EUVD-2026-81591

vm2 NodeVM can replace the host process TLS trust store...

GHSA-98XX-8MX4-X7CM vm2 NodeVM can replace the host process TLS trust store

Summary vm2 3.11.6 exposes the host tls module to a NodeVM when that builtin is explicitly allowed. Although the module object is wrapped as read-only, its functions still execute against process-wide host state. On Node.js versions that provide tls.setDefaultCACertificates, sandbox code can...

CVE-2026-92941

A flaw was found in vm2. The sandbox improperly exposes the host Transport Layer Security TLS module to untrusted code running within the sandbox environment. An attacker can exploit this issue using allowed built-in utilities to modify the process-wide certificate authorities. This manipulation...

Incorrect Permission Assignment for Critical Resource

Overview vm2 is a sandbox that can run untrusted code with whitelisted Node's built-in modules. Affected versions of this package are vulnerable to Incorrect Permission Assignment for Critical Resource via the tls module. An attacker can modify the process-wide certificate authorities by invoking...

Duplicate Advisory: vm2 NodeVM can replace the host process TLS trust store

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-98xx-8mx4-x7cm. This link is maintained to preserve external references. Original Description vm2 versions from 3.11.3 before 3.11.7 expose the host tls module to NodeVM sandbox code, allowing attackers to call...

PT-2026-105553

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-98xx-8mx4-x7cm. This link is maintained to preserve external references. Original Description vm2 versions from 3.11.3 before 3.11.7 expose the host tls module to NodeVM sandbox code, allowing attackers to call...

PT-2026-94313

Name of the Vulnerable Software and Affected Versions vm2 versions 3.11.3 through 3.11.6 Description The host tls module is exposed to NodeVM sandbox code, which allows attackers to call the setDefaultCACertificates function and replace process-wide certificate authorities. By utilizing allowed t...

Improper Handling of Unicode Encoding

Overview Affected versions of this package are vulnerable to Improper Handling of Unicode Encoding in the checkServerIdentity function in lib/tls.js, which does not normalize an internationalized hostname to ASCII before matching it against certificate names. An attacker presenting a certificate...

Uncaught Exception

Overview Affected versions of this package are vulnerable to Uncaught Exception in the TLS module when a TLS server is configured with pskCallback or ALPNCallback. A remote attacker can crash or exhaust resources of a TLS server by sending input that causes the callback to throw an error...

SUSE-SU-2025:4475-1 Security update for salt

This update for salt fixes the following issues: - Security issues fixed: - CVE-2025-62349: Added minimumauthversion to enforce security bsc1254257 - CVE-2025-62348: Fixed Junos module yaml loader bsc1254256 - Backport security fixes for vendored tornado BDSA-2024-3438 BDSA-2024-3439 BDSA-2024-90...

Security update 5.0.6 for Multi-Linux Manager Salt Bundle

This update fixes the following issues: venv-salt-minion: Security issues fixed: CVE-2025-62349: Added minimumauthversion to enforce security bsc1254257 CVE-2025-62348: Fixed Junos module yaml loader bsc1254256 Backport security fixes for vendored tornado BDSA-2024-3438 BDSA-2024-3439...

Security update 5.1.1.1 for Multi-Linux Manager Client Tools

This update fixes the following issues: venv-salt-minion: Security issues fixed: CVE-2025-62349: Added minimumauthversion to enforce security bsc1254257 CVE-2025-62348: Fixed Junos module yaml loader bsc1254256 Backport security fixes for vendored tornado BDSA-2024-3438 BDSA-2024-3439...

Security update 5.1.1.1 for Multi-Linux Manager Salt Bundle

This update fixes the following issues: venv-salt-minion: Security issues fixed: CVE-2025-62349: Added minimumauthversion to enforce security bsc1254257 CVE-2025-62348: Fixed Junos module yaml loader bsc1254256 Backport security fixes for vendored tornado BDSA-2024-3438 BDSA-2024-3439...

EUVD-2020-0174

Malware in sbrugna...

EUVD-2016-4508

Malware in sbrugna...

Linux kernel 安全漏洞

Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. A security vulnerability exists in Linux kernel, which stems from a null pointer dereference vulnerability in the tls module tlsswspliceeof...

CVE-2024-35908

CVE-2024-35908 (Linux kernel) : The issue arises in TLS handling within tls_sw_recvmsg where a psock reference is taken before tls_rx_reader_lock; if the lock fails, the reference isn’t released, causing a leak. The fix postpones taking the psock reference until after successful locking, ensuring...

Linux kernel 安全漏洞

Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. A security vulnerability exists in Linux kernel, which stems from a vulnerability in the net:tls module...

openSUSE: Security Advisory for lighttpd (openSUSE-SU-2022:10132-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

FreeBSD : mod_gnutls -- Infinite Loop on request read timeout (e8b20517-dbb6-11ed-bf28-589cfc0f81b0)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the e8b20517-dbb6-11ed-bf28-589cfc0f81b0 advisory. - Modgnutls is a TLS module for Apache HTTPD based on GnuTLS. Versions from 0.9.0 to 0.12.0 including d...