EUVD-2026-81591

vm2 NodeVM can replace the host process TLS trust store...

NPM: vm2 NodeVM can replace the host process TLS trust store

NPM: vm2 NodeVM can replace the host process TLS trust store vulnerability discovered by ? in WordPress Npm vm2 versions = 3.11.3, = 3.11.6...

GHSA-XQ74-C7JX-8W5J Duplicate Advisory: vm2 NodeVM can replace the host process TLS trust store

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-98xx-8mx4-x7cm. This link is maintained to preserve external references. Original Description vm2 versions from 3.11.3 before 3.11.7 expose the host tls module to NodeVM sandbox code, allowing attackers to call...

CVE-2026-92941 vm2 3.11.3 before 3.11.7 TLS Trust Store Manipulation

vm2 versions from 3.11.3 before 3.11.7 expose the host tls module to NodeVM sandbox code, allowing attackers to call tls.setDefaultCACertificates and replace process-wide certificate authorities. Attackers with access to allowed tls and url builtins can use URLSearchParams to create host-realm...

CVE-2026-92941 vm2 3.11.3 before 3.11.7 TLS Trust Store Manipulation

vm2 versions from 3.11.3 before 3.11.7 expose the host tls module to NodeVM sandbox code, allowing attackers to call tls.setDefaultCACertificates and replace process-wide certificate authorities. Attackers with access to allowed tls and url builtins can use URLSearchParams to create host-realm...

CVE-2026-92941 vm2 3.11.3 before 3.11.7 TLS Trust Store Manipulation

vm2 versions from 3.11.3 before 3.11.7 expose the host tls module to NodeVM sandbox code, allowing attackers to call tls.setDefaultCACertificates and replace process-wide certificate authorities. Attackers with access to allowed tls and url builtins can use URLSearchParams to create host-realm...

CVE-2026-92941

vm2 (Node.js sandboxing library) versions 3.11.3 through 3.11.6 expose the host tls module to NodeVM sandbox code. An attacker with access to the allowed tls and url builtins can use URLSearchParams to construct host-realm arrays and invoke tls.setDefaultCACertificates() , replacing the process-w...

CVE-2026-92941: Incorrect Permission Assignment for Critical Resource

vm2 versions from 3.11.3 before 3.11.7 expose the host tls module to NodeVM sandbox code, allowing attackers to call tls.setDefaultCACertificates and replace process-wide certificate authorities. Attackers with access to allowed tls and url builtins can use URLSearchParams to create host-realm...

AZL-91227 CVE-2026-9697 affecting package nodejs for versions less than 24.17.0-1

Impact: undici's ProxyAgent silently drops the requestTls option when configured with a SOCKS5 proxy URI socks5:// or socks://. The target HTTPS connection through the SOCKS5 tunnel falls back to Node's default trust store, ignoring user-configured ca, cert, key, rejectUnauthorized, and servernam...

EUVD-2017-17396

Malware in sbrugna...

EUVD-2017-11482

Malware in sbrugna...

EUVD-2022-26875

Malicious code in bioql PyPI...

Linux Distros Unpatched Vulnerability : CVE-2017-2299

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Versions of the puppetlabs-apache module prior to 1.11.1 and 2.1.0 make it very easy to accidentally misconfigure TLS trust. If you specify the sslca parameter...

The vulnerability of the tls_trust_file command in the SMTP client Msmtp and the POP3 client Mpop allows attackers to compromise the integrity, availability, and confidentiality of information.

The vulnerability of the tlstrustfile command in the SMTP client Msmtp and the POP3 client Mpop is related to incorrect authentication of the certificate’s authenticity. Exploiting this vulnerability allows a malicious actor to compromise the integrity, availability, and confidentiality of...

Default configuration

In msmtp 1.8.2 and mpop 1.4.3, when tlstrustfile has its default configuration, certificate-verification results are not properly checked...

CVE-2019-8337

In msmtp 1.8.2 and mpop 1.4.3, when tlstrustfile has its default configuration, certificate-verification results are not properly checked...

UBUNTU-CVE-2019-8337

In msmtp 1.8.2 and mpop 1.4.3, when tlstrustfile has its default configuration, certificate-verification results are not properly checked...

PT-2018-3530

Name of the Vulnerable Software and Affected Versions: msmtp version 1.8.2 mpop version 1.4.3 Description: The issue is related to the tls trust file command in the msmtp and mpop clients, which is associated with improper certificate authentication verification. This could allow a remote attacke...

Elastic Kibana X-Pack 'CVE-2017-8445' TLS Trust Manager Bypass Vulnerability - Windows

Elastic Kibana with X-Pack is prone to a TLS Trust Manager bypass vulnerability. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

Elastic Kibana X-Pack 'CVE-2017-8445' TLS Trust Manager Bypass Vulnerability - Linux

Elastic Kibana with X-Pack is prone to a TLS Trust Manager bypass vulnerability. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...