vm2, Tobit Webbox, NGINX Vulnerabilities Lead Security Briefing

A critical sandbox escape vulnerability in the Node.js vm2 library, affecting versions 3.9.6 through 3.10.5, allows attackers to obtain host objects and escape the sandbox. This is achieved through various methods, including exploiting mutable proxies for intrinsic prototypes and forwarding sandbox writes to host objects using otherReflectSet(). Further vulnerabilities in versions prior to 3.11.0 allow bypassing the module builtin allowlist via the * wildcard, exposing Node's Module._load() for arbitrary module loading. Additionally, a separate vulnerability in versions prior to 3.11.3 allows host exceptions to be caught using yield* within an async generator, leading to potential code execution when the generator is closed. These flaws collectively pose a significant risk to applications relying on vm2 for sandboxing. CVEs include CVE-2026-44005, CVE-2026-43997, and CVE-2026-43999, with additional details in The Hacker News.

Multiple critical vulnerabilities have been disclosed in Tobit Laboratories AG's TeamDavid Webbox application, including several buffer overflow conditions and a memory leak. CVE-2026-54212, CVE-2026-54211, and CVE-2026-54210 detail buffer overflows exploitable via specially crafted JSON bodies, excessively long form data, or file upload requests, potentially leading to denial-of-service or remote code execution. CVE-2026-54203 describes a memory leak vulnerability accessible via a specific URL, allowing unauthorized actors to read sensitive information. Another critical flaw, CVE-2026-54213, allows unauthenticated users to shut down the server by accessing the /internalRestart endpoint. A high-severity vulnerability, CVE-2026-54209, involves insecure password handling, and CVE-2026-54218 highlights the use of hard-coded cryptographic keys for local user passwords, which are only obfuscated. These issues are detailed in Vypr Intelligence.

The NGINX rewrite module is affected by a critical vulnerability, CVE-2026-42945, which can lead to worker process crashes and potentially remote code execution. This flaw exists when the rewrite directive is followed by another rewrite, if, or set directive combined with a Perl-Compatible Regular Expression. The vulnerability has seen widespread reporting and exploitation, with multiple sources including The Hacker News and The Register Security covering its impact and active exploitation. Patches and mitigations have been released by vendors, and users are urged to update immediately.

WordPress sites are facing multiple critical vulnerabilities. The Divi Ajax Filter plugin, up to version 5.1.2, suffers from a Local File Inclusion flaw (CVE-2026-11613) via the 'custom_loop_template' parameter, allowing unauthenticated attackers to include arbitrary files. Additionally, the JobSearch plugin versions up to 3.2.0 have an unauthenticated PHP Object Injection vulnerability (CVE-2026-84834). Furthermore, YITH Request a Quote for WooCommerce Premium versions prior to 4.46.0 contain an unauthenticated Broken Access Control vulnerability (CVE-2026-84834), potentially allowing unauthorized actions.

A critical vulnerability in the Linux kernel, CVE-2026-64068, has been addressed, focusing on missing locking around retry operations for adding new subrequests in the netfs subsystem. This fix ensures proper locking in netfs_retry_read_subrequests() and netfs_retry_write_stream() to prevent race conditions. This disclosure is part of a larger set of vulnerabilities affecting the Linux kernel, as noted by Vypr Intelligence.

The EAP Artemis deserialization configuration presents a security risk due to its default allowance of deserialization. The ObjectMessage.getObject() method utilizes ObjectInputStreamWithClassLoader, which relies on checkSecurity()/isTrustedType() for allow-list/block-list filtering. However, the current implementation may permit the deserialization of untrusted objects, potentially leading to arbitrary code execution. This vulnerability is tracked as CVE-2026-86404.

Red Hat OpenShift Container Platform is impacted by two high-severity vulnerabilities. The Windows Machine Config Operator (WMCO) has a flaw (CVE-2026-54099) where the WICD CSR auto-approver validates the organization system but fails to reject other systems, potentially allowing unauthorized certificate signing requests. Separately, the Route OpenShift resource has insufficient validation on the spec.path YAML stanza (CVE-2026-1784), which could allow a controller to bypass intended security checks.