EUVD-2026-81605

vm2 sandbox escape via WebAssembly.compileStreaming Promise species bypass...

Astra Linux – Vulnerability in Firefox, Thunderbird

The WebAssembly JIT might miscalculate the size of a return type, which could lead to a null read and result in a crash. Note: This issue only affected x86-32 platforms. Other platforms are unaffected.. This vulnerability affects Firefox ESR 78.10, Thunderbird 78.10, and Firefox 88...

Astra Linux – Vulnerability in Firefox and Thunderbird

Inconsistent data in the instruction and data cache when creating Wasm code can lead to a potentially exploitable crash.This bug only affects Firefox on ARM64 platforms.. This vulnerability affects Firefox ESR 102.3, Thunderbird 102.3, and Firefox 105...

Astra Linux – Vulnerability in Firefox and Thunderbird

Incorrect boundary conditions in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox 145, Firefox ESR 140.5, Thunderbird 145, and Thunderbird 140.5...

CVE-2026-104855

A flaw was found in wasmtime. Execution preemption checks during bulk operations can expose an invalid intermediate state if an application mutates or continues using the execution store after a cancellation or trap. Under these conditions, an attacker executing WebAssembly code can cause memory...

Mis-typed WebAssembly tag imports can lead to GC heap corruption

This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-cfhf-m2cr-62wj For more information see the GitHub-hosted security advisory...

RUSTSEC-2026-0325 Mis-typed WebAssembly tag imports can lead to GC heap corruption

This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-cfhf-m2cr-62wj For more information see the GitHub-hosted security advisory...

Rocky Linux 8 [CIQ] Security Update: firefox / firefox-debuginfo / firefox-debugsource Multiple Vulnerabilities (crlsa-2025_1283)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20251283 advisory. firefox: thunderbird: Memory safety bugs fixed in Firefox 135, Thunderbird 135, Firefox ESR 128.7, and Thunderbird 128.7 CVE-2025-1017 firefox: thunderbird...

AlmaLinux 9.2 [TuxCare] Security Update: nodejs / nodejs-devel / nodejs-docs / nodejs-full-i18n / etc (ALMALINUX9.2:CLSA-2025:1762361695)

The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2025:1762361695 advisory. - Maliciously crafted export names in an imported WebAssembly module can inject JavaScript code. The injected code may be able to access data...

Rocky Linux 8 [CIQ] Security Update: firefox / firefox-debuginfo / firefox-debugsource Multiple Vulnerabilities (crlsa-2024_5391)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20245391 advisory. Firefox: 115.14/128.1 ESR mozilla: Fullscreen notification dialog can be obscured by document content CVE-2024-7518 mozilla: Out of bounds memory access in...

AlmaLinux 9.2 [TuxCare] Security Update: thunderbird Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2026:1781204847)

The AlmaLinux 9.2 host has a package installed that is affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1781204847 advisory. - Invalid pointer in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox 150, Firefox ESR 140.10,...

Linux Distros Unpatched Vulnerability : CVE-2026-100796

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Use-after-free in the JavaScript: WebAssembly component. This vulnerability was fixed in Thunderbird 157 and Firefox 157. CVE-2026-100796 Note that Nessus relie...

Linux Distros Unpatched Vulnerability : CVE-2026-100817

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Other issue in the JavaScript: WebAssembly component. This vulnerability was fixed in Thunderbird 157 and Firefox 157. CVE-2026-100817 Note that Nessus relies o...

CVE-2026-92956

A flaw was found in vm2. When running untrusted code within a sandbox, improper isolation in WebAssembly streaming functions allows host error objects to leak into the sandbox environment. An attacker capable of running code inside the sandbox can exploit this flaw to escape sandbox containment a...

Linux Distros Unpatched Vulnerability : CVE-2026-100769

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Use-after-free in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird...

Linux Distros Unpatched Vulnerability : CVE-2026-100776

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Use-after-free in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird...

Linux Distros Unpatched Vulnerability : CVE-2026-100788

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Invalid pointer in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird...

Linux Distros Unpatched Vulnerability : CVE-2026-100792

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - JIT miscompilation in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird...

AlmaLinux 9.6 [TuxCare] Security Update: nodejs / nodejs-devel / nodejs-docs / nodejs-full-i18n / etc Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1772617597)

The AlmaLinux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1772617597 advisory. - Maliciously crafted export names in an imported WebAssembly module can inject JavaScript code. The injected code may be able to...

Rocky Linux 9.6 [TuxCare] Security Update: nodejs / nodejs-devel / nodejs-docs / nodejs-full-i18n / etc Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1772617597)

The Rocky Linux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1772617597 advisory. - Maliciously crafted export names in an imported WebAssembly module can inject JavaScript code. The injected code may be able to...