Search Vulnerabilities

Claude Desktop: Local Privilege Escalation via Directory Junction in CoworkVMService

Claude Desktop: SSH Host Key Verification Bypass Allows Man-in-the-Middle Attack on Remote Sessions

Malicious code in @b2bneo-rest/api-csf (npm)

vm2 NodeVM `nesting: true` bypasses `require: false` allowing sandbox escape and arbitrary OS command execution

vm2 has a NodeVM require.root bypass via symlink traversal that allows sandbox escape

vm2's Transformer Fast-Path Bypass Exposes Internal State Variable

vm2 is Vulnerable to Host File Path Disclosure via Stack Trace Information Leak

vm2 Host Promise Resolution Preserves Object Identity Across Sandbox Boundary

vm2 Sandbox Access to Host Buffer.alloc Allows timeout Bypass Resulting in Memory Exhaustion

vm2 has a Sandbox Escape via Promise Constructor Unhandled Rejection (Process Crash DoS)

vm2 has a NodeVM builtin allowlist bypass via `module` builtin's `Module._load` that allows sandbox escape

vm2: Mutable Proxies for Host Intrinsic Prototypes Allows Sandbox Escape

vm2 Access to Host Object Enables Sandbox Escape

Malicious code in mrdaa-frontend (npm)

vm2 has a Sandbox Escape Vulnerability

Kiota abstractions RedirectHandler leaks Cookie/Proxy-Authorization headers on cross-host redirect

Malicious code in 24712-pl5006 (npm)

Vercel: Non-interactive mode includes CLI arguments in suggested command output

Hono: bodyLimit() can be bypassed for chunked / unknown-length requests

hono/jsx has Unvalidated JSX Tag Names that May Allow HTML Injection