Threat database

A vulnerability in the vm2 library's NodeVM with the option nesting: true allows sandboxed code to bypass require restrictions and load the vm2 module itself. This enables the creation of an inner NodeVM with unrestricted require capabilities, allowing execution of arbitrary OS commands on the host. The issue arises because nesting: true injects vm2 into the sandbox's builtins unconditionally, overriding require: false or any allowlist. This flaw affects all vm2 versions prior to 3.11.1.

A security update for mingw-libtiff addresses a vulnerability referenced as CVE-2026-4775. This update is functionally equivalent to the Red Hat advisory RHSA-2026:14929. No specific technical details or affected versions are provided in the available data.

A security update for libpng12 addresses two use-after-free vulnerabilities in functions png_set_tRNS, png_set_PLTE, and png_set_hIST. These flaws can lead to arbitrary code execution or heap information disclosure. The update advances libpng12 to version 1.2.59 to fix these issues.

Multiple security issues were fixed in the postfix-3.11.2-1.1 package on the GA media of openSUSE Tumbleweed. The details of these issues are not specified in the provided data.

A security update for libsoup has been released by the SUSE Product Security Team. This update provides a functional equivalent of the Red Hat advisory RHSA-2026:14087. No specific technical details or affected versions are provided in the available information.

Multiple security issues were addressed in the gnutls-3.8.13-1.1 package on the GA media of openSUSE Tumbleweed. These fixes resolve vulnerabilities identified by several CVEs. No specific details about the nature of the vulnerabilities or their impact are provided.

This vulnerability concerns a regression issue in python-urllib3 addressed by the update for CVE-2025-66471. The update fixes a regression introduced in the previous patch. No detailed technical or impact information is provided beyond this fix.

A security update for giflib addresses CVE-2026-23868, which involves a double-free vulnerability caused by a shallow copy operation that can lead to memory corruption.