What’s Vulnerable › Products

patriksimek vm2 vulnerabilities

81 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 69 published in the last 12 months.

Check whether your patriksimek vm2 version is affected

Latest patriksimek vm2 vulnerabilities

• CVE-2026-100723 — vm2 before 3.12.2 Memory Disclosure via zlib Buffer Pool (CVSS 7.5)
• CVE-2026-100722 — vm2 before 3.12.2 Host Process Termination via Construct Trap (CVSS 6.8)
• CVE-2026-100721 — vm2 before 3.12.2 Authorization Bypass via Custom Resolver (CVSS 9.0)
• CVE-2026-93606 — vm2 before 3.12.1 Sandbox Escape via Promise Symbol.species (CVSS 10.0)
• CVE-2026-93605 — vm2 NodeVM before 3.12.1 Remote Code Execution via child_process (CVSS 10.0)
• CVE-2026-93604 — vm2 3.11.8 Sandbox Escape via crypto.setFips (CVSS 7.2)
• CVE-2026-93603 — vm2 before 3.12.1 Sandbox Escape RCE via Non-Strict Host Function (CVSS 10.0)
• CVE-2026-92963 — vm2 before 3.11.2 Information Disclosure via Internal State (CVSS 5.3)
• CVE-2026-92962 — vm2 before 3.11.4 Defense Invariant Violation via setup-sandbox.js (CVSS 2.1)
• CVE-2026-92961 — vm2 before 3.11.6 Memory Exhaustion DoS via bufferAllocLimit Bypass (CVSS 7.5)
• CVE-2026-92960 — vm2 before 3.11.6 Process-wide State Exposure via os and dns (CVSS 10.0)
• CVE-2026-92959 — vm2 before 3.11.8 allowAsync Bypass via Promise Thenable (CVSS 7.1)
• CVE-2026-92958 — vm2 before 3.11.7 Denylist Bypass via fs/promises (CVSS 8.5)
• CVE-2026-92957 — vm2 before 3.11.7 NodeVM Builtin Deny-List Bypass via node: Prefix (CVSS 9.9)
• CVE-2026-92956 — vm2 3.10.1 through 3.11.6 Sandbox Escape via WebAssembly.compileStreaming (CVSS 10.0)
• CVE-2026-92955 — vm2 before 3.11.8 Sandbox Escape via NodeVM (CVSS 10.0)
• CVE-2026-92954 — vm2 3.10.0 through 3.11.7 Denial of Service via Host Promise (CVSS 8.6)
• CVE-2026-92953 — vm2 3.11.0 through 3.11.7 Prototype Pollution via TypedArray (CVSS 10.0)
• CVE-2026-92952 — vm2 3.11.4 through 3.11.6 Sandbox Symbol Filtering Bypass (CVSS 6.8)
• CVE-2026-92951 — vm2 before 3.11.7 Module Allowlist Bypass via Custom Resolver (CVSS 9.9)
• CVE-2026-92950 — vm2 before 3.11.7 Sandbox Escape via CLI require (CVSS 8.6)
• CVE-2026-92949 — vm2 3.9.6 before 3.11.7 Sandbox Bypass via Accessor Descriptor (CVSS 4.0)
• CVE-2026-92948 — vm2 3.9.6 through 3.11.5 Sandbox Escape via node:test (CVSS 9.9)
• CVE-2026-92947 — vm2 before 3.11.7 Memory Disclosure via Buffer Pool (CVSS 10.0)
• CVE-2026-92946 — vm2 before 3.11.7 Remote Code Execution via require.external (CVSS 10.0)