CVE-2026-92960 - vm2 before 3.11.6 fails to restrict access to os and dns builtins under the builtin: ['*'] configura

CVE-2026-92956 - vm2 versions 3.10.1 through 3.11.6 contain a sandbox escape reachable from a default `new VM()` sand

CVE-2026-92955 - vm2 before 3.11.8 contains a sandbox escape vulnerability in NodeVM that allows attackers to access

CVE-2026-92953 - vm2 versions from 3.11.0 before 3.11.8 fail to protect host TypedArray and ArrayBuffer prototypes fr

CVE-2026-92947 - vm2 before 3.11.7 exposes Node's shared Buffer pool to sandboxed code, allowing disclosure of host m

CVE-2026-92946 - vm2 before 3.11.7 contains a remote code execution vulnerability when require.external is enabled wi

CVE-2026-92941 - vm2 versions from 3.11.3 before 3.11.7 expose the host tls module to NodeVM sandbox code, allowing a

CVE-2026-92940 - vm2 versions 3.11.3 through 3.11.6 expose the host process's real https.globalAgent to sandboxed cod

CVE-2026-92937 - vm2 3.11.6 is vulnerable to a sandbox escape leading to remote code execution in the host Node.js pr

CVE-2026-62104 - Unauthenticated Remote Code Execution (RCE) in Migratico Lite <= 2.6.8 versions.