Export limit exceeded: 395020 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (395020 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-92956 | 1 Patriksimek | 1 Vm2 | 2026-09-17 | 10 Critical |
| vm2 versions 3.10.1 through 3.11.6 contain a sandbox escape reachable from a default `new VM()` sandbox when running on Node.js 26. WebAssembly.compileStreaming and WebAssembly.instantiateStreaming can produce a raw host-realm Promise that rejects with a host-realm error object; by controlling Symbol.species via Promise.prototype.finally, sandbox code receives that raw host error, walks from the host error constructor to the host Function constructor, and recovers the real host `process` object, gaining host Node.js capabilities (e.g. access to host modules such as fs) in the context of the process running the sandbox. No NodeVM, require permission, host object injection, or otherwise unsafe configuration is required. This is a bypass of the fix for GHSA-6j2x-vhqr-qr7q, which removed the JSPI entry points WebAssembly.promising and WebAssembly.Suspending. The issue is fixed in 3.11.7. | ||||
| CVE-2026-92958 | 1 Patriksimek | 1 Vm2 | 2026-09-17 | 8.5 High |
| vm2 through 3.11.6 contains a builtin-module denylist bypass in NodeVM. When the embedder uses the builtin wildcard together with negative entries (e.g. require: { builtin: ['*', '-fs', '-child_process'] }), negative entries are matched by exact module name in lib/builtin.js, so -fs removes only the builtin named fs and does not remove builtin subpaths such as fs/promises. Sandboxed code can therefore call require('fs/promises') or require('node:fs/promises') and reach the promise-based filesystem API despite fs being denied; node: prefix handling is likewise inconsistent (a -node:fs/promises entry does not block require('fs/promises')). Host file creation and writing were confirmed via fsp.writeFile(), and other fs/promises operations (cp, mkdir, rename, rm, rmdir, truncate, read operations, etc.) are also reachable. This issue is fixed in vm2 3.11.7. | ||||
| CVE-2026-71538 | 1 Cyclonedx | 1 Cyclonedx Node Npm | 2026-09-17 | N/A |
| @cyclonedx/cyclonedx-npm creates CycloneDX Software Bill of Materials from npm projects. Prior to version 6.0.0, the Windows fallback path in src/npmRunner.ts, used when npm_execpath does not provide the npm CLI path, can construct a shell command containing an untrusted value from the --workspace option. When an attacker can influence that option and the fallback npm execution path is reached, shell metacharacters in the workspace value can execute arbitrary operating-system commands with the privileges of the user running the CLI, allowing data access, file modification, or service disruption. This issue is fixed in version 6.0.0. | ||||
| CVE-2026-85917 | 1 Microsoft | 1 Azure Ai Foundry | 2026-09-17 | 7.5 High |
| Server-side request forgery (ssrf) in Azure AI Foundry allows an unauthorized attacker to elevate privileges over a network. | ||||
| CVE-2026-85889 | 1 Microsoft | 1 Azure Ai Foundry | 2026-09-17 | 10 Critical |
| Missing authentication for critical function in Azure AI Foundry allows an unauthorized attacker to elevate privileges over a network. | ||||
| CVE-2026-70200 | 1 Microsoft | 1 Azure Logic Apps | 2026-09-17 | 10 Critical |
| Improper limitation of a pathname to a restricted directory ('path traversal') in Azure Logic Apps allows an unauthorized attacker to elevate privileges over a network. | ||||
| CVE-2026-87701 | 1 Microsoft | 1 Cosmos Db | 2026-09-17 | 9.6 Critical |
| Improper neutralization of special elements in output used by a downstream component ('injection') in Azure Cosmos DB allows an authorized attacker to elevate privileges over a network. | ||||
| CVE-2026-78501 | 1 Microsoft | 1 365 Copilot Business Chat | 2026-09-17 | 7.4 High |
| Improper neutralization of special elements used in a command ('command injection') in Microsoft 365 Copilot's Business Chat allows an unauthorized attacker to disclose information over a network. | ||||
| CVE-2026-83944 | 1 Microsoft | 1 Azure Logic Apps | 2026-09-17 | 10 Critical |
| Improper access control in Azure Logic Apps allows an unauthorized attacker to elevate privileges over a network. | ||||
| CVE-2026-85885 | 1 Microsoft | 1 365 Copilot | 2026-09-17 | 9.9 Critical |
| Improper neutralization of special elements used in a command ('command injection') in M365 Copilot allows an authorized attacker to elevate privileges over a network. | ||||
| CVE-2026-68791 | 1 Microsoft | 1 Azure Machine Learning | 2026-09-17 | 8.6 High |
| Incorrect authorization in Azure Machine Learning allows an unauthorized attacker to disclose information over a network. | ||||
| CVE-2026-69399 | 1 Microsoft | 1 Azure Arc | 2026-09-17 | 10 Critical |
| Azure Arc Elevation of Privilege Vulnerability | ||||
| CVE-2026-77903 | 1 Microsoft | 1 Dataverse | 2026-09-17 | 9 Critical |
| Authentication bypass by spoofing in Microsoft Dataverse allows an unauthorized attacker to elevate privileges over a network. | ||||
| CVE-2026-69865 | 1 Microsoft | 1 Azure Container Registry | 2026-09-17 | 10 Critical |
| Authorization bypass through user-controlled key in Microsoft Container Registry allows an unauthorized attacker to elevate privileges over a network. | ||||
| CVE-2026-70009 | 1 Microsoft | 1 Azure Arc | 2026-09-17 | 9.3 Critical |
| Improper limitation of a pathname to a restricted directory ('path traversal') in Azure Arc allows an unauthorized attacker to elevate privileges over a network. | ||||
| CVE-2026-55946 | 1 Microsoft | 1 Copilot | 2026-09-17 | 6.1 Medium |
| Improper neutralization of special elements used in a command ('command injection') in Microsoft Copilot allows an unauthorized attacker to disclose information over a network. | ||||
| CVE-2026-79276 | 1 Google | 1 Chrome | 2026-09-17 | 4.3 Medium |
| Improper privilege management in FileSystem in Google Chrome prior to 152.0.7977.65 allowed a remote attacker leveraging social engineering to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Medium) | ||||
| CVE-2026-79264 | 1 Google | 1 Chrome | 2026-09-17 | 4.3 Medium |
| Incorrect reference resolution in Preload in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: Medium) | ||||
| CVE-2026-79259 | 1 Google | 1 Chrome | 2026-09-17 | 4.3 Medium |
| Improper input validation in Safebrowsing in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to bypass system access restrictions via a crafted file. (Chromium security severity: Medium) | ||||
| CVE-2026-79251 | 1 Google | 1 Chrome | 2026-09-17 | 4.3 Medium |
| Improper input validation in Network in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to potentially bypass web origin policy via a crafted HTML page. (Chromium security severity: Medium) | ||||