https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sun, 04 Oct 2026 18:44:33 +0000 https://db.gcve.eu/vuln/bdu:2026-14936 bdu:2026-14936 https://db.gcve.eu/vuln/bdu:2026-14936 https://db.gcve.eu/vuln/cve-2026-92941 <p><strong>Affected:</strong> patriksimek vm2</p> <p>vm2 versions from 3.11.3 before 3.11.7 expose the host tls module to NodeVM sandbox code, allowing attackers to call tls.setDefaultCACertificates() and replace process-wide certificate authorities. Attackers with access to allowed tls and url builtins can use URLSearchParams to create host-realm arrays and manipulate the TLS trust store, enabling subsequent host HTTPS clients to accept attacker-controlled certificates.</p> <p><strong>Affected:</strong> patriksimek vm2</p> <p>vm2 versions from 3.11.3 before 3.11.7 expose the host tls module to NodeVM sandbox code, allowing attackers to call tls.setDefaultCACertificates() and replace process-wide certificate authorities. Attackers with access to allowed tls and url builtins can use URLSearchParams to create host-realm arrays and manipulate the TLS trust store, enabling subsequent host HTTPS clients to accept attacker-controlled certificates.</p> https://db.gcve.eu/vuln/cve-2026-92941