{"vulnerability": "CVE-2026-9294", "sightings": [{"uuid": "0067d1a9-24f3-4afc-93dc-6793f15a4e91", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-9294", "type": "seen", "source": "https://infosec.exchange/users/offseq/statuses/116626962874841105", "content": "\ud83d\udea8 New HIGH-severity vuln: CVE-2026-9294 in Edimax BR-6428NS (v1.10) enables remote buffer overflow via pppUserName in formWanTcpipSetup. Public exploit, no patch yet \u2014 restrict access & monitor traffic. https://radar.offseq.com/threat/cve-2026-9294-buffer-overflow-in-edimax-br-6428ns-e09f5444 #OffSeq #Vulnerability #RouterSecurity #CVE20269294", "creation_timestamp": "2026-05-24T01:30:26.443353Z"}, {"uuid": "0ce9bf41-c5a1-4b44-b01a-b9ee0ee2e3bd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-92940", "type": "seen", "source": "https://bsky.app/profile/stemshop.bsky.social/post/3mvq227333b2j", "content": "\ud83d\udea8 CVE-2026-92940 \u2014 CVSS 10 CRITICAL\n\nvm2 versions 3.11.3 through 3.11.6 expose the host process's real https.globalAgent to sandboxed code when ...\n\n\ud83d\udd0e https://stemshop.top/cve/CVE-2026-92940\n\n#CVE #CyberSecurity #InfoSec", "creation_timestamp": "2026-09-17T16:08:58.682477Z"}, {"uuid": "07ee1da7-c0fe-4671-b16b-14afd0c99abe", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-92941", "type": "seen", "source": "https://bsky.app/profile/stemshop.bsky.social/post/3mvq22hlddl2r", "content": "\ud83d\udea8 CVE-2026-92941 \u2014 CVSS 10 CRITICAL\n\nvm2 versions from 3.11.3 before 3.11.7 expose the host tls module to NodeVM sandbox code, allowing attacker...\n\n\ud83d\udd0e https://stemshop.top/cve/CVE-2026-92941\n\n#CVE #CyberSecurity #InfoSec", "creation_timestamp": "2026-09-17T16:09:08.632920Z"}, {"uuid": "20902039-e510-4e8a-aff9-b7c969791cec", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-92944", "type": "seen", "source": "https://bsky.app/profile/stemshop.bsky.social/post/3mvq22phhdz2j", "content": "\ud83d\udea8 CVE-2026-92944 \u2014 CVSS 9.3 CRITICAL\n\nvm2 versions 3.10.2 through 3.11.6 contain a sandbox escape vulnerability on Node.js 26 where Promise.proto...\n\n\ud83d\udd0e https://stemshop.top/cve/CVE-2026-92944\n\n#CVE #CyberSecurity #InfoSec", "creation_timestamp": "2026-09-17T16:09:15.874931Z"}, {"uuid": "c0a29711-dd52-426d-aeb7-75151451ae79", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-92946", "type": "seen", "source": "https://bsky.app/profile/stemshop.bsky.social/post/3mvq22ywnjz2y", "content": "\ud83d\udea8 CVE-2026-92946 \u2014 CVSS 10 CRITICAL\n\nvm2 before 3.11.7 contains a remote code execution vulnerability when require.external is enabled without a...\n\n\ud83d\udd0e https://stemshop.top/cve/CVE-2026-92946\n\n#CVE #CyberSecurity #InfoSec", "creation_timestamp": "2026-09-17T16:09:25.734247Z"}, {"uuid": "8f85c254-3b41-4720-b3ed-0450b83b53e6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-92947", "type": "seen", "source": "https://bsky.app/profile/stemshop.bsky.social/post/3mvq23belmi2w", "content": "\ud83d\udea8 CVE-2026-92947 \u2014 CVSS 10 CRITICAL\n\nvm2 before 3.11.7 exposes Node's shared Buffer pool to sandboxed code, allowing disclosure of host memory u...\n\n\ud83d\udd0e https://stemshop.top/cve/CVE-2026-92947\n\n#CVE #CyberSecurity #InfoSec", "creation_timestamp": "2026-09-17T16:09:34.576748Z"}, {"uuid": "0f3fdb56-a394-4380-8125-ed4627e676ab", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-92948", "type": "seen", "source": "https://bsky.app/profile/stemshop.bsky.social/post/3mvq23jidi622", "content": "\ud83d\udea8 CVE-2026-92948 \u2014 CVSS 9.4 CRITICAL\n\nvm2 versions >= 3.9.6 and <= 3.11.6 are affected by a NodeVM builtin allowlist bypass that permits a sandbo...\n\n\ud83d\udd0e https://stemshop.top/cve/CVE-2026-92948\n\n#CVE #CyberSecurity #InfoSec", "creation_timestamp": "2026-09-17T16:09:43.047628Z"}, {"uuid": "eeb3d47e-b427-4e58-9d03-396f8c97450e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-92940", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mvq246uklt24", "content": "CVE-2026-92940 - vm2\nVersions 3.11.3 through 3.11.6 of the vm2 tool let code running in an isolated environment see the real HTTPS connections the host makes. This can allow that code to capture\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#vm2 #patriksimek #CVE #infosec", "creation_timestamp": "2026-09-17T16:10:05.468885Z"}, {"uuid": "3281c247-3ac1-4014-b869-7f1eeb1f0e6c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-92941", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mvq24dqwp52p", "content": "CVE-2026-92941 - vm2\nVersions of vm2 between 3.11.3 and 3.11.6 allow code running inside the sandbox to modify the Node.js TLS settings for the whole host. This lets an attacker replace the list of trusted\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#vm2 #patriksimek #CVE #infosec", "creation_timestamp": "2026-09-17T16:10:10.931025Z"}, {"uuid": "10377293-2b76-4356-94de-fb476daa5d3f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-92947", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mvq2o2j4l52y", "content": "CVE-2026-92947 - vm2\nThe vm2 module versions before 3.11.7 let code running inside its sandbox access Node\u2019s shared memory buffers. This means a malicious script could read or change data that should stay\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#vm2 #patriksimek #CVE #infosec", "creation_timestamp": "2026-09-17T16:20:05.334774Z"}, {"uuid": "293ffdc6-a90a-43b2-a498-30c6282c9323", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-92944", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mvq2o4zfv42f", "content": "CVE-2026-92944 - vm2\nThe vm2 library that isolates JavaScript code can be bypassed in versions 3.10.2 through 3.11.6, allowing a crafted script to break out of the sandbox and execute code on the host\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#vm2 #patriksimek #CVE #infosec", "creation_timestamp": "2026-09-17T16:20:07.461881Z"}, {"uuid": "e6fe741f-7554-485f-adc1-5965a5198c98", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-92946", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mvq37zokqz2f", "content": "CVE-2026-92946 - vm2\nThe vm2 sandbox library for Node.js can let attackers run commands on the server if the \"require.external\" option is turned on without proper restrictions. This could let malicious code\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#vm2 #patriksimek #CVE #infosec", "creation_timestamp": "2026-09-17T16:30:08.245511Z"}, {"uuid": "bd508487-b970-470e-ac98-42bac7525b35", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-92948", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mvq3a5akg52t", "content": "CVE-2026-92948 - vm2\nVersions of the vm2 library from 3.9.6 up to 3.11.6 let specially crafted code break out of its sandbox when Node.js 24 or later is used and the node:test module is allowed. This means\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#vm2 #patriksimek #CVE #infosec", "creation_timestamp": "2026-09-17T16:30:11.854093Z"}]}