Vendor
Patriksimek vulnerabilities
Updated . Rebuilt every hour.
Junglewise Threat Intelligence has tracked 63 vulnerabilities in Patriksimek: 0 in the last 7 days and 31 in the last 90 days, 34 of them critical and 0 exploited in the wild. The most recent, vm2 NodeVM path bypass in custom resolution, was published on 27 September 2026. Nothing in the last four weeks, down from 28 vulnerabilities in the four before. 0 critical against 15. 1 technology has a page of its own.
- Last 7 days
- 0
- Last 90 days
- 31
- Critical, all time
- 34
- Exploited in the wild
- 0
Patriksimek technologies
Latest Patriksimek vulnerabilities
- vm2 NodeVM path bypass in custom resolutioncriticalCVSS 9
- CVE-2026-93605: vm2 NodeVM sandbox escape via child_process denylist omissioncriticalCVSS 10EPSS 0.7%
- CVE-2026-93603: vm2 sandbox escape via nullish this receivercriticalCVSS 10EPSS 0.7%
- vm2 CLI sandbox escape via require(__filename)highCVSS 8.6
- vm2 NodeVM sandbox escape via prototype pollutioncriticalCVSS 10
- vm2 Promise rejection denial of servicehighCVSS 8.6
- vm2 NodeVM builtin denylist bypass via fs/promiseshighCVSS 8.5
- vm2 NodeVM builtin allowlist bypass sandbox escapecriticalCVSS 9.9
- vm2 module allowlist bypass via prefix matchingmediumCVSS 4.2
- vm2 NodeVM TLS trust store manipulationcriticalCVSS 10
- vm2 information disclosure via util.getCallSites()mediumCVSS 5.8
- vm2 HTTPS credentials exposure through globalAgent proxy bypasscriticalCVSS 10
- vm2 information disclosure via error stack formattingmediumCVSS 5.8
- CVE-2026-92963: vm2 has access to `VM2_INTERNAL_STATE_DO_NOT_USE_OR_PROGRAM_WILL_FAIL`mediumCVSS 5.3EPSS 0.3%
- CVE-2026-92962: vm2 Defense Invariant #11 violation in stack-trace formattermediumCVSS 4EPSS 0.2%
- CVE-2026-92959: vm2 allowAsync bypass via Promise thenable assimilationhighCVSS 7.1EPSS 0.4%
- CVE-2026-92954: vm2 host Promise rejection denial of servicehighCVSS 8.6EPSS 0.5%
- CVE-2026-92953: vm2 prototype pollution in TypedArray and ArrayBuffercriticalCVSS 10EPSS 0.5%
- CVE-2026-92952: vm2 sandbox symbol filtering bypass in Node.js symbol isolationmediumCVSS 6.8EPSS 0.5%
- CVE-2026-92951: vm2 module allowlist bypass via substring matchingcriticalCVSS 9.9EPSS 0.5%
- CVE-2026-92949: vm2 sandbox bypass via accessor descriptor on frozen objectsmediumCVSS 4EPSS 0.3%
- CVE-2026-92947: vm2 memory disclosure via shared Buffer poolcriticalCVSS 10EPSS 0.5%
- CVE-2026-92946: vm2 remote code execution in NodeVM require.externalcriticalCVSS 10EPSS 0.9%
- CVE-2026-92941: vm2 NodeVM sandbox escape via TLS trust store manipulationcriticalCVSS 10EPSS 0.3%
- CVE-2026-92940: vm2 HTTPS credential exposure via globalAgentcriticalCVSS 10EPSS 0.5%
Most severe Patriksimek vulnerabilities
Exploited in the wild first, then by severity and CVSS score.
- CVE-2026-92937: vm2 sandbox escape in Promise rejection handlingcriticalCVSS 10EPSS 1.0%
- CVE-2026-92946: vm2 remote code execution in NodeVM require.externalcriticalCVSS 10EPSS 0.9%
- CVE-2026-47208: patriksimek vm2 sandbox breakout via Promise species hijackcriticalCVSS 10EPSS 0.8%
- CVE-2026-44005: patriksimek vm2 sandbox escape via host prototype mutationcriticalCVSS 10EPSS 0.8%
- CVE-2026-47140: patriksimek vm2 sandbox escape via NodeVM builtin denylist bypasscriticalCVSS 10EPSS 0.8%
- CVE-2026-44006: patriksimek vm2 sandbox escape via arbitrary prototype accesscriticalCVSS 10EPSS 0.8%
- CVE-2026-43997: patriksimek vm2 sandbox escape via host object leakagecriticalCVSS 10EPSS 0.8%
- CVE-2026-93605: vm2 NodeVM sandbox escape via child_process denylist omissioncriticalCVSS 10EPSS 0.7%
- CVE-2026-93603: vm2 sandbox escape via nullish this receivercriticalCVSS 10EPSS 0.7%
- CVE-2026-47137: patriksimek vm2 sandbox escape via configuration bypasscriticalCVSS 10EPSS 0.7%
Vulnerabilities per week
Nothing in the last four weeks, down from 28 vulnerabilities in the four before. 0 critical against 15. The last 13 weeks, by the week each vulnerability was published.
| Week of | Bar | Vulns | Critical |
|---|---|---|---|
| 17 Aug 2026 | 3 | 2 | |
| 24 Aug 2026 | 0 | 0 | |
| 31 Aug 2026 | 0 | 0 | |
| 7 Sep 2026 | 0 | 0 | |
| 14 Sep 2026 | 27 | 14 | |
| 21 Sep 2026 | 1 | 1 | |
| 28 Sep 2026 | 0 | 0 | |
| 5 Oct 2026 | 0 | 0 | |
| 12 Oct 2026 | 0 | 0 | |
| 19 Oct 2026 | 0 | 0 | |
| 26 Oct 2026 | 0 | 0 | |
| 2 Nov 2026 | 0 | 0 | |
| 9 Nov 2026 | 0 | 0 |
Embed a badge
A live badge for a README, a status page or an internal wiki: how many Patriksimek vulnerabilities were published in the last 7 days and how many of them are critical, refreshed hourly.
[](https://junglewise.ai/threats/vendors/patriksimek)<a href="https://junglewise.ai/threats/vendors/patriksimek"><img src="https://junglewise.ai/threats/vendors/patriksimek/badge.svg" alt="Patriksimek vulnerabilities" /></a>How this is built
Junglewise Threat Intelligence collects vulnerabilities from NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories, and matches each one to the technologies and vendors it affects. Dates are the date a vulnerability was published, in UTC.
The pages are rebuilt from the database every hour. Frozen weekly and monthly reports never change once published, so they can be cited.
Use this data
The same data is at https://junglewise.ai/threats/vendors/patriksimek.json, and this page as text at https://junglewise.ai/threats/vendors/patriksimek.md, for scripts and language models. It is free to reuse under CC BY 4.0 with a link back to this page.
Cite as: Junglewise Threat Intelligence, "Patriksimek vulnerabilities", https://junglewise.ai/threats/vendors/patriksimek, 9 November 2026.