Reference page — cumulative record through Wednesday, August 19, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.
Weakness type CWE-913 — authoritative definition at MITRE. A cumulative reference aggregating every published CVE mapped to this weakness class; not a page of record.
| CVEs all-time | CVEs YTD | KEV all-time |
|---|---|---|
| 9 | 9 | 0 |
█▁▅
2026-06 6 · 2026-07 0 · 2026-08 3
| CVE | CVSS | EPSS %ile | KEV | Title |
|---|---|---|---|---|
| CVE-2026-53753 | 10.0 | 80.1 | — | Crawl4AI: AST Sandbox Escape via gi_frame.f_back Chain - Pre-Auth RCE in Docker API |
| CVE-2026-47210 | 9.8 | 76.7 | — | vm2 sandbox escape via JSPI-backed Promise `.finally()` species bypass |
| CVE-2026-47208 | 10.0 | 52.5 | — | vm2: Sandbox Breakout Using Promise Species |
| CVE-2026-47131 | 10.0 | 47.0 | — | vm2: Sandbox Escape |
| CVE-2026-47698 | 9.8 | 40.3 | — | vm2: Sandbox Breakout Using Dangerous Host Proto Mutators |
| CVE-2026-73226 | 8.8 | 31.9 | — | Electerm WebSocket `upgrade-func` and `fs` handlers allow arbitrary method/function inv… |
| CVE-2026-47137 | 10.0 | 31.5 | — | vm2: GHSA-8hg8-63c5-gwmx patch bypass: nesting:true without explicit require still allo… |
| CVE-2026-48775 | 6.8 | 14.3 | — | LangGraph Checkpoint: Unsafe JSON deserialization in checkpoint loading |
| CVE-2026-71470 | 9.1 | — | — | Acm-search-v2-rhel9: search-v2-operator: search cr imageoverride/arguments/envvar flow … |
| Vendor | CVEs |
|---|---|
| patriksimek | 5 |
| electerm | 1 |
| langchain-ai | 1 |
| red hat | 1 |
| unclecode | 1 |