Recent Advisories

Severity ID Title Vendor Product Date Type
CRITICAL 9.8 CVE-2026-54133

jmespath.php has CompilerRuntime code injection via unescaped function names_CVE-2026-54133

jmespath.php allows users to use JMESPath, software for declaratively specifying how to extract elements from a JSON document, in PHP applications ...

jmespath jmespath.php < 2.9.1 CVE
CRITICAL 9.3 CVE-2026-53787

Amasty Order Attributes for Magento 2 < 4.0.0 Unauthenticated Arbitrary File Upload_CVE-2026-53787

Amasty Order Attributes for Magento 2 before version 4.0.0 contains an unauthenticated arbitrary file upload vulnerability that allows unauthentica...

Amasty Order Attributes for Magento 2 CVE
MEDIUM 5.1 CVE-2026-53722

Nuxt: Reflected XSS in `` via unsanitised `javascript:` or `data:` URL_CVE-2026-53722

Nuxt is an open-source web development framework for Vue.js. Prior to versions 3.21.7 and 4.4.7, did not validate the URL scheme of values bound t...

nuxt nuxt < 3.21.7 CVE
HIGH 8.8 CVE-2026-53721

Nuxt: Route-rule middleware bypass via case-sensitivity mismatch between vue-router and the routeRules matcher_CVE-2026-53721

Nuxt is an open-source web development framework for Vue.js. From versions 3.11.0 to before 3.21.7 and 4.0.0 to before 4.4.7, there is a route-rule...

nuxt nuxt >= 3.11.0, < 3.21.7 CVE
MEDIUM 6.9 CVE-2026-47739

Frappe: Stored XSS in Note_CVE-2026-47739

Frappe is a full-stack web application framework. Prior to versions 15.106.0 and 16.16.0, stored XSS in Note was possible due to lack of sanitizati...

frappe frappe < 15.106.0 CVE
MEDIUM 5.3 CVE-2026-47244

Netty HTTP/2: Advertised MAX_CONCURRENT_STREAMS are not enforced_CVE-2026-47244

Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, Default...

netty netty >= 4.2.0.Final, < 4.2.15.Final CVE
CRITICAL 9.8 CVE-2026-47210

vm2 sandbox escape via JSPI-backed Promise `.finally()` species bypass_CVE-2026-47210

vm2 is an open source vm/sandbox for Node.js. Prior to version 3.11.4, a sandbox escape vulnerability in vm2 allows arbitrary code execution in the...

patriksimek vm2 < 3.11.4 CVE
HIGH 8.6 CVE-2026-47209

vm2: Bridge Proxy set trap ignores receiver parameter, enabling host object property injection via prototype chain_CVE-2026-47209

vm2 is an open source vm/sandbox for Node.js. Prior to version 3.11.4, the BaseHandler.set trap in bridge.js (line 1231) ignores the receiver param...

patriksimek vm2 < 3.11.4 CVE
CRITICAL 10 CVE-2026-47208

vm2: Sandbox Breakout Using Promise Species_CVE-2026-47208

vm2 is an open source vm/sandbox for Node.js. Prior to version 3.11.4, VM2 suffers from a sandbox breakout vulnerability. This allows attackers to ...

patriksimek vm2 < 3.11.4 CVE
MEDIUM 6.9 CVE-2026-47141

vm2: NodeVM observability builtins leak host process and HTTP request data_CVE-2026-47141

vm2 is an open source vm/sandbox for Node.js. Prior to version 3.11.4, NodeVM exposes some process-wide observability builtins when they are allowe...

patriksimek vm2 < 3.11.4 CVE