NPM: vm2: NodeVM nesting guard accepts array-shaped require and permits host RCE

NPM: vm2: NodeVM nesting guard accepts array-shaped require and permits host RCE vulnerability discovered by ? in WordPress Npm vm2 versions = 3.11.4, = 3.11.6...

vm2: NodeVM nesting guard accepts array-shaped require and permits host RCE

Summary The NodeVM constructor computes hasRealRequireConfig using typeof requireOpts === 'object' && requireOpts !== null, so require: bypasses the guard intended to reject nesting without an explicit require configuration. makeResolverFromLegacyOptions then destructures the array to undefined...

DoS (Denial of Service) Apache Tomcat Dependency in Crowd Data Center and Server

This High severity DoS Denial of Service vulnerability known as CVE-2026-13506 was introduced in 6.1.0 and later of Crowd Data Center and Server. This DoS Denial of Service vulnerability, with a CVSS Score of 8.7 and a CVSS Vector of...

Security update for bouncycastle

This update for bouncycastle fixes the following issues: CVE-2026-8763: Name Constraints bypass via trailing dot in rfc822Name and URI bsc1272700. CVE-2026-12185: BKS/UBER keystore allocates from untrusted lengths before integrity check bsc1272701. CVE-2026-12802: CMS AuthEnvelopedData fails to...

EUVD-2026-52139

In Bouncy Castle for Java before 1.85, Lazy ASN.1 sequence forcing resets nesting-depth guard. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS BC-FJA before bc-fips 1.0.2.7 1.0.X series, 2.0.2 2.0.X series and 2.1.3 2.1.X series...