SecOne4allLoading…
S1SecOne4all
Join free
CVE✓ EDITORIALLY REVIEWED

CVE-2026-92945: vm2 before 3.11.7 contains a module allowlist bypass vulnerability in isPathAllowedForModule that uses raw string prefix matching instead of boundary-anchored comparison. Attackers

vm2 before 3.11.7 contains a module allowlist bypass vulnerability in isPathAllowedForModule that uses raw string prefix matching instead of boundary-anchored comparison. Attackers can reach non-allowlisted packages sharing a prefix with allowlisted modules by performing relative requires from allowlisted packages when transitive loading is disabled.

NNVD CVE APIOriginal reporting source
1 min read

Source summary

vm2 before 3.11.7 contains a module allowlist bypass vulnerability in isPathAllowedForModule that uses raw string prefix matching instead of boundary-anchored comparison. Attackers can reach non-allowlisted packages sharing a prefix with allowlisted modules by performing relative requires from allowlisted packages when transitive loading is disabled.

Read the original report

Source transparency

This editorial summary links back to the original reporting. Review the source for its complete context and updates.

Open original report ↗
Continue reading
More verified coverage
CVE · Sep 17, 2026 · 03:19 PM · UTC · UTC+00:00CVE-2026-92973: ansi2html versions 1.7.0a0 through 1.9.3 contain a cross-site scripting vulnerability in OSC 8 hyperlink handling that fails to validate or escape URL targets. Attackers controllin

ansi2html versions 1.7.0a0 through 1.9.3 contain a cross-site scripting vulnerability in OSC 8 hyperlink handling that fails to validate or escape URL targets. Attackers controlling ANSI text input can inject javascript: schemes or terminate href attributes to execute arbitrary scripts in the context of pages displaying converted output.

Read article →CYBERSECURITY · Sep 29, 2024 · 06:09 AM · UTC · UTC+00:00Apple iOS 17.2.1 - Screen Time Passcode Retrieval (Mitigation Bypass)

<p>A mitigation bypass / privilege escalation flaw has been discovered in Apple's iOS Screen Time functionality</p>

Read article →CYBERSECURITY · Sep 28, 2024 · 11:07 AM · UTC · UTC+00:00CVE-2024-8056: MM-Breaking News WordPress Plugin Reflected XSS Vulnerability

<p>The MM-Breaking News WordPress plugin through 0.7.9 does not escape the $_SERVER['REQUEST_URI'] parameter before outputting it back in an attribute, which could lead to Reflected Cross-Site Scripting in old web browsers</p>

Read article →