CVE Vulnerabilities - 30 September 2026

containerd may skip source address check for certain callbacks

CLEANSTART-2026-TD03320

The containerd software can fail to verify the origin of a connection when a callback other than a public‑key is used. This could let an attacker bypass normal access checks and interact with the syst...

10.0

Kobako gem lets sandbox code break out

GHSA-7pwq-q9jf-539h CVE-2026-55107

The Kobako Ruby library (versions before 0.9.1) can let malicious Ruby code run inside its sandbox escape and execute anything on the main application. This means an attacker could take control of the...

10.0

OrdaSoft Joomla CCK lets attackers run code

CVE-2026-102427

The OrdaSoft Joomla CCK extension (versions before 8.3.16) lets anyone upload a specially crafted file that the site will execute as code. Because the upload function does not require login or check t...

10.0

SiteSkite plugin allows attackers to run code on your site

CVE-2026-96349

The SiteSkite plugin for WordPress (versions up to 2.1.8) lets anyone on the internet execute commands on your web server without logging in. This could let attackers steal data, modify your site, or ...

10.0

vm2 package can let attackers run code on your server

GHSA-76w7-j9cq-rx2j CVE-2026-47208 ROOT-APP-NPM-CVE-2026-47208

The vm2 library used in GitHub Actions and other projects can be exploited to execute malicious code on the host system. This could let an attacker take control of the environment where vm2 runs. Upda...

10.0

vm2 may execute attacker code

CVE-2026-22709 GHSA-99p7-6v5w-7xg8 ROOT-APP-NPM-CVE-2026-22709

The vm2 library and its related packages can be tricked into running code supplied by an attacker. This could let a malicious user take control of your application or server. Install the latest patche...

10.0

vm2 sandbox can let attackers run code on host

GHSA-xj72-wvfv-8985 CVE-2023-29199 ROOT-APP-NPM-CVE-2023-29199

Versions of the vm2 library up through 3.9.15 may allow a malicious user to break out of its protected environment and execute code on the underlying system. This could let an attacker take control of...

10.0

vm2 sandbox escape can run code on host

GHSA-whpj-8f3w-67p5 CVE-2023-32314 ROOT-APP-NPM-CVE-2023-32314

Versions of the vm2 sandbox up to 3.9.17 let a malicious script break out of its isolation and execute commands on the server that runs it. This gives an attacker the ability to take control of the ho...

10.0

vm2 package can run unauthorized code on GitHub Actions

GHSA-rp36-8xq3-r6c4 CVE-2026-47140 ROOT-APP-NPM-CVE-2026-47140

The vm2 library used in GitHub Actions and the @rootio/vm2 package may let attackers execute their own code on the server. This could let a malicious user take control of the environment where the pac...

10.0

vm2 sandbox lets attackers run code on host

GHSA-mrgp-mrhc-5jrq CVE-2022-36067 ROOT-APP-NPM-CVE-2022-36067

Versions of the vm2 sandbox library before 3.9.11 allow a user to break out of the isolated environment and execute commands on the server that runs it. This can let an attacker take control of the ho...

10.0

vm2 package may let attackers run code

GHSA-g644-9gfx-q4q4 CVE-2023-37903 ROOT-APP-NPM-CVE-2023-37903

The vm2 library used in several projects can be tricked into executing unwanted code, potentially letting an attacker control the system. This risk affects any software that includes vm2, such as the ...

10.0

vm2 package may let attackers run code

GHSA-v6mx-mf47-r5wg CVE-2026-47131 ROOT-APP-NPM-CVE-2026-47131

The vm2 library used in GitHub Actions, the @rootio/vm2 package, and other vm2 installations can be tricked into executing malicious code. This could let an attacker take control of systems that run s...

10.0

vm2 sandbox can let attackers run host code

GHSA-ch3r-j5x3-6q2m CVE-2023-30547 ROOT-APP-NPM-CVE-2023-30547

Versions of the vm2 sandbox up to 3.9.16 let a specially crafted error bypass its protections, allowing malicious code to break out of the sandbox and run on the host system. This can lead to unauthor...

10.0

vm2 package can run attacker code

GHSA-cchq-frgv-rjh5 CVE-2023-37466 ROOT-APP-NPM-CVE-2023-37466

The vm2 library used in several projects can be tricked into executing malicious code. This risk has been fixed in newer releases of vm2 and related packages. Update all vm2 installations to the lates...

10.0

vm2 package may allow unauthorized code execution

GHSA-m4wx-m65x-ghrr CVE-2026-47137 ROOT-APP-NPM-CVE-2026-47137

The vm2 library used in GitHub Actions, the @rootio/vm2 package, and other vm2 installations can be tricked into running code that an attacker supplies. This could let malicious scripts run on your sy...

10.0

iperf3 can be crashed by unauthenticated client

DEBIAN-CVE-2026-101283 CVE-2026-101283 UBUNTU-CVE-2026-101283 BELL-CVE-2026-101283

Versions 3.20 through 3.21 of iperf3 may let anyone connect and send specially crafted data that overflows memory, potentially causing the program to stop working or be taken over. The issue does not ...

9.9

iperf3 3.21 may allow remote crash

DEBIAN-CVE-2026-101276 CVE-2026-101276 UBUNTU-CVE-2026-101276 BELL-CVE-2026-101276

The iperf3 testing tool version 3.21 can be attacked over the network, causing the program to stop working. An attacker can trigger a condition that frees memory while a background thread is still usi...

9.9

Crane package can be exploited before version 0.19.2‑r0

CLEANSTART-2026-PX86725

The crane software (cleanstart/crane) in version 0.19.2‑r0 and earlier contains a security weakness that could allow an attacker to run unauthorized actions. Updating to a newer release removes the ri...

9.4

Crane may allow attackers to run unauthorized code

CLEANSTART-2026-OZ76094

The crane component used by Docker’s Moby container system contains a flaw that could let a remote user run their own programs on the affected machine. This could let an attacker take control, steal d...

9.9

Next.js next/og ImageResponse can let attackers run code

GHSA-vcvr-r3jv-pc5j

The ImageResponse feature in Next.js’s next/og module can execute malicious code if it processes SVG data that includes values supplied by users. This affects apps that embed user‑controlled text, att...

9.9

zosmaai pi-llm-wiki allows remote command execution

CVE-2026-102911

The pi-llm-wiki software (versions up to 0.11.7) can run unwanted system commands when a specially crafted web address is supplied. This can be triggered from outside the network, letting an attacker ...

8.6

Devika 1.0 could execute malicious code

CVE-2026-51872

The Devika version 1.0 application contains a weakness in its Runner.run_code component that could let an attacker supply harmful code that the system will run. This could lead to unauthorized actions...

9.8

Devika 1.0 lets attacker run any code

CVE-2026-51871

The Devika version 1.0 application can execute commands that it receives from a language model without checking them first. This means a malicious user could cause the software to run arbitrary code o...

9.8

DeepTutor v1.4.0 can let attackers run commands

CVE-2026-51870

The DeepTutor 1.4.0 application contains a flaw in its command‑execution component that could allow an attacker to run any program on the server. This could give them control of the system, potentiall...

9.8

DB-GPT v0.8.0 may run code directly on server

CVE-2026-51869

The sandbox feature in DB‑GPT version 0.8.0 does not isolate code as intended and can fall back to running it on the host machine. This means that malicious or buggy scripts could execute with the sam...

9.8