https://vulnerability.circl.lu/sightings/feed 2026-09-17T18:22:30.783219+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent sightings. https://vulnerability.circl.lu/sighting/72d2baa5-dd8d-4db0-89d0-f4bfb7e5d700/export 2026-09-17T18:22:30.807038+00:00 Automation user https://cve.circl.lu/user/automation {"uuid": "72d2baa5-dd8d-4db0-89d0-f4bfb7e5d700", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-92957", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mvq4vmvkn625", "content": "CVE-2026-92957 - vm2\nThe vm2 sandbox library (versions before 3.11.7) does not correctly block the built\u2011in child_process module when a deny list uses the \u201cnode:\u201d prefix. As a result, code running inside the\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#vm2 #patriksimek #CVE #infosec", "creation_timestamp": "2026-09-17T17:00:10.415087Z"} 2026-09-17T17:00:10.415087+00:00 https://vulnerability.circl.lu/sighting/4ec44329-7fed-44e9-a5ae-cd607b237348/export 2026-09-17T18:22:30.808464+00:00 Automation user https://cve.circl.lu/user/automation {"uuid": "4ec44329-7fed-44e9-a5ae-cd607b237348", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-92956", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mvq4dt2b7b2t", "content": "CVE-2026-92956 - vm2\nVersions 3.10.1 through 3.11.6 of the vm2 library let code run inside its default sandbox reach the underlying Node.js environment. An attacker could obtain the real process object and\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#vm2 #patriksimek #CVE #infosec", "creation_timestamp": "2026-09-17T16:50:10.288085Z"} 2026-09-17T16:50:10.288085+00:00 https://vulnerability.circl.lu/sighting/71b245f4-32f5-4054-96e6-f1223d115a84/export 2026-09-17T18:22:30.808571+00:00 Automation user https://cve.circl.lu/user/automation {"uuid": "71b245f4-32f5-4054-96e6-f1223d115a84", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-92954", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mvq4dqa76x24", "content": "CVE-2026-92954 - vm2\nVersions of the vm2 sandbox library between 3.10.0 and 3.11.5 can let malicious code ignore a failed promise from the host application, causing Node.js to shut down the entire process.\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#vm2 #patriksimek #CVE #infosec", "creation_timestamp": "2026-09-17T16:50:06.468607Z"} 2026-09-17T16:50:06.468607+00:00 https://vulnerability.circl.lu/sighting/4ac61f05-23a0-4b86-9e90-a1bed8cfefa4/export 2026-09-17T18:22:30.808644+00:00 Automation user https://cve.circl.lu/user/automation {"uuid": "4ac61f05-23a0-4b86-9e90-a1bed8cfefa4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-92953", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mvq3rw6o4i22", "content": "CVE-2026-92953 - vm2\nVersions of the vm2 sandbox from 3.11.0 up to 3.11.7 do not stop code running inside the sandbox from changing core JavaScript objects that control binary data handling. This means an\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#vm2 #patriksimek #CVE #infosec", "creation_timestamp": "2026-09-17T16:40:08.292148Z"} 2026-09-17T16:40:08.292148+00:00 https://vulnerability.circl.lu/sighting/9b245890-d3a5-4ce4-a0de-a99318ac70d9/export 2026-09-17T18:22:30.808715+00:00 Automation user https://cve.circl.lu/user/automation {"uuid": "9b245890-d3a5-4ce4-a0de-a99318ac70d9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-92951", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mvq3rtbfv62n", "content": "CVE-2026-92951 - vm2\nThe vm2 sandbox library can be tricked into loading code that isn\u2019t approved, letting attackers run unwanted programs on the host system. This happens because the library checks package\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#vm2 #patriksimek #CVE #infosec", "creation_timestamp": "2026-09-17T16:40:05.255744Z"} 2026-09-17T16:40:05.255744+00:00 https://vulnerability.circl.lu/sighting/5bf79c9a-c7aa-455e-b5c7-a03030fce7ae/export 2026-09-17T18:22:30.808792+00:00 Automation user https://cve.circl.lu/user/automation {"uuid": "5bf79c9a-c7aa-455e-b5c7-a03030fce7ae", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-92955", "type": "seen", "source": "https://bsky.app/profile/vulnsea.com/post/3mvq2gyiwpv2g", "content": "\ud83c\udf0a ABYSSAL \u00b7 critical with a public exploit\nCVE-2026-92955: vm2 before 3.11.8 contains a sandbox escape vulnerability in NodeVM that allows attackers to access the host __proto__ getter/setter through cons\u2026\nCVSS 10\nhttps://beta.vulnsea.com/cve/CVE-2026-92955\n\n#CVE #infosec #cybersecurity #threatintel", "creation_timestamp": "2026-09-17T16:16:08.149674Z"} 2026-09-17T16:16:08.149674+00:00 https://vulnerability.circl.lu/sighting/00080db4-a979-422f-ab5a-521f3f4a1ba2/export 2026-09-17T18:22:30.808861+00:00 Automation user https://cve.circl.lu/user/automation {"uuid": "00080db4-a979-422f-ab5a-521f3f4a1ba2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-92957", "type": "seen", "source": "https://bsky.app/profile/stemshop.bsky.social/post/3mvq25ddenw2t", "content": "\ud83d\udea8 CVE-2026-92957 \u2014 CVSS 9.4 CRITICAL\n\nvm2 through 3.11.6 does not normalize `node:`-prefixed builtin specifiers when evaluating user-supplied neg...\n\n\ud83d\udd0e https://stemshop.top/cve/CVE-2026-92957\n\n#CVE #CyberSecurity #InfoSec", "creation_timestamp": "2026-09-17T16:10:43.689600Z"} 2026-09-17T16:10:43.689600+00:00 https://vulnerability.circl.lu/sighting/5775dfa3-c013-41b2-a1b5-1c53ad145ed8/export 2026-09-17T18:22:30.808932+00:00 Automation user https://cve.circl.lu/user/automation {"uuid": "5775dfa3-c013-41b2-a1b5-1c53ad145ed8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-92956", "type": "seen", "source": "https://bsky.app/profile/stemshop.bsky.social/post/3mvq253bvtj2j", "content": "\ud83d\udea8 CVE-2026-92956 \u2014 CVSS 10 CRITICAL\n\nvm2 versions 3.10.1 through 3.11.6 contain a sandbox escape reachable from a default `new VM()` sandbox whe...\n\n\ud83d\udd0e https://stemshop.top/cve/CVE-2026-92956\n\n#CVE #CyberSecurity #InfoSec", "creation_timestamp": "2026-09-17T16:10:35.411576Z"} 2026-09-17T16:10:35.411576+00:00 https://vulnerability.circl.lu/sighting/ed6cc2f2-2120-4da1-8d1a-d755f4eec1ef/export 2026-09-17T18:22:30.809001+00:00 Automation user https://cve.circl.lu/user/automation {"uuid": "ed6cc2f2-2120-4da1-8d1a-d755f4eec1ef", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-92955", "type": "seen", "source": "https://bsky.app/profile/stemshop.bsky.social/post/3mvq24tfahn2p", "content": "\ud83d\udea8 CVE-2026-92955 \u2014 CVSS 10 CRITICAL\n\nvm2 before 3.11.8 contains a sandbox escape vulnerability in NodeVM that allows attackers to access the hos...\n\n\ud83d\udd0e https://stemshop.top/cve/CVE-2026-92955\n\n#CVE #CyberSecurity #InfoSec", "creation_timestamp": "2026-09-17T16:10:27.201416Z"} 2026-09-17T16:10:27.201416+00:00 https://vulnerability.circl.lu/sighting/b2a79c70-450f-4f96-8b3f-8cc8a9e7e6ac/export 2026-09-17T18:22:30.809071+00:00 Automation user https://cve.circl.lu/user/automation {"uuid": "b2a79c70-450f-4f96-8b3f-8cc8a9e7e6ac", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-92954", "type": "seen", "source": "https://bsky.app/profile/stemshop.bsky.social/post/3mvq24ldgos2t", "content": "\ud83d\udea8 CVE-2026-92954 \u2014 CVSS 9.2 CRITICAL\n\nvm2 is a sandbox library for running untrusted JavaScript in Node.js. In versions >= 3.10.0 and <= 3.11.7, ...\n\n\ud83d\udd0e https://stemshop.top/cve/CVE-2026-92954\n\n#CVE #CyberSecurity #InfoSec", "creation_timestamp": "2026-09-17T16:10:18.569944Z"} 2026-09-17T16:10:18.569944+00:00