# cve.now: Patriksimek

The newest entries naming Patriksimek as an affected vendor (up to 200), of 77 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-100723](https://cve.now/CVE-2026-100723.md): vm2 before 3.12.2 Memory Disclosure via zlib Buffer Pool (CVSS 6.9)
- [CVE-2026-100722](https://cve.now/CVE-2026-100722.md): vm2 before 3.12.2 Host Process Termination via Construct Trap (CVSS 8.9)
- [CVE-2026-100721](https://cve.now/CVE-2026-100721.md): vm2 before 3.12.2 Authorization Bypass via Custom Resolver (CVSS 9.5)
- [CVE-2026-93606](https://cve.now/CVE-2026-93606.md): vm2 before 3.12.1 Sandbox Escape via Promise Symbol.species (CVSS 10.0)
- [CVE-2026-93605](https://cve.now/CVE-2026-93605.md): vm2 NodeVM before 3.12.1 Remote Code Execution via child\_process (CVSS 10.0)
- [CVE-2026-93604](https://cve.now/CVE-2026-93604.md): vm2 3.11.8 Sandbox Escape via crypto.setFips (CVSS 6.9)
- [CVE-2026-93603](https://cve.now/CVE-2026-93603.md): vm2 before 3.12.1 Sandbox Escape RCE via Non-Strict Host Function (CVSS 10.0)
- [CVE-2026-92963](https://cve.now/CVE-2026-92963.md): vm2 before 3.11.2 Information Disclosure via Internal State (CVSS 6.9)
- [CVE-2026-92962](https://cve.now/CVE-2026-92962.md): vm2 before 3.11.4 Defense Invariant Violation via setup-sandbox.js (CVSS 2.1)
- [CVE-2026-92961](https://cve.now/CVE-2026-92961.md): vm2 before 3.11.6 Memory Exhaustion DoS via bufferAllocLimit Bypass (CVSS 8.7)
- [CVE-2026-92960](https://cve.now/CVE-2026-92960.md): vm2 before 3.11.6 Process-wide State Exposure via os and dns (CVSS 10.0)
- [CVE-2026-92959](https://cve.now/CVE-2026-92959.md): vm2 before 3.11.8 allowAsync Bypass via Promise Thenable (CVSS 7.1)
- [CVE-2026-92958](https://cve.now/CVE-2026-92958.md): vm2 before 3.11.7 Denylist Bypass via fs/promises (CVSS 8.4)
- [CVE-2026-92957](https://cve.now/CVE-2026-92957.md): vm2 before 3.11.7 NodeVM Builtin Deny-List Bypass via node: Prefix (CVSS 9.4)
- [CVE-2026-92956](https://cve.now/CVE-2026-92956.md): vm2 3.10.1 through 3.11.6 Sandbox Escape via WebAssembly.compileStreaming (CVSS 10.0)
- [CVE-2026-92955](https://cve.now/CVE-2026-92955.md): vm2 before 3.11.8 Sandbox Escape via NodeVM (CVSS 10.0)
- [CVE-2026-92954](https://cve.now/CVE-2026-92954.md): vm2 3.10.0 through 3.11.7 Denial of Service via Host Promise (CVSS 9.2)
- [CVE-2026-92953](https://cve.now/CVE-2026-92953.md): vm2 3.11.0 through 3.11.7 Prototype Pollution via TypedArray (CVSS 9.3)
- [CVE-2026-92952](https://cve.now/CVE-2026-92952.md): vm2 3.11.4 through 3.11.6 Sandbox Symbol Filtering Bypass (CVSS 8.9)
- [CVE-2026-92951](https://cve.now/CVE-2026-92951.md): vm2 before 3.11.7 Module Allowlist Bypass via Custom Resolver (CVSS 9.4)
- [CVE-2026-92950](https://cve.now/CVE-2026-92950.md): vm2 before 3.11.7 Sandbox Escape via CLI require (CVSS 9.3)
- [CVE-2026-92949](https://cve.now/CVE-2026-92949.md): vm2 3.9.6 before 3.11.7 Sandbox Bypass via Accessor Descriptor (CVSS 6.3)
- [CVE-2026-92948](https://cve.now/CVE-2026-92948.md): vm2 3.9.6 through 3.11.5 Sandbox Escape via node:test (CVSS 9.4)
- [CVE-2026-92947](https://cve.now/CVE-2026-92947.md): vm2 before 3.11.7 Memory Disclosure via Buffer Pool (CVSS 10.0)
- [CVE-2026-92946](https://cve.now/CVE-2026-92946.md): vm2 before 3.11.7 Remote Code Execution via require.external (CVSS 10.0)
- [CVE-2026-92945](https://cve.now/CVE-2026-92945.md): vm2 before 3.11.7 Module Allowlist Bypass via Prefix Matching (CVSS 2.3)
- [CVE-2026-92944](https://cve.now/CVE-2026-92944.md): vm2 3.10.2 through 3.11.6 Sandbox Escape via Promise Protector (CVSS 9.3)
- [CVE-2026-92942](https://cve.now/CVE-2026-92942.md): vm2 before 3.11.7 Timeout Bypass via FinalizationRegistry (CVSS 8.7)
- [CVE-2026-92941](https://cve.now/CVE-2026-92941.md): vm2 3.11.3 before 3.11.7 TLS Trust Store Manipulation (CVSS 10.0)
- [CVE-2026-92940](https://cve.now/CVE-2026-92940.md): vm2 3.11.3 through 3.11.6 HTTPS Credential Exposure via globalAgent (CVSS 10.0)
- [CVE-2026-92939](https://cve.now/CVE-2026-92939.md): vm2 3.11.3 through 3.11.6 Native Code Execution via crypto.setEngine (CVSS 9.4)
- [CVE-2026-92938](https://cve.now/CVE-2026-92938.md): vm2 3.11.3 through 3.11.6 Remote Code Execution via node:sqlite (CVSS 9.4)
- [CVE-2026-92937](https://cve.now/CVE-2026-92937.md): vm2 3.11.6 Remote Code Execution via Promise call/apply (CVSS 10.0)
- [CVE-2026-92936](https://cve.now/CVE-2026-92936.md): vm2 3.11.0 before 3.11.7 Information Disclosure via Error Stack (CVSS 6.9)
- [CVE-2026-92935](https://cve.now/CVE-2026-92935.md): vm2 NodeVM Remote Code Execution via Array-Shaped Require (CVSS 9.5)
- [CVE-2026-92934](https://cve.now/CVE-2026-92934.md): vm2 before 3.11.8 Sandbox Escape RCE via AggregateError (CVSS 9.5)
- [CVE-2026-92933](https://cve.now/CVE-2026-92933.md): vm2 before 3.11.8 Information Disclosure via util.getCallSites (CVSS 6.9)
- [CVE-2026-47683](https://cve.now/CVE-2026-47683.md): vm2: bufferAllocLimit cap bypassed by Buffer.concat and Buffer.from arrayLike (CVSS 8.7)
- [CVE-2026-47686](https://cve.now/CVE-2026-47686.md): vm2: Missing Error.cause Sanitization Enables VM2 Sandbox Escape to RCE (CVSS 9.9)
- [CVE-2026-47698](https://cve.now/CVE-2026-47698.md): vm2: Sandbox Breakout Using Dangerous Host Proto Mutators (CVSS 9.8)
- [CVE-2026-47141](https://cve.now/CVE-2026-47141.md): vm2: NodeVM observability builtins leak host process and HTTP request data (CVSS 6.9)
- [CVE-2026-47210](https://cve.now/CVE-2026-47210.md): vm2 sandbox escape via JSPI-backed Promise \`.finally()\` species bypass (CVSS 9.8)
- [CVE-2026-47208](https://cve.now/CVE-2026-47208.md): vm2: Sandbox Breakout Using Promise Species (CVSS 10.0)
- [CVE-2026-47140](https://cve.now/CVE-2026-47140.md): vm2: NodeVM builtin denylist bypass via process and inspector/promises allows host code execution (CVSS 10.0)
- [CVE-2026-47139](https://cve.now/CVE-2026-47139.md): vm2: NodeVM network builtin exclusions bypass via internal \_http\_client and \_http\_server (CVSS 8.6)
- [CVE-2026-47137](https://cve.now/CVE-2026-47137.md): vm2: GHSA-8hg8-63c5-gwmx patch bypass: nesting:true without explicit require still allows full RCE (CVSS 10.0)
- [CVE-2026-47135](https://cve.now/CVE-2026-47135.md): vm2: Sandbox escape via unblocked cross-realm Symbol.for keys + missing bridge write-trap symbol checks (CVSS 8.7)
- [CVE-2026-47131](https://cve.now/CVE-2026-47131.md): vm2: Sandbox Escape (CVSS 10.0)
- [CVE-2026-47209](https://cve.now/CVE-2026-47209.md): vm2: Bridge Proxy set trap ignores receiver parameter, enabling host object property injection via prototype chain (CVSS 8.6)
- [CVE-2026-44005](https://cve.now/CVE-2026-44005.md): vm2: Sandbox escape (CVSS 10.0)
- [CVE-2026-45411](https://cve.now/CVE-2026-45411.md): vm2: Sandbox Breakout Using Async Generator (CVSS 9.8)
- [CVE-2026-44009](https://cve.now/CVE-2026-44009.md): vm2: Sandbox Breakout Through Null Proto Exception (CVSS 9.8)
- [CVE-2026-44008](https://cve.now/CVE-2026-44008.md): vm2 has sandbox breakout via \`neutralizeArraySpeciesBatch\` (CVSS 9.8)
- [CVE-2026-44007](https://cve.now/CVE-2026-44007.md): vm2: nesting: true bypasses require: false, allowing sandbox escape to arbitrary OS command execution (CVSS 9.1)
- [CVE-2026-44006](https://cve.now/CVE-2026-44006.md): vm2: Sandbox Escape (CVSS 10.0)
- [CVE-2026-44004](https://cve.now/CVE-2026-44004.md): vm2: Host Process OOM DoS via Buffer.alloc (Timeout Bypass) (CVSS 7.5)
- [CVE-2026-44003](https://cve.now/CVE-2026-44003.md): vm2: Transformer Fast-Path Bypass Exposes Internal State Variable (CVSS 5.3)
- [CVE-2026-44002](https://cve.now/CVE-2026-44002.md): vm2: Host File Path Disclosure via Stack Trace Information Leak (CVSS 5.8)
- [CVE-2026-44001](https://cve.now/CVE-2026-44001.md): vm2: Sandbox Escape via Promise Constructor Unhandled Rejection (Process Crash DoS) (CVSS 8.6)
- [CVE-2026-44000](https://cve.now/CVE-2026-44000.md): vm2: sandbox boundary bypass via host Promise resolution preserving host object identity (CVSS 6.5)
- [CVE-2026-43999](https://cve.now/CVE-2026-43999.md): vm2: NodeVM builtin allowlist bypass via \`module\` builtin's \`Module.\_load\` allows sandbox escape (CVSS 9.9)
- [CVE-2026-43998](https://cve.now/CVE-2026-43998.md): vm2: NodeVM require.root bypass via symlink traversal allows sandbox escape (CVSS 8.5)
- [CVE-2026-43997](https://cve.now/CVE-2026-43997.md): vm2: Sandbox Escape (CVSS 10.0)
- [CVE-2026-26956](https://cve.now/CVE-2026-26956.md): vm2: WASM Sandbox Escape (Node 25 only) (CVSS 9.8)
- [CVE-2026-26332](https://cve.now/CVE-2026-26332.md): vm2: Sandbox Escape (CVSS 9.8)
- [CVE-2026-24781](https://cve.now/CVE-2026-24781.md): vm2: Sandbox Breakout Through Inspect (CVSS 9.8)
- [CVE-2026-24120](https://cve.now/CVE-2026-24120.md): vm2: Sandbox Breakout Through Promise Species (CVSS 9.8)
- [CVE-2026-24118](https://cve.now/CVE-2026-24118.md): VM2 Sandbox Breakout Through lookupGetter (CVSS 9.8)
- [CVE-2026-22709](https://cve.now/CVE-2026-22709.md): vm2 has a Sandbox Escape (CVSS 9.8)
- [CVE-2023-37903](https://cve.now/CVE-2023-37903.md): Sandbox Escape in vm2 (CVSS 9.8)
- [CVE-2023-37466](https://cve.now/CVE-2023-37466.md): vm2 Sandbox Escape vulnerability (CVSS 9.8)
- [CVE-2023-32314](https://cve.now/CVE-2023-32314.md): Sandbox Escape (CVSS 9.8)
- [CVE-2023-32313](https://cve.now/CVE-2023-32313.md): Inspect method manipulation in vm2 (CVSS 5.3)
- [CVE-2023-30547](https://cve.now/CVE-2023-30547.md): Sandbox Escape in vm2 (CVSS 9.8)
- [CVE-2023-29199](https://cve.now/CVE-2023-29199.md): vm2 Sandbox escape vulnerability (CVSS 9.8)
- [CVE-2023-29017](https://cve.now/CVE-2023-29017.md): vm2 Sandbox Escape vulnerability (CVSS 10.0)
- [CVE-2022-36067](https://cve.now/CVE-2022-36067.md): vm2 vulnerable to Sandbox Escape before v3.9.11 (CVSS 10.0)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/patriksimek
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.