the last 7 days 5,435 Show in the list Critical, last 7 days 355 Show in the list Healthcare-tagged, last 7 days 4 Show in the list Known exploited (CISA KEV) 1,747 Show in the list Showing CVEs that name the product patriksimek:vm2 . Show all products
40 CVEs, showing 1 to 40
CVE Severity Title Published CVE-2026-47698 Critical 9.8 vm2: Sandbox Breakout Using Dangerous Host Proto Mutators Assigned by GitHub_M
Aug 17, 2026 CVE-2026-47686 Critical 9.9 vm2: Missing Error.cause Sanitization Enables VM2 Sandbox Escape to RCE Assigned by GitHub_M
Aug 17, 2026 CVE-2026-47683 High 8.7 vm2: bufferAllocLimit cap bypassed by Buffer.concat and Buffer.from arrayLike Assigned by GitHub_M
Aug 17, 2026 CVE-2026-92933 Medium 5.8 vm2 before 3.11.8 Information Disclosure via util.getCallSites Assigned by VulnCheck
Sep 17, 2026 CVE-2026-92934 Critical 9.0 vm2 before 3.11.8 Sandbox Escape RCE via AggregateError Assigned by VulnCheck
Sep 17, 2026 CVE-2026-92935 Critical 9.0 vm2 NodeVM Remote Code Execution via Array-Shaped Require Assigned by VulnCheck
Sep 17, 2026 CVE-2026-92936 Medium 5.8 vm2 3.11.0 before 3.11.7 Information Disclosure via Error Stack Assigned by VulnCheck
Sep 17, 2026 CVE-2026-92937 Critical 10.0 vm2 3.11.6 Remote Code Execution via Promise call/apply Assigned by VulnCheck
Sep 17, 2026 CVE-2026-92938 Critical 9.9 vm2 3.11.3 through 3.11.6 Remote Code Execution via node:sqlite Assigned by VulnCheck
Sep 17, 2026 CVE-2026-92939 Critical 9.9 vm2 3.11.3 through 3.11.6 Native Code Execution via crypto.setEngine Assigned by VulnCheck
Sep 17, 2026 CVE-2026-92940 Critical 10.0 vm2 3.11.3 through 3.11.6 HTTPS Credential Exposure via globalAgent Assigned by VulnCheck
Sep 17, 2026 CVE-2026-92941 Critical 10.0 vm2 3.11.3 before 3.11.7 TLS Trust Store Manipulation Assigned by VulnCheck
Sep 17, 2026 CVE-2026-92942 High 7.5 vm2 before 3.11.7 Timeout Bypass via FinalizationRegistry Assigned by VulnCheck
Sep 17, 2026 CVE-2026-92944 Critical 9.8 vm2 3.10.2 through 3.11.6 Sandbox Escape via Promise Protector Assigned by VulnCheck
Sep 17, 2026 CVE-2026-92945 Medium 4.2 vm2 before 3.11.7 Module Allowlist Bypass via Prefix Matching Assigned by VulnCheck
Sep 17, 2026 CVE-2026-92946 Critical 10.0 vm2 before 3.11.7 Remote Code Execution via require.external Assigned by VulnCheck
Sep 17, 2026 CVE-2026-92947 Critical 10.0 vm2 before 3.11.7 Memory Disclosure via Buffer Pool Assigned by VulnCheck
Sep 17, 2026 CVE-2026-92948 Critical 9.9 vm2 3.9.6 through 3.11.5 Sandbox Escape via node:test Assigned by VulnCheck
Sep 17, 2026 CVE-2026-92949 Medium 4.0 vm2 3.9.6 before 3.11.7 Sandbox Bypass via Accessor Descriptor Assigned by VulnCheck
Sep 17, 2026 CVE-2026-92950 High 8.6 vm2 before 3.11.7 Sandbox Escape via CLI require Assigned by VulnCheck
Sep 17, 2026 CVE-2026-92951 Critical 9.9 vm2 before 3.11.7 Module Allowlist Bypass via Custom Resolver Assigned by VulnCheck
Sep 17, 2026 CVE-2026-92952 Medium 6.8 vm2 3.11.4 through 3.11.6 Sandbox Symbol Filtering Bypass Assigned by VulnCheck
Sep 17, 2026 CVE-2026-92953 Critical 10.0 vm2 3.11.0 through 3.11.7 Prototype Pollution via TypedArray Assigned by VulnCheck
Sep 17, 2026 CVE-2026-92954 High 8.6 vm2 3.10.0 through 3.11.7 Denial of Service via Host Promise Assigned by VulnCheck
Sep 17, 2026 CVE-2026-92955 Critical 10.0 vm2 before 3.11.8 Sandbox Escape via NodeVM Assigned by VulnCheck
Sep 17, 2026 CVE-2026-92956 Critical 10.0 vm2 3.10.1 through 3.11.6 Sandbox Escape via WebAssembly.compileStreaming Assigned by VulnCheck
Sep 17, 2026 CVE-2026-92957 Critical 9.9 vm2 before 3.11.7 NodeVM Builtin Deny-List Bypass via node: Prefix Assigned by VulnCheck
Sep 17, 2026 CVE-2026-92958 High 8.5 vm2 before 3.11.7 Denylist Bypass via fs/promises Assigned by VulnCheck
Sep 17, 2026 CVE-2026-92959 High 7.1 vm2 before 3.11.8 allowAsync Bypass via Promise Thenable Assigned by VulnCheck
Sep 17, 2026 CVE-2026-92960 Critical 10.0 vm2 before 3.11.6 Process-wide State Exposure via os and dns Assigned by VulnCheck
Sep 17, 2026 CVE-2026-92961 High 7.5 vm2 before 3.11.6 Memory Exhaustion DoS via bufferAllocLimit Bypass Assigned by VulnCheck
Sep 17, 2026 CVE-2026-92962 Low 2.1 vm2 before 3.11.4 Defense Invariant Violation via setup-sandbox.js Assigned by VulnCheck
Sep 17, 2026 CVE-2026-92963 Medium 5.3 vm2 before 3.11.2 Information Disclosure via Internal State Assigned by VulnCheck
Sep 17, 2026 CVE-2026-93603 Critical 10.0 vm2 before 3.12.1 Sandbox Escape RCE via Non-Strict Host Function Assigned by VulnCheck
Sep 18, 2026 CVE-2026-93604 High 7.2 vm2 3.11.8 Sandbox Escape via crypto.setFips Assigned by VulnCheck
Sep 18, 2026 CVE-2026-93605 Critical 10.0 vm2 NodeVM before 3.12.1 Remote Code Execution via child_process Assigned by VulnCheck
Sep 18, 2026 CVE-2026-93606 Critical 10.0 vm2 before 3.12.1 Sandbox Escape via Promise Symbol.species Assigned by VulnCheck
Sep 18, 2026 CVE-2026-100721 Critical 9.0 vm2 before 3.12.2 Authorization Bypass via Custom Resolver Assigned by VulnCheck
Sep 27, 2026 CVE-2026-100722 Medium 6.8 vm2 before 3.12.2 Host Process Termination via Construct Trap Assigned by VulnCheck
Sep 27, 2026 CVE-2026-100723 High 7.5 vm2 before 3.12.2 Memory Disclosure via zlib Buffer Pool Assigned by VulnCheck
Sep 27, 2026
CVSS is the assigning CNA's score where it gives one, otherwise NVD's. The healthcare tag is a documented heuristic (a list of clinical and health IT vendors, and clinical terms in the description), not a classification. The CVE record is authoritative.
© 2026 MTC Group, LLC. All rights reserved. InfoSec Signals™ and the InfoSec Signals logo are trademarks of MTC Group, LLC.
Printed from infosec-signals.mtcgroupllc.com. Every record links back to the agency that published it.
