wasm2c-tableflip

wasm2c sandbox escape: guest module runs a shell command on the host Read the blog: trustsig.eu/blog wasmrtallocatefuncreftable in wasm2c/wasm-rt-impl-tableops.inc sets table-size from the module's declared element count and then ignores the result of calloc. When the allocation fails the table i...

Important: Red Hat Security Advisory: flatpak-builder security update

An update for flatpak-builder is now available for Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support and Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On. Red Hat Product Security has rated this update as having a security impact of Important. A Common...

Exploit for CVE-2026-115893

CVE-2026-115893: Wasmtime aarch64 Sandbox Escape A working fu...

GHSA-834V-8H66-3H79 Happy DOM: Incomplete fix for CVE-2026-33943: unsanitized import alias leads to host code execution

Summary The ESM compiler in [email protected] does not validate imported local binding aliases before interpolating them into generated JavaScript. As a result, an invalid ESM import alias can be transformed into a valid JavaScript destructuring default initializer and executed. This appears to b...

npm: Happy DOM: Incomplete fix for CVE-2026-33943: unsanitized import alias leads to host code execution

npm: Happy DOM: Incomplete fix for CVE-2026-33943: unsanitized import alias leads to host code execution vulnerability discovered by ? in WordPress npm happy-dom versions = 17.0.0, = 21.0.3...

Happy DOM: Incomplete fix for CVE-2026-33943: unsanitized import alias leads to host code execution

Summary The ESM compiler in [email protected] does not validate imported local binding aliases before interpolating them into generated JavaScript. As a result, an invalid ESM import alias can be transformed into a valid JavaScript destructuring default initializer and executed. This appears to b...

CVE-2026-115895

The happy-dom library (versions 17.0.0 through 21.0.4 ) is vulnerable to host code execution due to an incomplete fix for CVE-2026-33943. The flaw exists in packages/happy-dom/src/module/ECMAScriptModuleCompiler.ts, where the compiler fails to validate named ESM import aliases before inserting th...

CVE-2026-115895 Happy DOM: Incomplete fix for CVE-2026-33943: unsanitized import alias leads to host code execution

Happy DOM is a JavaScript implementation of a web browser without its graphical user interface. From 17.0.0 until 21.0.4, packages/happy-dom/src/module/ECMAScriptModuleCompiler.ts accepts a named ESM import alias without validating that it is a JavaScript binding identifier before inserting it in...

CVE-2026-115895 Happy DOM: Incomplete fix for CVE-2026-33943: unsanitized import alias leads to host code execution

Happy DOM is a JavaScript implementation of a web browser without its graphical user interface. From 17.0.0 until 21.0.4, packages/happy-dom/src/module/ECMAScriptModuleCompiler.ts accepts a named ESM import alias without validating that it is a JavaScript binding identifier before inserting it in...

CVE-2026-112049

Vita3K before build 4187 contains a path traversal zip slip vulnerability in installarchivecontent that allows attackers to write files outside the install directory via crafted .vpk archives. Attackers can embed '..' segments or absolute paths in zip entry names to write attacker-controlled file...

CVE-2026-112049

Vita3K before build 4187 contains a path traversal zip slip vulnerability in installarchivecontent that allows attackers to write files outside the install directory via crafted .vpk archives. Attackers can embed '..' segments or absolute paths in zip entry names to write attacker-controlled file...

EUVD-2026-103511

Vita3K before build 4187 contains a path traversal zip slip vulnerability in installarchivecontent that allows attackers to write files outside the install directory via crafted .vpk archives. Attackers can embed '..' segments or absolute paths in zip entry names to write attacker-controlled file...

CVE-2026-112049 Vita3K before build 4187 Path Traversal via VPK Package Installation

Vita3K before build 4187 contains a path traversal zip slip vulnerability in installarchivecontent that allows attackers to write files outside the install directory via crafted .vpk archives. Attackers can embed '..' segments or absolute paths in zip entry names to write attacker-controlled file...

CVE-2026-112049: Improper Limitation of a Pathname to a Restricted Directory

Vita3K before build 4187 contains a path traversal zip slip vulnerability in installarchivecontent that allows attackers to write files outside the install directory via crafted .vpk archives. Attackers can embed '..' segments or absolute paths in zip entry names to write attacker-controlled file...

PT-2026-116632

Vita3K before build 4187 contains a path traversal zip slip vulnerability in install archive content that allows attackers to write files outside the install directory via crafted .vpk archives. Attackers can embed '..' segments or absolute paths in zip entry names to write attacker-controlled...

flatpak-builder security update

An update is available for flatpak-builder. This update affects Rocky Linux 10. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list Flatpak-builder is a tool for building flatpaks from sources. Securi...

flatpak-builder: Host code execution via `git am` hook execution in patch source extraction (`use-git-am`)

A flaw was found in flatpak-builder where Git hooks are not disabled when applying patch sources with use-git-am: true. An attacker who can provide a malicious source containing a Git post-applypatch hook can cause the hook to execute on the host during the build process, resulting in arbitrary...

ALSA-2026:80973 Important: flatpak-builder security update

Flatpak-builder is a tool for building flatpaks from sources. Security Fixes: flatpak-builder: Host code execution via git am hook execution in patch source extraction use-git-am CVE-2026-86320 For more details about the security issues, including the impact, a CVSS score, acknowledgments, and...

EulerOS 2.0 SP11 : kata-containers (EulerOS-SA-2026-4330)

According to the versions of the kata-containers package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : Kata Containers is an open source project focusing on a standard implementation of lightweight Virtual Machines VMs that perform like...

EulerOS 2.0 SP13 : kata-containers (EulerOS-SA-2026-4146)

According to the versions of the kata-containers package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : Kata Containers is an open source project focusing on a standard implementation of lightweight Virtual Machines VMs that perform like...