< Back
Software Vulnerabilities
Last Updated On 1 Nov, 2026
- JFSA-2026-001699278Prefab UI is vulnerable to Remote Code Execution via a Pyodide js Bridge to DenoCVE-2026-120338criticalDiscovered ByYuval MoravchickPublished on 1 Nov, 2026
- JFSA-2026-001699276Beta9 is vulnerable to a Container Escape via Unvalidated Sandbox File PathsCVE-2026-120307criticalDiscovered ByNatan NehoraiPublished on 1 Nov, 2026
- JFSA-2026-001699277Beta9 is vulnerable to Host Filesystem Exposure via Volume Path TraversalCVE-2026-120308criticalDiscovered ByNatan NehoraiPublished on 1 Nov, 2026
- JFSA-2026-001699275Beta9 is vulnerable to a Build Worker Sandbox Escape via Chroot-only Buildah IsolationCVE-2026-120306criticalDiscovered ByNatan NehoraiPublished on 1 Nov, 2026
- JFSA-2026-001694382LMCache is vulnerable to Unauthenticated Remote Code Execution via Pickle Deserialization on the Multiprocess ZMQ TransportCVE-2026-105192criticalDiscovered ByYuval MoravchickPublished on 7 Oct, 2026
- JFSA-2026-001694179VTCode is vulnerable to Arbitrary Command Execution via an ANSI-C Quote Bypass of the find Approval CheckCVE-2026-104247mediumDiscovered ByNatan NehoraiPublished on 5 Oct, 2026
- Parallels Desktop is vulnerable to a Local Privilege Escalation via Appliance Extract Argument InjectionCVE-2026-90894highDiscovered ByYuval MoravchickPublished on 14 Sep, 2026
- JFSA-2026-001686326Bifrost is vulnerable to Unauthenticated Remote Code Execution via MCP Stdio Client RegistrationCVE-2026-90898criticalDiscovered ByYuval MoravchickPublished on 14 Sep, 2026
- JFSA-2026-001684572Bifrost is vulnerable to Unauthenticated Remote Code Execution via a Custom Plugin HTTP Path on Dynamically Linked BuildsCVE-2026-86242highDiscovered ByOr PelesPublished on 6 Sep, 2026
- JFSA-2026-001683789Readest is vulnerable to Arbitrary Code Execution via Unsanitized iframe srcdoc in the EPUB SanitizerCVE-2026-82642highDiscovered ByYuval MoravchickPublished on 30 Aug, 2026