NPM: vm2 exposes host HTTPS credentials and TLS traffic through globalAgent

NPM: vm2 exposes host HTTPS credentials and TLS traffic through globalAgent vulnerability discovered by ? in WordPress Npm vm2 versions = 3.11.3, = 3.11.6...

vm2 exposes host HTTPS credentials and TLS traffic through globalAgent

Summary vm2 3.11.6 exposes the host process's real https.globalAgent when a NodeVM is explicitly allowed to require https. The module is wrapped as read-only, but calls to methods on the shared agent still mutate the host object. Sandbox code can register a free listener and receive host request...

CLEANSTART-2026-PN99410 Parsing an invalid SVCB or HTTPS RR can panic when the size of a parameter value overflows the message buffer

Security vulnerability affects the cri-tools package. Parsing an invalid SVCB or HTTPS RR can panic when the size of a parameter value overflows the message buffer...

MAL-2026-17437 Malicious code in @bluewin/utils (npm)

@bluewin/utils is a dependency-confusion package: it describes itself as a "PoC package for dependency confusion testing" and claims the @bluewin scope, so a build that resolves that scope from the public registry runs its code instead of the intended private package. Its postinstall script runs...

CVE-2026-66249: Sensitive Cookie in HTTPS Session Without 'Secure' Attribute

iControl is affected by a Missing Secure Attribute vulnerability, which could allow an attacker to intercept cookies transmitted over unencrypted HTTP connections, enabling the unauthorized extraction of sensitive information such as session identifiers...

Rocky Linux 9 [CIQ] Security Update: bind9.18 / bind9.18-chroot / bind9.18-debuginfo / etc Multiple Vulnerabilities (crlsa-2025_1670)

The Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20251670 advisory. bind: bind9: Many records in the additional section cause CPU exhaustion CVE-2024-11187 bind: bind9: DNS-over-HTTPS implementation suffers from multiple...

Rocky Linux 8 [CIQ] Security Update: perl-CPAN (crlsa-2024_3094)

The Rocky Linux 8 host has a package installed that is affected by a vulnerability as referenced in the CIQ crlsa-20243094 advisory. perl: CPAN.pm does not verify TLS certificates when downloading distributions over HTTPS CVE-2023-31484 Tenable has extracted the preceding description block direct...

Rocky Linux 8 [CIQ] Security Update: libsoup / libsoup-debuginfo / libsoup-debugsource / libsoup-devel (crlsa-2026_14087)

The Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-202614087 advisory. libsoup: libsoup: Information disclosure via cleartext transmission of cookies during HTTPS tunnel establishment CVE-2026-5119 Tenable has extracted the preceding...

Rocky Linux 10.1 [CIQ] Security Update: libsoup3 / libsoup3-debuginfo / libsoup3-debugsource / etc Multiple Vulnerabilities (crlsa-2026_15968)

The Rocky Linux 10.1 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202615968 advisory. libsoup: libsoup: Denial of Service via Use-After-Free in HTTP/2 server CVE-2026-4271 libsoup: libsoup: Information disclosure via cleartext transmissi...

Rocky Linux 8 [CIQ] Security Update: libecap / libecap-debuginfo / libecap-debugsource / libecap-devel / etc Multiple Vulnerabilities (crlsa-2023_7668)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20237668 advisory. squid: DoS against HTTP and HTTPS CVE-2023-5824 Tenable has extracted the preceding description block directly from the CIQ security advisory. Note that...

CentOS Linux 7 [TuxCare] Security Update: libsoup / libsoup-devel (CENTOS7:CLSA-2026:1777035141)

The CentOS Linux 7 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS7:CLSA-2026:1777035141 advisory. - A flaw was found in libsoup. When establishing HTTPS tunnels through a configured HTTP proxy, sensitive session cookies are transmitted in...

CentOS Linux 8.4 [TuxCare] Security Update: perl-CPAN Multiple Vulnerabilities (CENTOS8.4:CLSA-2025:1758821935)

The CentOS Linux 8.4 host has a package installed that is affected by multiple vulnerabilities as referenced in the TuxCare CENTOS8.4:CLSA-2025:1758821935 advisory. - CPAN 2.28 allows Signature Verification Bypass. CVE-2020-16156 - CPAN.pm before 2.35 does not verify TLS certificates when...

Rocky Linux 9 [CIQ] Security Update: libsoup / libsoup-debuginfo / libsoup-debugsource / libsoup-devel (crlsa-2026_19356)

The Rocky Linux 9 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-202619356 advisory. libsoup: libsoup: Information disclosure via cleartext transmission of cookies during HTTPS tunnel establishment CVE-2026-5119 Tenable has extracted the preceding...

AlmaLinux 9.2 [TuxCare] Security Update: perl-CPAN / perl-CPAN-tests (ALMALINUX9.2:CLSA-2025:1759497192)

The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2025:1759497192 advisory. - CPAN.pm before 2.35 does not verify TLS certificates when downloading distributions over HTTPS. CVE-2023-31484 Note that Nessus has not...

Rocky Linux 9 [CIQ] Security Update: libsoup / libsoup-debuginfo / libsoup-debugsource / libsoup-devel (crlsa-2026_13978)

The Rocky Linux 9 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-202613978 advisory. libsoup: libsoup: Information disclosure via cleartext transmission of cookies during HTTPS tunnel establishment CVE-2026-5119 Tenable has extracted the preceding...

CVE-2026-9032: NULL Pointer Dereference

Tapo C120 v1 and C200 v5 contain a NULL pointer dereference in the HTTPS onboarding connect request parser. The interface is reachable without authentication after initial setup and does not validate that a password field is present for certain authentication and encryption parameter combinations...

PT-2026-103964

Tapo C120 v1 and C200 v5 contain a NULL pointer dereference in the HTTPS onboarding connect request parser. The interface is reachable without authentication after initial setup and does not validate that a password field is present for certain authentication and encryption parameter combinations...

Rocky Linux 9 [CIQ] Security Update: perl-CPAN (crlsa-2023_6539)

The Rocky Linux 9 host has a package installed that is affected by a vulnerability as referenced in the CIQ crlsa-20236539 advisory. perl: CPAN.pm does not verify TLS certificates when downloading distributions over HTTPS CVE-2023-31484 Tenable has extracted the preceding description block direct...

Fortinet FortiMail Path Traversal Vulnerability

Fortinet FortiMail contains a path traversal and an improper neutralization of NULL byte or NULL character vulnerability that may allow an unauthenticated attacker to write arbitrary files on the underlying system via crafted HTTP or HTTPS requests...

CLEANSTART-2026-YN61709 Parsing an invalid SVCB or HTTPS RR can panic when the size of a parameter value overflows the message buffer

CVE-2026-46600 affects multiple packages. Parsing an invalid SVCB or HTTPS RR can panic when the size of a parameter value overflows the message buffer. See references for individual vulnerability details...