Bytecodealliance · weakness class
Input Validation and Logic
17 CVEs
Every dot is a CVE in what this vendor ships; the named ones are the most at risk.
Every one of the 17 is a mark on the map. Named now: 1 to 17, most at risk first.
- Miscompilation of `i8x16.swizzle` and `select` with v128 inputs in Wasmtime
- Wasmtime: Cranelift backend on aarch64 can jump to incorrect target on large Wasm `br_table` instruction
- Cranelift vulnerable to miscompilation of constant values in division on AArch64
- Wasmtime has Undefined Behavior in Rust runtime functions
- Wasmtime vulnerable to segfault when using component resources
- Wasmtime is vulnerable to panic when dropping a `[Typed]Func::call_async` future
- Wasmtime's host panics when Winch compiler executes `table.fill`
- Wasmtime panics when lifting `flags` component value
- Wasmtime 39.0.0 before 48.0.4 and 49.0.0 before 49.0.2 Stack Buffer Overflow
- Wasmtime 46.0.0 before 48.0.4 and 49.0.0 before 49.0.2 wasi:http Zero Timeout Panic DoS
- Wasmtime runtime crash when combining tail calls with trapping imports
- Wasmtime segfault or unused out-of-sandbox load with `f64x2.splat` operator on x86-64
- Wasmtime before 36.0.18, 37.0.0 before 48.0.6, and 49.0.0 before 49.0.3 HTTP Request Target Smuggling
- Wasmtime 47.0.0 before 48.0.6 and 49.0.0 before 49.0.3 Misaligned VMContext via Exception Tags
- WebAssembly Micro Runtime vulnerable to a segmentation fault in v128.store instruction
- Wasmtime 47.0.0 before 48.0.4 and 49.0.0 before 49.0.2 GC Heap Corruption via Tag Imports
- Wasmtime 46.0.0 before 48.0.4 and 49.0.0 before 49.0.2 Host Panic via WASIp3 Timestamps
exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it
Zoom in on the map and the dots under the middle of it are named where they are.
Data as of 2026-11-14. CVE List through 2026-11-14 · EPSS of 2026-11-13 · CISA KEV checked 2026-11-14. Sources: the CVE List, CISA KEV, EPSS, NVD, nuclei templates and public bug bounty data. Use this via MCP