VP
Vendor security profile
vm2 project
Product portfolio, patch evidence and exploitation signals in a single security scorecard
The data is combined from the CVE Program, NVD, CISA KEV and vendor security advisories.
Total CVEs16
Critical13
CISA KEV0
Public exploit16
Patch rate%13
Avg. CVSS9.5
12-month vulnerability rate
0
0
0
0
0
0
16
0
0
0
0
0
CVE KEV
CVE severity distribution
16toplam CVE
Critical13 (81%)
High3 (19%)
Patch and exploitation view
%13
Verified patch
%0
CISA KEV
%100
Public exploit
2Patch available
0Partial
0Workaround
0Vendor: no patch
14Unknown
Latest vulnerabilities
10.0
CVE-2026-44005
vm2: Sandbox escape
P
Patch status unknownEPSS %1
9.8
CVE-2026-45411
vm2: Sandbox Breakout Using Async Generator
P
Patch status unknownEPSS %1
9.8
CVE-2026-44009
vm2: Sandbox Breakout Through Null Proto Exception
P
Patch status unknownEPSS %1
9.8
CVE-2026-44008
vm2: Snabox breakout via `neutralizeArraySpeciesBatch`
P
Patch status unknownEPSS %1
9.1
CVE-2026-44007
vm2: nesting: true bypasses require: false, allowing sandbox escape to arbitrary OS command execution
P
Patch status unknownEPSS %1
10.0
CVE-2026-44006
vm2: Sandbox Escape
P
Patch status unknownEPSS %1
7.5
CVE-2026-44004
vm2: Host Process OOM DoS via Buffer.alloc (Timeout Bypass)
P
Patch status unknownEPSS %1
8.6
CVE-2026-44001
vm2: Sandbox Escape via Promise Constructor Unhandled Rejection (Process Crash DoS)
P
Patch status unknownEPSS %1
9.9
CVE-2026-43999
vm2: NodeVM builtin allowlist bypass via `module` builtin's `Module._load` allows sandbox escape
P
Patch status unknownEPSS %1
8.5
CVE-2026-43998
vm2: NodeVM require.root bypass via symlink traversal allows sandbox escape
P
Patch status unknownEPSS %1