Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

2 records

Release: patriksimek vm2 3.11.6 Clear all filters
TI-2026-62624 CVE-2026-92961 · GHSA-3m4j-9x2m-pq7h

vm2 before 3.11.6 Memory Exhaustion DoS via bufferAllocLimit Bypass

Priority MEDIUM 44

vm2 before 3.11.6 fails to enforce bufferAllocLimit on ArrayBuffer, SharedArrayBuffer, and TypedArray constructors, allowing attackers to allocate arbitrary host memory.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00533 Published 2026-09-17 Fixed in 3.11.6 CWE-770
TI-2026-62623 CVE-2026-92960 · GHSA-qj2x-7x9q-qgm7

vm2 before 3.11.6 Process-wide State Exposure via os and dns

Priority HIGH 82

vm2 before 3.11.6 fails to restrict access to os and dns builtins under the builtin: ['*'] configuration, allowing sandbox code to read host process identity and network topology.

CVSS 4.0CRITICAL 10.0 Network No auth No interaction EPSS 0.00474 Published 2026-09-17 Fixed in 3.11.6 CWE-200