{"kind": "product", "path": "vulns/ubuntu-26.10/rust-wasmtime", "name": "rust-wasmtime", "product": "rust-wasmtime", "ecosystem": "Ubuntu:26.10", "items": [{"id": "CVE-2026-115893", "noindex": false, "published": "2026-10-23T21:29:33.917Z", "modified": "2026-10-23T21:29:33.917Z", "cvss": 9.9, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "severity": "critical", "epss": 0.00432, "kev": false, "exploits": ["github-poc"], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-115893", "title": "Wasmtime: Cranelift backend on aarch64 can jump to incorrect target on large Wasm `br_table` instruction", "description": "Wasmtime is a runtime for WebAssembly. Prior to 36.0.19, 48.0.7, and 49.0.4, the Cranelift compiler backend on aarch64 can compile a Wasm br_table instruction with more than approximately 256,000 targets so that it has an incorrect conditional branch target. The branch can then jump to arbitrary other code at a user-controlled offset, allowing a user-controlled Wasm module to escape the sandbox on aarch64 engines using the default Cranelift backend. This issue is fixed in versions 36.0.19, 48.0.7, and 49.0.4.", "references": ["https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-mghf-wjfp-p5xm", "https://github.com/bytecodealliance/wasmtime/pull/14818", "https://github.com/bytecodealliance/wasmtime/pull/14819"], "fixes": [], "products": [{"name": "rust-wasmtime", "path": "vulns/ubuntu-26.10/rust-wasmtime", "ecosystem": "Ubuntu:26.10"}]}, {"id": "CVE-2026-115892", "noindex": false, "published": "2026-10-23T21:26:54.528Z", "modified": "2026-10-23T21:26:54.528Z", "cvss": 5.7, "cvss_vector": "CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "severity": "medium", "epss": 0.00434, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-115892", "title": "Wasmtime: Panic lowering a host-created component model stream into a guest that expects a different payload type", "description": "Wasmtime is a runtime for WebAssembly. From 46.0.0 until 48.0.7 and 49.0.4, lowering a host-created component-model stream or future into a guest can omit a required payload-type check after the value passes through guest code and returns through StreamAny, FutureAny, Val::Stream, Val::Future, or an equivalent typed reader. A malicious guest that controls exported function types or returned values can cause the host to pass the type-erased value to a guest expecting a different payload type, which panics the Wasmtime host. This issue is fixed in versions 48.0.7 and 49.0.4.", "references": ["https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-9pvw-hwfg-92h5", "https://github.com/bytecodealliance/wasmtime/pull/14819", "https://github.com/bytecodealliance/wasmtime/pull/14820"], "fixes": [], "products": [{"name": "rust-wasmtime", "path": "vulns/ubuntu-26.10/rust-wasmtime", "ecosystem": "Ubuntu:26.10"}]}, {"id": "CVE-2026-115889", "noindex": false, "published": "2026-10-23T21:23:27.669Z", "modified": "2026-10-26T17:42:15.319Z", "cvss": 9.9, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "severity": "critical", "epss": 0.00454, "kev": false, "exploits": ["github-poc"], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-115889", "title": "Wasmtime: Bit-packing in Cranelift compiler causes silent overflow and miscompilation", "description": "Wasmtime is a runtime for WebAssembly. Prior to 36.0.19 and 43.0.0, the Cranelift compiler backend bit-packs SSA value indices in a way that can silently overflow in release builds when compiling a sufficiently large or specially crafted Wasm function with many SSA values. The overflow can make Cranelift reference incorrect IR values, causing arbitrary miscompilation, type confusion, and other attacker-controlled effects that may escape the Wasm sandbox on any architecture using the default Cranelift backend. This issue is fixed in versions 36.0.19 and 43.0.0.", "references": ["https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-897f-g5gm-fmxm", "https://github.com/bytecodealliance/wasmtime/pull/12613", "https://github.com/bytecodealliance/wasmtime/pull/14818"], "fixes": [], "products": [{"name": "rust-wasmtime", "path": "vulns/ubuntu-26.10/rust-wasmtime", "ecosystem": "Ubuntu:26.10"}]}, {"id": "CVE-2026-115393", "noindex": false, "published": "2026-10-22T19:13:59.314Z", "modified": "2026-10-22T19:13:59.314Z", "cvss": 1, "cvss_vector": "CVSS:4.0/AV:L/AC:H/AT:P/PR:H/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N", "severity": "low", "epss": 0.00092, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-115393", "title": "Wasmtime before 24.0.12, 25.0.0 before 36.0.13, 37.0.0 before 46.0.2, and 47.0.0 before 47.0.3 Cross-Engine Type Confusion", "description": "Wasmtime before 24.0.12, 25.0.0 before 36.0.13, 37.0.0 before 46.0.2, and 47.0.0 before 47.0.3 contains a type confusion vulnerability because several Store APIs fail to validate that objects belong to the Store's Engine. Embedders mixing objects between Engines via Instance::new, StructRefPre::new, or Tag::new can trigger trampoline signature mismatches causing out-of-bounds stack writes, GC heap corruption, or panics.", "references": ["https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-hgjw-h833-99q9", "https://www.vulncheck.com/advisories/wasmtime-before-24.0.12-25.0.0-before-36.0.13-37.0.0-before-46.0.2-and-47.0.0-before-47.0.3-cross-engine-type-confusion", "https://nvd.nist.gov/vuln/detail/CVE-2026-115393"], "fixes": [], "products": [{"name": "rust-wasmtime", "path": "vulns/ubuntu-26.10/rust-wasmtime", "ecosystem": "Ubuntu:26.10"}]}, {"id": "CVE-2026-115392", "noindex": false, "published": "2026-10-22T19:13:58.512Z", "modified": "2026-10-22T19:13:58.512Z", "cvss": 8.8, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:H/VI:H/VA:L/SC:H/SI:H/SA:L", "severity": "high", "epss": 0.00242, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-115392", "title": "Wasmtime before 24.0.13, 25.0.0 before 36.0.14, 37.0.0 before 46.0.3, and 47.0.0 before 47.0.4 Sandbox Escape via Trailing Slashes", "description": "Wasmtime before 24.0.13, 25.0.0 before 36.0.14, 37.0.0 before 46.0.3, and 47.0.0 before 47.0.4 allows a filesystem sandbox escape in wasmtime-wasi because its cap-std dependency mishandles symlinks with trailing slashes on macOS and Linux kernels lacking openat2. A guest with write access to any sandboxed directory can read and write any host-accessible file, and read-only guests may read host files via preexisting symlinks.", "references": ["https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-vqjp-4c8c-hfgg", "https://www.vulncheck.com/advisories/wasmtime-before-24.0.13-25.0.0-before-36.0.14-37.0.0-before-46.0.3-and-47.0.0-before-47.0.4-sandbox-escape-via-trailing-slashes", "https://nvd.nist.gov/vuln/detail/CVE-2026-115392"], "fixes": [], "products": [{"name": "rust-wasmtime", "path": "vulns/ubuntu-26.10/rust-wasmtime", "ecosystem": "Ubuntu:26.10"}]}, {"id": "CVE-2026-115391", "noindex": false, "published": "2026-10-22T19:13:57.752Z", "modified": "2026-10-22T19:13:57.752Z", "cvss": 6.9, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H", "severity": "medium", "epss": 0.00172, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-115391", "title": "Wasmtime 46.0.0 before 46.0.3 and 47.0.0 before 47.0.4 Unbounded Heap Allocation via WASIp3 Streams", "description": "Wasmtime 46.0.0 before 46.0.3 and 47.0.0 before 47.0.4 contains an uncontrolled resource allocation vulnerability in its WASIp3 implementation that buffers guest-specified-length writes on the host without limit. Malicious guests can offer large buffers to WASIp3 file or HTTP write streams, causing the host to copy and buffer all bytes, bounded only by guest linear memory, exhausting host memory.", "references": ["https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-x84v-gj2h-g759", "https://www.vulncheck.com/advisories/wasmtime-46.0.0-before-46.0.3-and-47.0.0-before-47.0.4-unbounded-heap-allocation-via-wasip3-streams", "https://nvd.nist.gov/vuln/detail/CVE-2026-115391"], "fixes": [], "products": [{"name": "rust-wasmtime", "path": "vulns/ubuntu-26.10/rust-wasmtime", "ecosystem": "Ubuntu:26.10"}]}, {"id": "CVE-2026-115390", "noindex": false, "published": "2026-10-22T19:13:55.910Z", "modified": "2026-10-23T15:00:44.401Z", "cvss": 6.9, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "severity": "medium", "epss": 0.00242, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-115390", "title": "Wasmtime 47.0.0 before 48.0.3 and 49.0.0 before 49.0.1 Fuel Accounting Bypass DoS", "description": "Wasmtime 47.0.0 before 48.0.3 and 49.0.0 before 49.0.1 contains a fuel accounting flaw in Cranelift-compiled call_ref and try_table catch paths. Malicious guests can reset consumed fuel after calls to run exponentially long on linear fuel, evading timeouts and periodic yields for denial of service.", "references": ["https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-m63x-6p34-q65x", "https://www.vulncheck.com/advisories/wasmtime-47.0.0-before-48.0.3-and-49.0.0-before-49.0.1-fuel-accounting-bypass-dos", "https://nvd.nist.gov/vuln/detail/CVE-2026-115390"], "fixes": [], "products": [{"name": "rust-wasmtime", "path": "vulns/ubuntu-26.10/rust-wasmtime", "ecosystem": "Ubuntu:26.10"}]}, {"id": "CVE-2026-115389", "noindex": false, "published": "2026-10-22T19:13:55.163Z", "modified": "2026-10-22T19:13:55.163Z", "cvss": 1, "cvss_vector": "CVSS:4.0/AV:A/AC:H/AT:P/PR:L/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N", "severity": "low", "epss": 0.00153, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-115389", "title": "Wasmtime before 36.0.16, 37.0.0 before 48.0.3, and 49.0.0 before 49.0.1 Denial of Service via Val API", "description": "Wasmtime before 36.0.16, 37.0.0 before 48.0.3, and 49.0.0 before 49.0.1 does not adequately account for host allocations when lifting guest values through the dynamically-typed Val API, bypassing the hostcall fuel limit. A malicious WebAssembly guest can return crafted values that allocate at least ~100x more host memory than tracked, causing denial of service.", "references": ["https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-jqpg-j7w6-42pr", "https://www.vulncheck.com/advisories/wasmtime-before-36.0.16-37.0.0-before-48.0.3-and-49.0.0-before-49.0.1-denial-of-service-via-val-api", "https://nvd.nist.gov/vuln/detail/CVE-2026-115389"], "fixes": [], "products": [{"name": "rust-wasmtime", "path": "vulns/ubuntu-26.10/rust-wasmtime", "ecosystem": "Ubuntu:26.10"}]}, {"id": "CVE-2026-115388", "noindex": false, "published": "2026-10-22T19:13:54.430Z", "modified": "2026-10-22T19:13:54.430Z", "cvss": 6.9, "cvss_vector": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "severity": "medium", "epss": 0.00112, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-115388", "title": "Wasmtime before 36.0.16, 37.0.0 before 48.0.3, and 49.0.0 before 49.0.1 Memory Exhaustion DoS via wasmtime-wasi-http Outgoing Body Write", "description": "wasmtime-wasi-http in Wasmtime before 36.0.16, 37.0.0 before 48.0.3, and 49.0.0 before 49.0.1 does not enforce the wasi:io/streams check-write allowance for WASIp2 outgoing HTTP bodies, so oversized writes succeed instead of trapping. A malicious guest can pass large buffers to write on outgoing-body resources, holding host allocations for the store's lifetime and exhausting host memory.", "references": ["https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-c9gc-w9vx-w86p", "https://www.vulncheck.com/advisories/wasmtime-before-36.0.16-37.0.0-before-48.0.3-and-49.0.0-before-49.0.1-memory-exhaustion-dos-via-wasmtime-wasi-http-outgoing-body-write", "https://nvd.nist.gov/vuln/detail/CVE-2026-115388"], "fixes": [], "products": [{"name": "rust-wasmtime", "path": "vulns/ubuntu-26.10/rust-wasmtime", "ecosystem": "Ubuntu:26.10"}]}, {"id": "CVE-2026-115387", "noindex": false, "published": "2026-10-22T19:13:53.696Z", "modified": "2026-10-22T19:13:53.696Z", "cvss": 6.9, "cvss_vector": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "severity": "medium", "epss": 0.00112, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-115387", "title": "Wasmtime before 36.0.16, 37.0.0 before 48.0.3, and 49.0.0 before 49.0.1 Host Panic via WASI Filesystem Timestamp Overflow", "description": "Wasmtime before 36.0.16, 37.0.0 before 48.0.3, and 49.0.0 before 49.0.1 contains a denial of service vulnerability in wasmtime-wasi that allows guest WASI programs to panic the host via overflowing filesystem timestamps. Attackers can pass atim or mtim values whose sub-second field overflows the seconds field to path_filestat_set_times, fd_filestat_set_times, set-times, or set-times-at, crashing the host.", "references": ["https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-j2g9-4prp-pf6h", "https://www.vulncheck.com/advisories/wasmtime-before-36.0.16-37.0.0-before-48.0.3-and-49.0.0-before-49.0.1-host-panic-via-wasi-filesystem-timestamp-overflow", "https://nvd.nist.gov/vuln/detail/CVE-2026-115387"], "fixes": [], "products": [{"name": "rust-wasmtime", "path": "vulns/ubuntu-26.10/rust-wasmtime", "ecosystem": "Ubuntu:26.10"}]}, {"id": "CVE-2026-115386", "noindex": false, "published": "2026-10-22T19:13:52.931Z", "modified": "2026-10-23T15:00:52.816Z", "cvss": 2.1, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N", "severity": "low", "epss": 0.00197, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-115386", "title": "Wasmtime before 36.0.17, 37.0.0 before 48.0.4, and 49.0.0 before 49.0.2 Memory Disclosure via fd_readdir", "description": "Wasmtime before 36.0.17, 37.0.0 before 48.0.4, and 49.0.0 before 49.0.2 contains an information disclosure vulnerability in the WASIp1 fd_readdir implementation that copies uninitialized struct padding into guest memory. Guests with a preopened directory can list entries to receive three bytes of leftover host stack or heap memory per directory entry.", "references": ["https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-96f6-r43r-8c24", "https://www.vulncheck.com/advisories/wasmtime-before-36.0.17-37.0.0-before-48.0.4-and-49.0.0-before-49.0.2-memory-disclosure-via-fd-readdir", "https://nvd.nist.gov/vuln/detail/CVE-2026-115386"], "fixes": [], "products": [{"name": "rust-wasmtime", "path": "vulns/ubuntu-26.10/rust-wasmtime", "ecosystem": "Ubuntu:26.10"}]}, {"id": "CVE-2026-115385", "noindex": false, "published": "2026-10-22T19:13:52.184Z", "modified": "2026-10-26T19:38:29.749Z", "cvss": 6.9, "cvss_vector": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "severity": "medium", "epss": 0.00112, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-115385", "title": "Wasmtime 46.0.0 before 48.0.4 and 49.0.0 before 49.0.2 Host Panic via WASIp3 Timestamps", "description": "Wasmtime 46.0.0 before 48.0.4 and 49.0.0 before 49.0.2 contains a denial of service vulnerability in the wasmtime-wasi WASIp3 implementation that allows guests to abort the Unix host process. Guests with mutable preopened directory access can call set-times or set-times-at with negative seconds timestamps before the epoch, triggering an assertion failure that crashes the host.", "references": ["https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-mr2v-56j5-cmfc", "https://www.vulncheck.com/advisories/wasmtime-46.0.0-before-48.0.4-and-49.0.0-before-49.0.2-host-panic-via-wasip3-timestamps", "https://nvd.nist.gov/vuln/detail/CVE-2026-115385"], "fixes": [], "products": [{"name": "rust-wasmtime", "path": "vulns/ubuntu-26.10/rust-wasmtime", "ecosystem": "Ubuntu:26.10"}]}, {"id": "CVE-2026-115384", "noindex": false, "published": "2026-10-22T19:13:51.422Z", "modified": "2026-10-22T19:13:51.422Z", "cvss": 9.4, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H", "severity": "critical", "epss": 0.00312, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-115384", "title": "Wasmtime 39.0.0 before 48.0.4 and 49.0.0 before 49.0.2 Stack Buffer Overflow", "description": "Wasmtime 39.0.0 before 48.0.4 and 49.0.0 before 49.0.2 contains a stack buffer overflow vulnerability that allows malicious guests to write ~16KB to the native stack via unvalidated async callback result types. Attackers can supply components with mistyped component-model-async callback functions to overwrite return addresses, crashing the host or escaping the sandbox.", "references": ["https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-32h6-97mm-8q3c", "https://www.vulncheck.com/advisories/wasmtime-39.0.0-before-48.0.4-and-49.0.0-before-49.0.2-stack-buffer-overflow", "https://nvd.nist.gov/vuln/detail/CVE-2026-115384"], "fixes": [], "products": [{"name": "rust-wasmtime", "path": "vulns/ubuntu-26.10/rust-wasmtime", "ecosystem": "Ubuntu:26.10"}]}, {"id": "CVE-2026-115383", "noindex": false, "published": "2026-10-22T19:13:50.687Z", "modified": "2026-10-22T19:13:50.687Z", "cvss": 5.9, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "severity": "medium", "epss": 0.00184, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-115383", "title": "Wasmtime 47.0.0 before 48.0.4 and 49.0.0 before 49.0.2 GC Heap Corruption via Tag Imports", "description": "Wasmtime 47.0.0 before 48.0.4 and 49.0.0 before 49.0.2 contains an improper validation vulnerability that accepts components whose core modules import WebAssembly tags with a subtype of the original type. Malicious guests can mis-type exception object payloads to corrupt the GC heap, causing Wasmtime to panic when the exceptions proposal is enabled.", "references": ["https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-cfhf-m2cr-62wj", "https://www.vulncheck.com/advisories/wasmtime-47.0.0-before-48.0.4-and-49.0.0-before-49.0.2-gc-heap-corruption-via-tag-imports", "https://nvd.nist.gov/vuln/detail/CVE-2026-115383"], "fixes": [], "products": [{"name": "rust-wasmtime", "path": "vulns/ubuntu-26.10/rust-wasmtime", "ecosystem": "Ubuntu:26.10"}]}, {"id": "CVE-2026-115382", "noindex": false, "published": "2026-10-22T19:13:49.956Z", "modified": "2026-10-23T15:01:00.837Z", "cvss": 5.9, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "severity": "medium", "epss": 0.00276, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-115382", "title": "Wasmtime 46.0.0 before 48.0.4 and 49.0.0 before 49.0.2 wasi:http Zero Timeout Panic DoS", "description": "Wasmtime 46.0.0 before 48.0.4 and 49.0.0 before 49.0.2 contains a denial-of-service vulnerability in its wasi:http implementation that allows guests to panic the host. Guests can specify a zero between-bytes-timeout request option, which is forwarded directly to a Tokio API that panics, crashing the host embedding.", "references": ["https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-w4qr-p94g-mjhv", "https://www.vulncheck.com/advisories/wasmtime-46.0.0-before-48.0.4-and-49.0.0-before-49.0.2-wasi-http-zero-timeout-panic-dos", "https://nvd.nist.gov/vuln/detail/CVE-2026-115382"], "fixes": [], "products": [{"name": "rust-wasmtime", "path": "vulns/ubuntu-26.10/rust-wasmtime", "ecosystem": "Ubuntu:26.10"}]}, {"id": "CVE-2026-115381", "noindex": false, "published": "2026-10-22T19:13:49.244Z", "modified": "2026-10-26T19:38:29.893Z", "cvss": 5.9, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "severity": "medium", "epss": 0.00212, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-115381", "title": "Wasmtime before 36.0.17, 37.0.0 before 48.0.4, and 49.0.0 before 49.0.2 Unbounded Host Memory Allocation via SinkOutputStream write-zeroes", "description": "Wasmtime before 36.0.17, 37.0.0 before 48.0.4, and 49.0.0 before 49.0.2 contains an unbounded memory allocation in the wasmtime-wasi WASIp2 write-zeroes method of SinkOutputStream, the default stream used when stdout/stderr are not configured. A malicious WebAssembly guest can request huge zero-filled writes, exhausting host memory and causing denial of service.", "references": ["https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-gqmc-89g8-p25r", "https://www.vulncheck.com/advisories/wasmtime-before-36.0.17-37.0.0-before-48.0.4-and-49.0.0-before-49.0.2-unbounded-host-memory-allocation-via-sinkoutputstream-write-zeroes", "https://nvd.nist.gov/vuln/detail/CVE-2026-115381"], "fixes": [], "products": [{"name": "rust-wasmtime", "path": "vulns/ubuntu-26.10/rust-wasmtime", "ecosystem": "Ubuntu:26.10"}]}, {"id": "CVE-2026-115380", "noindex": false, "published": "2026-10-22T19:13:48.469Z", "modified": "2026-10-26T19:38:30.038Z", "cvss": 5.1, "cvss_vector": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N", "severity": "medium", "epss": 0.00118, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-115380", "title": "Wasmtime before 36.0.17, 37.0.0 before 48.0.4, and 49.0.0 before 49.0.2 Fuel Limit Bypass DoS via WASI Preview 0 poll_oneoff", "description": "Wasmtime before 36.0.17, 37.0.0 before 48.0.4, and 49.0.0 before 49.0.2 contains a denial of service vulnerability in the wasmtime-wasi WASI preview 0 poll_oneoff adapter, which performs O(n) host work per subscription without consuming or checking fuel. Malicious guest modules can pass many subscriptions to force long-running host computation that ignores configured fuel limits.", "references": ["https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-j366-h8gg-77pm", "https://www.vulncheck.com/advisories/wasmtime-before-36.0.17-37.0.0-before-48.0.4-and-49.0.0-before-49.0.2-fuel-limit-bypass-dos-via-wasi-preview-0-poll-oneoff", "https://nvd.nist.gov/vuln/detail/CVE-2026-115380"], "fixes": [], "products": [{"name": "rust-wasmtime", "path": "vulns/ubuntu-26.10/rust-wasmtime", "ecosystem": "Ubuntu:26.10"}]}, {"id": "CVE-2026-115379", "noindex": false, "published": "2026-10-22T19:13:47.737Z", "modified": "2026-10-22T19:13:47.737Z", "cvss": 6.9, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "severity": "medium", "epss": 0.00278, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-115379", "title": "Wasmtime 47.0.0 before 48.0.4 and 49.0.0 before 49.0.2 GC Heap Corruption via try_call", "description": "Wasmtime 47.0.0 before 48.0.4 and 49.0.0 before 49.0.2 contains a missing GC rooting vulnerability that leaves references live across try_call unrooted when compiling Wasm modules. Attackers can supply Wasm modules whose callee triggers garbage collection, leaving stale or dangling references that cause GC heap corruption or incorrect execution.", "references": ["https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-hw8m-q44c-ggrf", "https://www.vulncheck.com/advisories/wasmtime-47.0.0-before-48.0.4-and-49.0.0-before-49.0.2-gc-heap-corruption-via-try-call", "https://nvd.nist.gov/vuln/detail/CVE-2026-115379"], "fixes": [], "products": [{"name": "rust-wasmtime", "path": "vulns/ubuntu-26.10/rust-wasmtime", "ecosystem": "Ubuntu:26.10"}]}, {"id": "CVE-2026-104855", "noindex": false, "published": "2026-10-02T17:37:50.941Z", "modified": "2026-10-06T16:38:35.157Z", "cvss": 2, "cvss_vector": "CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:P/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N", "severity": "low", "epss": 0.00276, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-104855", "title": "Wasmtime: Preemption and traps during bulk operations enable breaking internal VM state", "description": "Wasmtime is a runtime for WebAssembly. From 46.0.0 until 46.0.2 and 47.0.3, fuel and epoch preemption checks inside bulk operations including memory.copy, table.grow, and array.copy can expose invalid intermediate state when an embedder mutates a Store in Store::epoch_deadline_callback or continues using a Store after cancellation or a trap. A cancelled non-nullable table growth can leave null elements, linear-memory growth during memory.copy can invalidate retained raw pointers, and callback-triggered garbage collection during array.copy can invalidate GC pointers, resulting in a crash, invalid memory access, or GC heap corruption. Embedding", "references": ["https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-2hw9-mc66-jc2q", "https://github.com/bytecodealliance/wasmtime/pull/14041", "https://github.com/bytecodealliance/wasmtime/pull/14043"], "fixes": [], "products": [{"name": "rust-wasmtime", "path": "vulns/ubuntu-26.10/rust-wasmtime", "ecosystem": "Ubuntu:26.10"}]}, {"id": "CVE-2026-58494", "noindex": false, "published": "2026-07-08T20:22:16.039Z", "modified": "2026-07-09T13:28:57.055Z", "cvss": 6.5, "cvss_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N", "severity": "medium", "epss": 0.00171, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-58494", "title": "Wasmtime: WASI hard links bypass wasmtime-wasi's FilePerms for destination", "description": "Wasmtime is a runtime for WebAssembly. Prior to 24.0.11, 36.0.12, 45.0.3, and 46.0.1, wasmtime-wasi hard-link creation and renaming check directory permissions but not matching FilePerms on source and destination preopens, allowing a WASI guest with a read-only source file capability to overwrite host files exposed as FilePerms::READ through wasip1, wasip2, or wasip3 filesystem interfaces. This issue is fixed in versions 24.0.11, 36.0.12, 45.0.3, and 46.0.1.", "references": ["https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-4ch3-9j33-3pmj", "https://github.com/bytecodealliance/wasmtime/commit/5ddfd5f1ef28f2041fa07d237ad0336e167b0e0c", "https://github.com/bytecodealliance/wasmtime/commit/7db94cdcf0c79cb3dfde884b534b653f2dd83367"], "fixes": [], "products": [{"name": "rust-wasmtime", "path": "vulns/ubuntu-26.10/rust-wasmtime", "ecosystem": "Ubuntu:26.10"}]}], "total": 43, "unknown_count": 0, "release_unconfirmed": false, "page": 1, "pages": 3, "filtered": false, "noindex": false, "filters": {}, "page_size": 20, "products": [{"name": "rust-wasmtime", "path": "vulns/ubuntu-26.10/rust-wasmtime", "ecosystem": "Ubuntu:26.10"}], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}, {"name": "web", "path": "vulns/stack/web", "slug": "web"}, {"name": "php", "path": "vulns/stack/php", "slug": "php"}, {"name": "python", "path": "vulns/stack/python", "slug": "python"}, {"name": "node", "path": "vulns/stack/node", "slug": "node"}, {"name": "database", "path": "vulns/stack/database", "slug": "database"}, {"name": "containers", "path": "vulns/stack/containers", "slug": "containers"}, {"name": "network", "path": "vulns/stack/network", "slug": "network"}, {"name": "applications", "path": "vulns/stack/applications", "slug": "applications"}], "versions": [], "stats": {"recent": 19, "kev": 0}, "lastmod": "2026-10-26T19:38:30.038Z", "early_advisories": [], "license": "Подборку PatchFirst и наши дополнения (приоритеты, ранние предупреждения, тексты, сводки и агрегаты) можно свободно использовать для собственных целей, включая внутренние задачи бизнеса. Перепродажа, коммерческое распространение и массовое зеркалирование этой подборки или дополнений допускаются только по письменному соглашению с оператором. При любом использовании или публикации подборки или наших дополнений указывайте PatchFirst (https://ru.patchfirst.dev/vulns/) с этой ссылкой на страницу ленты своего региона. Исходные записи открытых источников остаются под их лицензиями и условиями. Эти условия не ограничивают ваши права на исходные данные, которые можно получить у источников напрямую.", "terms_url": "https://ru.patchfirst.dev/vulns/#feed-terms", "attribution": {"name": "PatchFirst", "url": "https://ru.patchfirst.dev/vulns/"}, "source_changes": "PatchFirst отбирает, нормализует и объединяет записи; могут добавляться сводки и переводы. Новости указываются ссылкой на первоисточник в самой записи.", "sources": [{"id": "cve", "name": "CVE List / CVE.org", "url": "https://www.cve.org/", "license": "CVE Terms of Use", "terms_url": "https://www.cve.org/Legal/TermsOfUse", "notice": "Copyright © 1999–2021, The MITRE Corporation. LICENSE Submissions : For all materials you submit to the Common Vulnerabilities and Exposures (CVE™), you hereby grant to The MITRE Corporation (MITRE) and all CVE Numbering Authorities (CNAs) a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute such materials and derivative works. Unless required by applicable law or agreed to in writing, you provide such materials on an \"AS IS\" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied, including, without limitation, any warranties or conditions of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A PARTICULAR PURPOSE. CVE Usage : MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE™). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy. DISCLAIMERS ALL DOCUMENTS AND THE INFORMATION CONTAINED THEREIN PROVIDED BY MITRE ARE PROVIDED ON AN \"AS IS\" BASIS AND THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS OR IS SPONSORED BY (IF ANY), THE MITRE CORPORATION, ITS BOARD OF TRUSTEES, OFFICERS, AGENTS, AND EMPLOYEES, DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION THEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE."}, {"id": "osv", "name": "OSV", "url": "https://osv.dev/", "terms_url": "https://google.github.io/osv.dev/data/", "terms": "Лицензии исходных баз различаются; см. каталог источников."}, {"id": "kev", "name": "CISA KEV", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "license": "CC0-1.0", "terms_url": "https://github.com/cisagov/kev-data/blob/develop/LICENSE"}, {"id": "epss", "name": "FIRST EPSS", "url": "https://www.first.org/epss/", "terms_url": "https://www.first.org/epss/faq", "terms": "Оценки доступны свободно; запрашивается указание источника (FIRST EPSS, оценки подготовлены Empirical Security)."}, {"id": "github-advisory", "name": "GitHub Advisory Database", "url": "https://github.com/advisories", "license": "CC-BY-4.0", "terms_url": "https://github.com/github/advisory-database/blob/main/LICENSE.md"}, {"id": "exploitdb", "name": "Exploit-DB", "url": "https://www.exploit-db.com/", "license": "GPL-2.0", "terms_url": "https://gitlab.com/exploit-database/exploitdb/-/blob/main/LICENSE.md"}, {"id": "metasploit", "name": "Metasploit", "url": "https://github.com/rapid7/metasploit-framework", "license": "BSD-3-Clause", "terms_url": "https://github.com/rapid7/metasploit-framework/blob/master/LICENSE", "notice": "Copyright (c) 2006-2026, Rapid7, Inc.\nLicense: BSD-3-clause\n Redistribution and use in source and binary forms, with or without modification,\n are permitted provided that the following conditions are met:\n .\n * Redistributions of source code must retain the above copyright notice,\n this list of conditions and the following disclaimer.\n .\n * Redistributions in binary form must reproduce the above copyright notice,\n this list of conditions and the following disclaimer in the documentation\n and/or other materials provided with the distribution.\n .\n * Neither the name of Rapid7, Inc. nor the names of its contributors\n may be used to endorse or promote products derived from this software\n without specific prior written permission.\n .\n THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS \"AS IS\" AND\n ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED\n WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE\n DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR\n ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES\n (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;\n LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON\n ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT\n (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS\n SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE."}, {"id": "nuclei", "name": "Nuclei Templates", "url": "https://github.com/projectdiscovery/nuclei-templates", "license": "MIT", "terms_url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/LICENSE.md", "notice": "MIT License\n\nCopyright (c) 2025 ProjectDiscovery, Inc.\n\nPermission is hereby granted, free of charge, to any person obtaining a copy\nof this software and associated documentation files (the \"Software\"), to deal\nin the Software without restriction, including without limitation the rights\nto use, copy, modify, merge, publish, distribute, sublicense, and/or sell\ncopies of the Software, and to permit persons to whom the Software is\nfurnished to do so, subject to the following conditions:\n\nThe above copyright notice and this permission notice shall be included in all\ncopies or substantial portions of the Software.\n\nTHE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR\nIMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,\nFITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE\nAUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER\nLIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,\nOUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE\nSOFTWARE."}, {"id": "linux-kernel", "name": "Linux kernel releases", "url": "https://www.kernel.org/", "license": "CC-BY-SA-4.0", "terms_url": "https://www.kernel.org/legal.html", "notice": "Copyright (C) 1997-2014 by The Linux Kernel Organization, Inc."}]}