https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-06T08:45:54.877578+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/bdu:2023-02119 bdu:2023-02119 2026-10-06T08:45:54.884860+00:00 bdu:2023-02119 https://cve.radiocsirt.org/vuln/certfr-2023-avi-0597 certfr-2023-avi-0597 — De multiples vulnérabilités ont été découvertes dans<span class="textit"> IBM Cognos Analytics</span>. Certaines d'entr… 2026-10-06T08:45:54.884894+00:00 certfr-2023-avi-0597 https://cve.radiocsirt.org/vuln/euvd-2026-214073 EUVD-2026-214073 2026-10-06T08:45:54.884912+00:00 EUVD-2026-214073 https://cve.radiocsirt.org/vuln/fkie_cve-2023-29199 fkie_cve-2023-29199 2026-10-06T08:45:54.884924+00:00

There exists a vulnerability in source code transformer (exception sanitization logic) of vm2 for versions up to 3.9.15, allowing attackers to bypass `handleException()` and leak unsanitized host exceptions which can be used to escape the sandbox and run arbitrary code in host context. A threat actor can bypass the sandbox protections to gain remote code execution rights on the host running the sandbox. This vulnerability was patched in the release of version `3.9.16` of `vm2`.

 https://cve.radiocsirt.org/vuln/ghsa-xj72-wvfv-8985 GHSA-xj72-wvfv-8985 — vm2 Sandbox Escape vulnerability 2026-10-06T08:45:54.884951+00:00

Affected: npm: vm2

There exists a vulnerability in source code transformer (exception sanitization logic) of vm2 for versions up to 3.9.15, allowing attackers to bypass `handleException()` and leak unsanitized host exceptions which can be used to escape the sandbox and run arbitrary code in host context.

### Impact A threat actor can bypass the sandbox protections to gain remote code execution rights on the host running the sandbox.

### Patches This vulnerability was patched in the release of version `3.9.16` of `vm2`.

### Workarounds None.

### References Github Issue - https://github.com/patriksimek/vm2/issues/516 PoC - https://gist.github.com/leesh3288/f05730165799bf56d70391f3d9ea187c

### For more information

If you have any questions or comments about this advisory:

- Open an issue in [VM2](https://github.com/patriksimek/vm2)

Thanks to [Xion](https://twitter.com/0x10n) (SeungHyun Lee) of [KAIST Hacking Lab](https://kaist-hacking.github.io/) for disclosing this vulnerability.

 https://cve.radiocsirt.org/vuln/gsd-2023-29199 gsd-2023-29199 2026-10-06T08:45:54.884984+00:00 gsd-2023-29199 https://cve.radiocsirt.org/vuln/rhsa-2023:1893 RHSA-2023:1893 — Red Hat Security Advisory: Multicluster Engine for Kubernetes 2.0 hotfix security update for console 2026-10-06T08:45:54.884995+00:00

vm2: sandbox escape vm2: Sandbox Escape vm2: Sandbox Escape when exception sanitization

 https://cve.radiocsirt.org/vuln/wid-sec-w-2023-1004 WID-SEC-W-2023-1004 — vm2: Mehrere Schwachstellen 2026-10-06T08:45:54.885013+00:00

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in vm2 ausnutzen, um aus der Sandbox auszubrechen und beliebigen Code im Host-Kontext auszuführen.