CVE-2026-119136

The Wasmtime runtime (versions 42.0.0 before 48.0.6 and 49.0.0 before 49.0.3 ) contains insufficient checks in the Store component when mixing async-style and sync-style WebAssembly calls. This vulnerability allows embedders re-entering WebAssembly via sync APIs from host functions called asynchr...

EUVD-2026-113203

Wasmtime 42.0.0 before 48.0.6 and 49.0.0 before 49.0.3 contains insufficient checks in Store when mixing async-style and sync-style WebAssembly calls. Embedders re-entering WebAssembly via sync APIs from host functions called asynchronously can trigger runtime panics or unsound cross-thread...

CVE-2026-119136 Wasmtime 42.0.0 before 48.0.6 and 49.0.0 before 49.0.3 Async-Entrypoint Enforcement Bypass

Wasmtime 42.0.0 before 48.0.6 and 49.0.0 before 49.0.3 contains insufficient checks in Store when mixing async-style and sync-style WebAssembly calls. Embedders re-entering WebAssembly via sync APIs from host functions called asynchronously can trigger runtime panics or unsound cross-thread...

CVE-2026-119136

Wasmtime 42.0.0 before 48.0.6 and 49.0.0 before 49.0.3 contains insufficient checks in Store when mixing async-style and sync-style WebAssembly calls. Embedders re-entering WebAssembly via sync APIs from host functions called asynchronously can trigger runtime panics or unsound cross-thread...

CVE-2026-119136 Wasmtime 42.0.0 before 48.0.6 and 49.0.0 before 49.0.3 Async-Entrypoint Enforcement Bypass

Wasmtime 42.0.0 before 48.0.6 and 49.0.0 before 49.0.3 contains insufficient checks in Store when mixing async-style and sync-style WebAssembly calls. Embedders re-entering WebAssembly via sync APIs from host functions called asynchronously can trigger runtime panics or unsound cross-thread...

CVE-2026-18894 Langflow OSS is affected by multiple vulnerabilities

IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote attacker to trigger pre-existing stored Python component code in a public workflow, executing it under the flow owner's runtime context within the server process. This bypasses the intended trust boundary where public execution paths are...

Security Bulletin: IBM MQ is affected by multiple vulnerabilities in the IBM Semeru Runtime Environment

Summary Multiple issues were identified with the IBM Semeru Runtime Environment which is shipped with IBM MQ Vulnerability Details CVEID:CVE-2026-41254 DESCRIPTION: Little CMS lcms2 through 2.18 has an integer overflow in CubeSize in cmslut.c because the overflow check is performed after the...

Security Bulletin: IBM MQ is affected by multiple Java vulnerabilities (CVE-2026-61308,CVE-2026-70907,CVE-2026-60589)

Summary Multiple issues were identified with the IBM Runtime Environment, Java Technology Edition which is shipped with IBM MQ Vulnerability Details CVEID:CVE-2026-61308 DESCRIPTION: Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Java...

OESA-2026-4574 libXtst security update

X.Org X11 libXtst runtime library Security Fixes: X.Org reports: Multiple issues have been found in the X client library implementations published by X.Org for which we are releasing security fixes for.CVE-2026-109088...

OESA-2026-4575 libXtst security update

X.Org X11 libXtst runtime library Security Fixes: X.Org reports: Multiple issues have been found in the X client library implementations published by X.Org for which we are releasing security fixes for.CVE-2026-109088...

OESA-2026-4573 libXtst security update

X.Org X11 libXtst runtime library Security Fixes: X.Org reports: Multiple issues have been found in the X client library implementations published by X.Org for which we are releasing security fixes for.CVE-2026-109088...

OESA-2026-4572 libXtst security update

X.Org X11 libXtst runtime library Security Fixes: X.Org reports: Multiple issues have been found in the X client library implementations published by X.Org for which we are releasing security fixes for.CVE-2026-109088...

NashaVM

NashaVM - Native Sharp Virtual Machine Nasha is a Virtual Machine for .NET files and its runtime was made in C++/CLI Installation git clone https://github.com/Mrakovic-ORG/NashaVM --recurse cd NashaVM\NashaVM nuget restore msbuild Dependencies dnlib .NET Framework Visual C++ Redistrutable FAQ Wha...

CVE-2026-19610 Wildfly-platform-mbean: wildfly-platform-mbean: rbac sensitive attribute read bypass for platform runtimemxbean

A flaw was found in the platform-mbean component of JBoss EAP, which provides management access to JVM-level metrics and configurations. The issue occurs because the handler for the read-resource operation on the runtime management resource fails to perform required Role-Based Access Control RBAC...

CVE-2026-19610

A flaw exists in the platform-mbean component of JBoss EAP , which manages JVM-level metrics and configurations. The vulnerability stems from a failure to perform required Role-Based Access Control (RBAC) checks during the read-resource operation on the runtime management resource. This oversight...

CVE-2026-19610 Wildfly-platform-mbean: wildfly-platform-mbean: rbac sensitive attribute read bypass for platform runtimemxbean

A flaw was found in the platform-mbean component of JBoss EAP, which provides management access to JVM-level metrics and configurations. The issue occurs because the handler for the read-resource operation on the runtime management resource fails to perform required Role-Based Access Control RBAC...

Bytecode Alliance wasmtime race condition vulnerability

Bytecode Alliance has identified a race condition vulnerability in versions prior to 42.0.0 through 48.0.6 and 49.0.0 through 49.0.3. This issue arises due to insufficient validation by Store when handling WebAssembly calls that mix asynchronous and synchronous styles. When the embedded runtime...

DualGuard: Comprehensive and Efficient Memory Safety across Sequential and Speculative Execution

Although decades of research have yielded sophisticated mechanisms for enforcing memory safety, speculative execution can subvert these protections through transient memory operations. Conversely, defenses designed specifically for speculative safety, such as Speculative Load Hardening SLH, canno...

PT-2026-132418

An unvalidated runtime configuration value in Apache CouchDB 3.5.2 and below on all platforms allows a CouchDB server admin to run arbitrary shell commands as the CouchDB operating system user. Users are recommended to upgrade to version 3.5.3, which fixes this issue...

CVE-2026-119136: bytecodealliance wasmtime: Wasmtime 42.0.0 before 48.0.6 and 49.0.0 before 49.0.3 contains insufficient checks in Store when mixing async-style…

Wasmtime 42.0.0 before 48.0.6 and 49.0.0 before 49.0.3 contains insufficient checks in Store when mixing async-style and sync-style WebAssembly calls. Embedders re-entering WebAssembly via sync APIs from host functions called asynchronously can trigger runtime panics or unsound cross-thread...