vm2
No vm2 CVE is in the CISA KEV catalogue.
Tracked since 27 Jan · latest article Thu 20 Aug · RSS
Exploited, by due date
CSV downloadNo vm2 CVE is in the CISA KEV catalogue.
6 articles from 4 outlets since 27 Jan; the latest 66 days ago.
- Article
- First report
Show as table
| Published (UTC) | Outlet | Headline |
|---|---|---|
| Thu 20 Aug · 14:10 UTC | SecurityOnline | Critical CVE-2026-47686 vm2 flaw lets attackers escape sandbox |
| Thu 7 May · 11:51 UTC | SOCRadar | CVE-2026-26956: vm2 Sandbox Escape Enables Host RCE in Node.js 25 |
| Thu 7 May · 05:01 UTC | The Hacker News | Critical vm2 Node.js flaws expose systems to sandbox escapes |
| Wed 28 Jan · 14:35 UTC | The Hacker News | Critical vm2 Node.js Flaw Allows Sandbox Escape and Arbitrary Code Execution |
| Tue 27 Jan · 22:15 UTC | StepSecurity | CVE-2026-22709: Critical Sandbox Escape Vulnerability in vm2 |
| Tue 27 Jan · 04:40 UTC | SecurityOnline | CVSS 9.8 Sandbox Escape: Critical vm2 Flaw Exposes Millions of Apps |
Who reported 4 outlets, last 12 months
- SecurityOnline2
- The Hacker News2
- StepSecurity1
- SOCRadar1
- Critical CVE-2026-47686 vm2 flaw lets attackers escape sandboxSecurityOnline
- CVE-2026-26956: vm2 Sandbox Escape Enables Host RCE in Node.js 25SOCRadar
- Critical vm2 Node.js flaws expose systems to sandbox escapesThe Hacker News
- Critical vm2 Node.js Flaw Allows Sandbox Escape and Arbitrary Code ExecutionThe Hacker News
- CVE-2026-22709: Critical Sandbox Escape Vulnerability in vm2StepSecurity
- CVSS 9.8 Sandbox Escape: Critical vm2 Flaw Exposes Millions of AppsSecurityOnline
All CVEs in coverage
9How these numbers are made
CISA KEV counts use the full catalogue, refreshed every 10 minutes. CVEs in coverage are those recorded by CyberSIXT. BOD 22-01 deadlines bind US federal civilian agencies.
CVEs with FIRST EPSS at or above the 95th percentile (top 5%), excluding CVEs in CISA KEV. EPSS estimates exploitation probability over the next 30 days.
Coverage is above its usual rate at three or more articles in 7 days and at least 2.5 times the weekly mean of the preceding 8 weeks.
Product names are grouped by normalised names, with version and edition tails removed.
Fix listed refers to an advisory. Unknown fix status is counted as not listed.