| CVE ID | Title | Vendor | Product | Severity | CVSS Score | Published At | AI Analysis |
|---|---|---|---|---|---|---|---|
| CVE-2026-92944 | vm2 3.10.2 through 3.11.6 Sandbox Escape via Promise Protector | patriksimek | vm2 | Critical | 9.8 | 2026-09-17 13:46:06 | Deep Dive |
| CVE-2026-92941 | vm2 3.11.3 before 3.11.7 TLS Trust Store Manipulation | patriksimek | vm2 | Critical | 10.0 | 2026-09-17 13:46:05 | Deep Dive |
| CVE-2026-92940 | vm2 3.11.3 through 3.11.6 HTTPS Credential Exposure via globalAgent | patriksimek | vm2 | Critical | 10.0 | 2026-09-17 13:46:04 | Deep Dive |
| CVE-2026-92939 | vm2 3.11.3 through 3.11.6 Native Code Execution via crypto.setEngine | patriksimek | vm2 | Critical | 9.9 | 2026-09-17 13:46:04 | Deep Dive |
| CVE-2026-92938 | vm2 3.11.3 through 3.11.6 Remote Code Execution via node:sqlite | patriksimek | vm2 | Critical | 9.9 | 2026-09-17 13:46:03 | Deep Dive |
| CVE-2026-92937 | vm2 3.11.6 Remote Code Execution via Promise call/apply | patriksimek | vm2 | Critical | 10.0 | 2026-09-17 13:46:02 | Deep Dive |
| CVE-2026-92935 | vm2 NodeVM Remote Code Execution via Array-Shaped Require | patriksimek | vm2 | Critical | 9.0 | 2026-09-17 13:46:01 | Deep Dive |
| CVE-2026-92934 | vm2 before 3.11.8 Sandbox Escape RCE via AggregateError | patriksimek | vm2 | Critical | 9.0 | 2026-09-17 13:46:00 | Deep Dive |
| CVE-2026-62108 | WordPress Headless Single Sign On plugin <= 1.7.0 - Broken Authentication vulnerability | miniOrange | Headless Single Sign On | Critical | 9.8 | 2026-09-17 13:24:38 | Deep Dive |
| CVE-2026-62104 | WordPress Migratico Lite plugin <= 2.6.8 - Remote Code Execution (RCE) vulnerability | superweby | Migratico Lite | Critical | 10.0 | 2026-09-17 13:24:37 | Deep Dive |
| CVE-2026-62101 | WordPress EduAdmin Booking plugin <= 5.4.2 - Broken Authentication vulnerability | Chris Åkerfeldt Wendel | EduAdmin Booking | Critical | 9.8 | 2026-09-17 13:24:36 | Deep Dive |
| CVE-2026-85500 | `require_confirmed_with` is not enforced on the action and fails open on an unreadable attribute in AshAuthentication | team-alembic | ash_authentication | Critical | 9.1 | 2026-09-17 13:09:43 | Deep Dive |
| CVE-2026-86533 | Revoked session accepted because the session jti is never checked in AshAuthentication and AshAuthentication Phoenix | team-alembic | ash_authentication | Critical | 9.1 | 2026-09-17 13:09:38 | Deep Dive |
| CVE-2026-82761 | Magic link single-use tokens replayable via TOCTOU race in AshAuthentication | team-alembic | ash_authentication | Critical | 9.1 | 2026-09-17 13:09:02 | Deep Dive |
| CVE-2026-92860 | rcourtman Pulse Quick Security Setup quick-setup fmt.Sprintf input validation | rcourtman | Pulse | Critical | 9.1 | 2026-09-17 12:00:16 | Deep Dive |
| CVE-2026-90823 | FatPipe固件10.1.2r60p100存在栈溢出漏洞 | FatPipe Networks | MPVPN | Critical | 9.8 | 2026-09-17 11:57:55 | Deep Dive |
| CVE-2026-90822 | FatPipe 10.1.2r60p100 命令注入漏洞 | FatPipe Networks | MPVPN | Critical | 9.8 | 2026-09-17 11:57:44 | Deep Dive |
| CVE-2026-15688 | Password Authentication Bypass Vulnerability in GX Works3 and Motion Control Setting | Mitsubishi Electric Corporation | GX Works3 | Critical | 9.2 | 2026-09-17 08:15:28 | Deep Dive |
| CVE-2026-87796 | Multi Uploader for Gravity Forms <= 1.1.9 - Unauthenticated Arbitrary File Upload via Chunked File Upload | sh1zen | Multi Uploader for Gravity Forms | Critical | 9.8 | 2026-09-17 04:28:15 | Deep Dive |
| CVE-2026-61594 | djust has an authorization bypass on the WebSocket/SSE mount path | djust-org | djust | Critical | 9.1 | 2026-09-16 21:59:02 | Deep Dive |