Malicious Package

Overview umap-wasm is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...

Brave Desktop 1.85.111 Security Fixes

Improved IKEv2 VPN configuration parameters on Windows. - Enabled WASM Interpreter when JIT is disabled. Upgraded Chromium to 143.0.7499.40 — refer to Google Chrome advisories for inherited CVEs...

Malicious code in umap-wasm (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 92fe0d08b117ec6e7dcd48b13025326c2f427f3251c624867c9f0d398bd2dab8 The package umap-wasm was found to contain malicious code. Source: ghsa-malware a8b9419bdb44fab11a3bade4b4831308972f0fc3acfd3472c362fe672339e8ab Any...

EUVD-2025-199931

Malicious code in umap-wasm npm...

MAL-2025-191492 Malicious code in umap-wasm (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 92fe0d08b117ec6e7dcd48b13025326c2f427f3251c624867c9f0d398bd2dab8 The package umap-wasm was found to contain malicious code. Source: ghsa-malware a8b9419bdb44fab11a3bade4b4831308972f0fc3acfd3472c362fe672339e8ab Any...

CVE-2025-64713

WebAssembly Micro Runtime WAMR is a lightweight standalone WebAssembly Wasm runtime. Prior to version 2.4.4, an out-of-bounds array access issue exists in WAMR's fast interpreter mode during WASM bytecode loading. When framerefbottom and frameoffsetbottom arrays are at capacity and a GETGLOBALI32...

Out-of-bounds Read

Overview Affected versions of this package are vulnerable to Out-of-bounds Read in the preservelocalforblock function, when handling a sequence where a GETGLOBALI32 opcode is followed by an if opcode in fast interpreter mode. An attacker can cause out-of-bounds access to the frameoffsetbottom arr...

Update Firefox to Patch CVE-2025-13016 Vulnerability Affecting 180 Million Users

AI security firm AISLE revealed CVE-2025-13016, a critical Firefox Wasm bug that risked 180M users for six months. Learn how the memory flaw allowed code execution...

AlmaLinux 9 : firefox (ALSA-2025:21280)

The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2025:21280 advisory. firefox: Mitigation bypass in the DOM: Security component CVE-2025-13018 firefox: Use-after-free in the Audio/Video component CVE-2025-13014 firefox:...

AlmaLinux 10 : firefox (ALSA-2025:21281)

The remote AlmaLinux 10 host has a package installed that is affected by multiple vulnerabilities as referenced in the ALSA-2025:21281 advisory. firefox: Mitigation bypass in the DOM: Security component CVE-2025-13018 firefox: Use-after-free in the Audio/Video component CVE-2025-13014 firefox:...

EUVD-2025-198914

Malicious code in @postman/secret-scanner-wasm npm...

Mozilla Firefox ESR < 140.5

The version of Firefox ESR installed on the remote macOS or Mac OS X host is prior to 140.5. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2025-88 advisory. - Use-after-free in the WebRTC: Audio/Video component. This vulnerability affects Firefox 145 and Firefox...

Astra Linux – Vulnerability in Firefox, Thunderbird

On arm64, an WASM brtable instruction with many entries could cause the label to be too far away from the instruction, leading to truncation and incorrect computation of the branch address. This vulnerability was fixed in Firefox 141, Firefox ESR 115.26, Firefox ESR 128.13, Firefox ESR 140.1,...

GHSA-4H67-722J-5PMC Wasmtime vulnerable to segfault when using component resources

Impact The implementation of component-model related host-to-wasm trampolines in Wasmtime contained a bug where it's possible to carefully craft a component, which when called in a specific way, would crash the host with a segfault or assert failure. This bug was introduced in the release of...

EUVD-2025-35897

Wasmtime vulnerable to segfault when using component resources...

SUSE CVE-2025-61595

MANTRA is a purpose-built RWA Layer 1 Blockchain, capable of adherence to real world regulatory requirements. Versions 4.0.1 and below do not enforce the tx gas limit in its send hooks. Send hooks can spend more gas than what remains in tx, combined with recursive calls in the wasm contract,...

CVE-2025-62711

Wasmtime is a runtime for WebAssembly. In versions from 38.0.0 to before 38.0.3, the implementation of component-model related host-to-wasm trampolines in Wasmtime contained a bug where it's possible to carefully craft a component, which when called in a specific way, would crash the host with a...

CVE-2025-62711 Wasmtime vulnerable to segfault when using component resources

Wasmtime is a runtime for WebAssembly. In versions from 38.0.0 to before 38.0.3, the implementation of component-model related host-to-wasm trampolines in Wasmtime contained a bug where it's possible to carefully craft a component, which when called in a specific way, would crash the host with a...

CVE-2025-62711 Wasmtime vulnerable to segfault when using component resources

Wasmtime is a runtime for WebAssembly. In versions from 38.0.0 to before 38.0.3, the implementation of component-model related host-to-wasm trampolines in Wasmtime contained a bug where it's possible to carefully craft a component, which when called in a specific way, would crash the host with a...

CVE-2025-62711

Wasmtime is a runtime for WebAssembly. In versions from 38.0.0 to before 38.0.3, the implementation of component-model related host-to-wasm trampolines in Wasmtime contained a bug where it's possible to carefully craft a component, which when called in a specific way, would crash the host with a...