VM
Product
vm2
71
CVEs
0
On KEV
10.0
Max CVSS
0
New 30D
Severity mix
Critical 44High 16Medium 10Low 1
Watch
Add vm2 to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-47141 | 6.9 | Jun 12 | vm2: NodeVM observability builtins leak host process and HTTP request data Affected: < 3.11.4 |
| CVE-2026-100722 | 6.8 | Sep 27 | vm2 before 3.12.2 Host Process Termination via Construct Trap Affected: before 3.12.2 |
| CVE-2026-92952 | 6.8 | Sep 17 | vm2 3.11.4 through 3.11.6 Sandbox Symbol Filtering Bypass Affected: 3.11.4 before 3.11.7 |
| CVE-2026-92936 | 5.8 | Sep 17 | vm2 3.11.0 before 3.11.7 Information Disclosure via Error Stack Affected: 3.11.0 before 3.11.7 |
| CVE-2026-92933 | 5.8 | Sep 17 | vm2 before 3.11.8 Information Disclosure via util.getCallSites Affected: before 3.11.8 |
| CVE-2026-44003 | 5.8 | May 13 | vm2: Transformer Fast-Path Bypass Exposes Internal State Variable Affected: < 3.11.0 |
| CVE-2026-44002 | 5.8 | May 13 | vm2: Host File Path Disclosure via Stack Trace Information Leak Affected: < 3.11.0 |
| CVE-2026-92963 | 5.3 | Sep 17 | vm2 before 3.11.2 Information Disclosure via Internal State Affected: before 3.11.2 |
| CVE-2026-92945 | 4.2 | Sep 17 | vm2 before 3.11.7 Module Allowlist Bypass via Prefix Matching Affected: before 3.11.7 |
| CVE-2026-92949 | 4.0 | Sep 17 | vm2 3.9.6 before 3.11.7 Sandbox Bypass via Accessor Descriptor Affected: 3.9.6 before 3.11.7 |
Showing 10