Browse CVEs

MEDIUM 5.0 CVE-2026-54786 Wasmtime is a runtime for WebAssembly. All versions prior to 24.0.10; versions 25.0.0 through those before 36.0.11; versions 37.0.0 through those be… Wasmtime 24.0.10 / 36.0.11+ Fix from $1,6002026-07-01 HIGH 7.5 CVE-2026-47261 Wasmtime is a runtime for WebAssembly. In versions prior to 24.0.9, 36.0.10, and 44.0.2, when a filesystem preopen is given DirPerms::all() and FileP… Wasmtime 24.0.9 / 36.0.10+ Fix from $1,9502026-06-15 HIGH 7.5 CVE-2026-44216 Wasmtime is a runtime for WebAssembly. From 30.0.0 to 36.0.8, 43.0.2, and 44.0.1, Wasmtime's allocation logic for a WebAssembly table contained check… Wasmtime 36.0.8 / 43.0.2+ Fix from $1,9502026-05-14 CRITICAL 9.9 CVE-2026-34987 Wasmtime is a runtime for WebAssembly. From 25.0.0 to before 36.0.7, 42.0.2, and 43.0.1, Wasmtime with its Winch (baseline) non-default compiler back… Wasmtime 36.0.7 / 42.0.2+ Fix from $2,3002026-04-09 HIGH 7.5 CVE-2026-35186 Wasmtime is a runtime for WebAssembly. From 25.0.0 to before 36.0.7, 42.0.2, and 43.0.1, Wasmtime's Winch compiler backend contains a bug where trans… Wasmtime 36.0.7 / 42.0.2+ Fix from $1,9502026-04-09 MEDIUM 6.3 CVE-2026-34988 Wasmtime is a runtime for WebAssembly. From 28.0.0 to before 36.0.7, 42.0.2, and 43.0.1, Wasmtime's implementation of its pooling allocator contains … Wasmtime 36.0.7 / 42.0.2+ Fix from $1,6002026-04-09 MEDIUM 5.4 CVE-2026-35195 Wasmtime is a runtime for WebAssembly. Prior to 24.0.7, 36.0.7, 42.0.2, and 43.0.1, Wasmtime's implementation of transcoding strings between componen… Wasmtime 24.0.7 / 36.0.7+ Fix from $1,6002026-04-09 HIGH 7.8 CVE-2026-34971 Wasmtime is a runtime for WebAssembly. From 32.0.0 to before 36.0.7, 42.0.2, and 43.0.1, Wasmtime's Cranelift compilation backend contains a bug on a… Wasmtime 36.0.7 / 42.0.2+ Fix from $1,9502026-04-09 HIGH 7.5 CVE-2026-34943 Wasmtime is a runtime for WebAssembly. Prior to 24.0.7, 36.0.7, 42.0.2, and 43.0.1, Wasmtime contains a possible panic which can happen when a flags-… Wasmtime 24.0.7 / 36.0.7+ Fix from $1,9502026-04-09 HIGH 7.5 CVE-2026-34946 Wasmtime is a runtime for WebAssembly. From 25.0.0 to before 36.0.7, 42.0.2, and 43.0.1, Wasmtime's Winch compiler contains a vulnerability where the… Wasmtime 36.0.7 / 42.0.2+ Fix from $1,9502026-04-09 MEDIUM 6.5 CVE-2026-34945 Wasmtime is a runtime for WebAssembly. From 25.0.0 to before 36.0.7, 42.0.2, and 43.0.1, Wasmtime's Winch compiler contains a bug where a 64-bit tabl… Wasmtime 36.0.7 / 42.0.2+ Fix from $1,6002026-04-09 MEDIUM 5.7 CVE-2026-34944 Wasmtime is a runtime for WebAssembly. Prior to 24.0.7, 36.0.7, 42.0.2, and 43.0.1, On x86-64 platforms with SSE3 disabled Wasmtime's compilation of … Wasmtime 24.0.7 / 36.0.7+ Fix from $1,6002026-04-09 MEDIUM 5.0 CVE-2026-34983 Wasmtime is a runtime for WebAssembly. In 43.0.0, cloning a wasmtime::Linker is unsound and can result in use-after-free bugs. This bug is not contro… Wasmtime Mitigation only Fix from $1,6002026-04-09 HIGH 8.1 CVE-2026-34941 Wasmtime is a runtime for WebAssembly. Prior to 24.0.7, 36.0.7, 42.0.2, and 43.0.1, Wasmtime contains a vulnerability where when transcoding a UTF-16… Wasmtime 24.0.7 / 36.0.7+ Fix from $1,9502026-04-09 MEDIUM 6.5 CVE-2026-34942 Wasmtime is a runtime for WebAssembly. Prior to 24.0.7, 36.0.7, 42.0.2, and 43.0.1, Wasmtime's implementation of transcoding strings into the Compone… Wasmtime 24.0.7 / 36.0.7+ Fix from $1,6002026-04-09 HIGH 7.5 CVE-2026-27195 Wasmtime is a runtime for WebAssembly. Starting with Wasmtime 39.0.0, the `component-model-async` feature became the default, which brought with it a… Wasmtime 40.0.4 / 41.0.4+ Fix from $1,9502026-02-24 HIGH 7.5 CVE-2026-27572 Wasmtime is a runtime for WebAssembly. Prior to versions 24.0.6, 36.0.6, 4.0.04, 41.0.4, and 42.0.0, Wasmtime's implementation of the `wasi:http/type… Wasmtime 24.0.6 / 36.0.6+ Fix from $1,9502026-02-24 MEDIUM 6.5 CVE-2026-27204 Wasmtime is a runtime for WebAssembly. Prior to versions 24.0.6, 36.0.6, 4.0.04, 41.0.4, and 42.0.0, Wasmtime's implementation of WASI host interface… Wasmtime 24.0.6 / 36.0.6+ Fix from $1,6002026-02-24 MEDIUM 5.5 CVE-2026-24116 Wasmtime is a runtime for WebAssembly. Starting in version 29.0.0 and prior to version 36.0.5, 40.0.3, and 41.0.1, on x86-64 platforms with AVX, Wasm… Wasmtime 36.0.5 / 40.0.3+ Fix from $1,6002026-01-27 HIGH 7.4 CVE-2025-64713 WebAssembly Micro Runtime (WAMR) is a lightweight standalone WebAssembly (Wasm) runtime. Prior to version 2.4.4, an out-of-bounds array access issue … Webassembly Micro Runtime 2.4.4+ Fix from $1,9502025-11-25 MEDIUM 5.5 CVE-2025-64704 WebAssembly Micro Runtime (WAMR) is a lightweight standalone WebAssembly (Wasm) runtime. Prior to version 2.4.4, WAMR is susceptible to a segmentatio… Webassembly Micro Runtime 2.4.4+ Fix from $1,6002025-11-25 MEDIUM 5.3 CVE-2025-58749 WebAssembly Micro Runtime (WAMR) is a lightweight standalone WebAssembly (Wasm) runtime. In WAMR versions prior to 2.4.2, when running in LLVM-JIT mo… Webassembly Micro Runtime 2.4.2+ Fix from $1,6002025-09-16 MEDIUM 5.3 CVE-2025-54126 The WebAssembly Micro Runtime's (WAMR) iwasm package is the executable binary built with WAMR VMcore which supports WebAssembly System Interface (WAS… Webassembly Micro Runtime after 2.4.0 Fix from $1,6002025-07-29 MEDIUM 5.5 CVE-2025-43853 The WebAssembly Micro Runtime's (WAMR) iwasm package is the executable binary built with WAMR VMcore which supports WebAssembly System Interface (WAS… Webassembly Micro Runtime 2.2.0+ Fix from $1,6002025-05-15 HIGH 7.5 CVE-2024-27532 wasm-micro-runtime (aka WebAssembly Micro Runtime or WAMR) 06df58f is vulnerable to NULL Pointer Dereference in function `block_type_get_result_types. Webassembly Micro Runtime 2.4.2+ Fix from $1,9502024-11-08 HIGH 7.8 CVE-2024-25431 An issue in bytecodealliance wasm-micro-runtime before v.b3f728c and fixed in commit 06df58f allows a remote attacker to escalate privileges via a cr… Webassembly Micro Runtime 1.3.2+ Fix from $1,9502024-11-08 CRITICAL 10.0 CVE-2024-51745 Wasmtime is a fast and secure runtime for WebAssembly. Wasmtime's filesystem sandbox implementation on Windows blocks access to special device filena… Wasmtime 24.0.2+ Fix from $2,3002024-11-05 MEDIUM 5.5 CVE-2024-47763 Wasmtime is an open source runtime for WebAssembly. Wasmtime's implementation of WebAssembly tail calls combined with stack traces can result in a ru… Wasmtime Patch available Fix from $1,6002024-10-09 HIGH 7.5 CVE-2024-34251 An out-of-bound memory read vulnerability was discovered in Bytecode Alliance wasm-micro-runtime v2.0.0 which allows a remote attacker to cause a den… Webassembly Micro Runtime No fix yet Fix from $1,9502024-05-06 MEDIUM 6.2 CVE-2024-34250 A heap buffer overflow vulnerability was discovered in Bytecode Alliance wasm-micro-runtime v2.0.0 which allows a remote attacker to cause at least a… Webassembly Micro Runtime No fix yet Fix from $1,6002024-05-06