V
Vendor security profile
vm2
Product portfolio, patch evidence and exploitation signals in a single security scorecard
The data is combined from the CVE Program, NVD, CISA KEV and vendor security advisories.
Total CVEs16
Critical0
CISA KEV0
Public exploit0
Patch rate—
Avg. CVSS—
12-month vulnerability rate
CVE KEV
CVE severity distribution
16toplam CVE
Uncertain16 (100%)
Patch and exploitation view
%0
Verified patch
%0
CISA KEV
%0
Public exploit
0Patch available
0Partial
0Workaround
0Vendor: no patch
16Unknown
Latest vulnerabilities
10.0
CVE-2026-44005vm2: Sandbox escape
Patch status unknownEPSS %1
9.8
CVE-2026-45411vm2: Sandbox Breakout Using Async Generator
Patch status unknownEPSS %1
9.8
CVE-2026-44009vm2: Sandbox Breakout Through Null Proto Exception
Patch status unknownEPSS %1
9.8
CVE-2026-44008vm2: Snabox breakout via `neutralizeArraySpeciesBatch`
Patch status unknownEPSS %1
9.1
10.0
CVE-2026-44006vm2: Sandbox Escape
Patch status unknownEPSS %1
7.5
CVE-2026-44004vm2: Host Process OOM DoS via Buffer.alloc (Timeout Bypass)
Patch status unknownEPSS %1
8.6
CVE-2026-44001vm2: Sandbox Escape via Promise Constructor Unhandled Rejection (Process Crash DoS)
Patch status unknownEPSS %1
9.9
CVE-2026-43999vm2: NodeVM builtin allowlist bypass via `module` builtin's `Module._load` allows sandbox escape
Patch status unknownEPSS %1
8.5
CVE-2026-43998vm2: NodeVM require.root bypass via symlink traversal allows sandbox escape
Patch status unknownEPSS %1