CVE records Every CVE as the CVE Program publishes it, refreshed every ten minutes, with NVD's analysis, CISA's known-exploited status and a healthcare tag. Subscribers get the CVEs that match their own systems on My program , by email as they are published. Where the data comes from: sources .
Updated under an hour ago (2026-10-19 08:00 UTC )
This week: 5,437 CVEs published, 355 critical, and 7 newly confirmed exploited. Add your stack to see whether any of them hit you.
Published in the last 7 days 5,437 Show in the list Critical, last 7 days 355 Show in the list Healthcare-tagged, last 7 days 4 Show in the list Known exploited (CISA KEV) 1,747 Show in the list Showing CVEs that name the product patriksimek:vm2 . Show all products
40 CVEs, showing 1 to 40
CVE Severity Title Published CVE-2026-100723 High 7.5 vm2 before 3.12.2 Memory Disclosure via zlib Buffer Pool Assigned by VulnCheck
Sep 27, 2026 CVE-2026-100722 Medium 6.8 vm2 before 3.12.2 Host Process Termination via Construct Trap Assigned by VulnCheck
Sep 27, 2026 CVE-2026-100721 Critical 9.0 vm2 before 3.12.2 Authorization Bypass via Custom Resolver Assigned by VulnCheck
Sep 27, 2026 CVE-2026-93606 Critical 10.0 vm2 before 3.12.1 Sandbox Escape via Promise Symbol.species Assigned by VulnCheck
Sep 18, 2026 CVE-2026-93605 Critical 10.0 vm2 NodeVM before 3.12.1 Remote Code Execution via child_process Assigned by VulnCheck
Sep 18, 2026 CVE-2026-93604 High 7.2 vm2 3.11.8 Sandbox Escape via crypto.setFips Assigned by VulnCheck
Sep 18, 2026 CVE-2026-93603 Critical 10.0 vm2 before 3.12.1 Sandbox Escape RCE via Non-Strict Host Function Assigned by VulnCheck
Sep 18, 2026 CVE-2026-92963 Medium 5.3 vm2 before 3.11.2 Information Disclosure via Internal State Assigned by VulnCheck
Sep 17, 2026 CVE-2026-92962 Low 2.1 vm2 before 3.11.4 Defense Invariant Violation via setup-sandbox.js Assigned by VulnCheck
Sep 17, 2026 CVE-2026-92961 High 7.5 vm2 before 3.11.6 Memory Exhaustion DoS via bufferAllocLimit Bypass Assigned by VulnCheck
Sep 17, 2026 CVE-2026-92960 Critical 10.0 vm2 before 3.11.6 Process-wide State Exposure via os and dns Assigned by VulnCheck
Sep 17, 2026 CVE-2026-92959 High 7.1 vm2 before 3.11.8 allowAsync Bypass via Promise Thenable Assigned by VulnCheck
Sep 17, 2026 CVE-2026-92958 High 8.5 vm2 before 3.11.7 Denylist Bypass via fs/promises Assigned by VulnCheck
Sep 17, 2026 CVE-2026-92957 Critical 9.9 vm2 before 3.11.7 NodeVM Builtin Deny-List Bypass via node: Prefix Assigned by VulnCheck
Sep 17, 2026 CVE-2026-92956 Critical 10.0 vm2 3.10.1 through 3.11.6 Sandbox Escape via WebAssembly.compileStreaming Assigned by VulnCheck
Sep 17, 2026 CVE-2026-92955 Critical 10.0 vm2 before 3.11.8 Sandbox Escape via NodeVM Assigned by VulnCheck
Sep 17, 2026 CVE-2026-92954 High 8.6 vm2 3.10.0 through 3.11.7 Denial of Service via Host Promise Assigned by VulnCheck
Sep 17, 2026 CVE-2026-92953 Critical 10.0 vm2 3.11.0 through 3.11.7 Prototype Pollution via TypedArray Assigned by VulnCheck
Sep 17, 2026 CVE-2026-92952 Medium 6.8 vm2 3.11.4 through 3.11.6 Sandbox Symbol Filtering Bypass Assigned by VulnCheck
Sep 17, 2026 CVE-2026-92951 Critical 9.9 vm2 before 3.11.7 Module Allowlist Bypass via Custom Resolver Assigned by VulnCheck
Sep 17, 2026 CVE-2026-92950 High 8.6 vm2 before 3.11.7 Sandbox Escape via CLI require Assigned by VulnCheck
Sep 17, 2026 CVE-2026-92949 Medium 4.0 vm2 3.9.6 before 3.11.7 Sandbox Bypass via Accessor Descriptor Assigned by VulnCheck
Sep 17, 2026 CVE-2026-92948 Critical 9.9 vm2 3.9.6 through 3.11.5 Sandbox Escape via node:test Assigned by VulnCheck
Sep 17, 2026 CVE-2026-92947 Critical 10.0 vm2 before 3.11.7 Memory Disclosure via Buffer Pool Assigned by VulnCheck
Sep 17, 2026 CVE-2026-92946 Critical 10.0 vm2 before 3.11.7 Remote Code Execution via require.external Assigned by VulnCheck
Sep 17, 2026 CVE-2026-92945 Medium 4.2 vm2 before 3.11.7 Module Allowlist Bypass via Prefix Matching Assigned by VulnCheck
Sep 17, 2026 CVE-2026-92944 Critical 9.8 vm2 3.10.2 through 3.11.6 Sandbox Escape via Promise Protector Assigned by VulnCheck
Sep 17, 2026 CVE-2026-92942 High 7.5 vm2 before 3.11.7 Timeout Bypass via FinalizationRegistry Assigned by VulnCheck
Sep 17, 2026 CVE-2026-92941 Critical 10.0 vm2 3.11.3 before 3.11.7 TLS Trust Store Manipulation Assigned by VulnCheck
Sep 17, 2026 CVE-2026-92940 Critical 10.0 vm2 3.11.3 through 3.11.6 HTTPS Credential Exposure via globalAgent Assigned by VulnCheck
Sep 17, 2026 CVE-2026-92939 Critical 9.9 vm2 3.11.3 through 3.11.6 Native Code Execution via crypto.setEngine Assigned by VulnCheck
Sep 17, 2026 CVE-2026-92938 Critical 9.9 vm2 3.11.3 through 3.11.6 Remote Code Execution via node:sqlite Assigned by VulnCheck
Sep 17, 2026 CVE-2026-92937 Critical 10.0 vm2 3.11.6 Remote Code Execution via Promise call/apply Assigned by VulnCheck
Sep 17, 2026 CVE-2026-92936 Medium 5.8 vm2 3.11.0 before 3.11.7 Information Disclosure via Error Stack Assigned by VulnCheck
Sep 17, 2026 CVE-2026-92935 Critical 9.0 vm2 NodeVM Remote Code Execution via Array-Shaped Require Assigned by VulnCheck
Sep 17, 2026 CVE-2026-92934 Critical 9.0 vm2 before 3.11.8 Sandbox Escape RCE via AggregateError Assigned by VulnCheck
Sep 17, 2026 CVE-2026-92933 Medium 5.8 vm2 before 3.11.8 Information Disclosure via util.getCallSites Assigned by VulnCheck
Sep 17, 2026 CVE-2026-47683 High 8.7 vm2: bufferAllocLimit cap bypassed by Buffer.concat and Buffer.from arrayLike Assigned by GitHub_M
Aug 17, 2026 CVE-2026-47686 Critical 9.9 vm2: Missing Error.cause Sanitization Enables VM2 Sandbox Escape to RCE Assigned by GitHub_M
Aug 17, 2026 CVE-2026-47698 Critical 9.8 vm2: Sandbox Breakout Using Dangerous Host Proto Mutators Assigned by GitHub_M
Aug 17, 2026
CVSS is the assigning CNA's score where it gives one, otherwise NVD's. The healthcare tag is a documented heuristic (a list of clinical and health IT vendors, and clinical terms in the description), not a classification. The CVE record is authoritative.
© 2026 MTC Group, LLC. All rights reserved. InfoSec Signals™ and the InfoSec Signals logo are trademarks of MTC Group, LLC.
Printed from infosec-signals.mtcgroupllc.com. Every record links back to the agency that published it.
