CVE-2026-58494 Wasmtime: WASI hard links bypass wasmtime-wasi's FilePerms for destination

Wasmtime is a runtime for WebAssembly. Prior to 24.0.11, 36.0.12, 45.0.3, and 46.0.1, wasmtime-wasi hard-link creation and renaming check directory permissions but not matching FilePerms on source and destination preopens, allowing a WASI guest with a read-only source file capability to overwrite...

CVE-2026-58494 Wasmtime: WASI hard links bypass wasmtime-wasi's FilePerms for destination

Wasmtime is a runtime for WebAssembly. Prior to 24.0.11, 36.0.12, 45.0.3, and 46.0.1, wasmtime-wasi hard-link creation and renaming check directory permissions but not matching FilePerms on source and destination preopens, allowing a WASI guest with a read-only source file capability to overwrite...

CVE-2026-58494

Wasmtime is a runtime for WebAssembly. Prior to 24.0.11, 36.0.12, 45.0.3, and 46.0.1, wasmtime-wasi hard-link creation and renaming check directory permissions but not matching FilePerms on source and destination preopens, allowing a WASI guest with a read-only source file capability to overwrite...

CVE-2026-58494

Wasmtime is a runtime for WebAssembly. Prior to 24.0.11, 36.0.12, 45.0.3, and 46.0.1, wasmtime-wasi hard-link creation and renaming check directory permissions but not matching FilePerms on source and destination preopens, allowing a WASI guest with a read-only source file capability to overwrite...

CVE-2026-58494 Wasmtime: WASI hard links bypass wasmtime-wasi's FilePerms for destination

Wasmtime is a runtime for WebAssembly. Prior to 24.0.11, 36.0.12, 45.0.3, and 46.0.1, wasmtime-wasi hard-link creation and renaming check directory permissions but not matching FilePerms on source and destination preopens, allowing a WASI guest with a read-only source file capability to overwrite...

UBUNTU-CVE-2026-55404

yt-dlp and youtube-dl are command-line audio/video downloaders. Prior to 2026.7.4, the --write-link, --write-url-link, and --write-desktop-link options can write .url or .desktop shortcut files using attacker-controlled webpageurl or filename metadata without sufficient validation or escaping,...

CVE-2026-59929

creationtimestamp| type| source ---|---|--- 2026-07-08 20:05:41+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mq5w64e2ij2q 2026-07-20 22:35:21+00:00| published-proof-of-concept| https://github.com/lepture/mistune/security/advisories/GHSA-qfrw-5rxm-mhh2...

CVE-2026-59890

creationtimestamp| type| source ---|---|--- 2026-07-08 19:55:40+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mq5vm6vmlj2i 2026-07-21 20:35:09+00:00| published-proof-of-concept| https://github.com/advisories/GHSA-h35f-9h28-mq5c 2026-07-22 12:00:52+00:00| seen|...

CVE-2026-59882

creationtimestamp| type| source ---|---|--- 2026-07-08 19:40:39+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mq5urdn5uw2z...

CVE-2026-55404 yt-dlp: Downstream command injection via improper sanitization of yt-dlp --write-link output

yt-dlp and youtube-dl are command-line audio/video downloaders. Prior to 2026.7.4, the --write-link, --write-url-link, and --write-desktop-link options can write .url or .desktop shortcut files using attacker-controlled webpageurl or filename metadata without sufficient validation or escaping,...

CVE-2026-55404

YT-dlp and YouTube-dl before 2026.7.4 expose a vulnerability through --write-link, --write-url-link, and --write-desktop-link that can write .url/.desktop shortcuts using attacker-controlled metadata, enabling file:// URI or desktop entry key injection and potential command execution when opened....

CVE-2026-55404 yt-dlp: Downstream command injection via improper sanitization of yt-dlp --write-link output

yt-dlp and youtube-dl are command-line audio/video downloaders. Prior to 2026.7.4, the --write-link, --write-url-link, and --write-desktop-link options can write .url or .desktop shortcut files using attacker-controlled webpageurl or filename metadata without sufficient validation or escaping,...

CVE-2026-55404 yt-dlp: Downstream command injection via improper sanitization of yt-dlp --write-link output

yt-dlp and youtube-dl are command-line audio/video downloaders. Prior to 2026.7.4, the --write-link, --write-url-link, and --write-desktop-link options can write .url or .desktop shortcut files using attacker-controlled webpageurl or filename metadata without sufficient validation or escaping,...

CVE-2026-55404

yt-dlp and youtube-dl are command-line audio/video downloaders. Prior to 2026.7.4, the --write-link, --write-url-link, and --write-desktop-link options can write .url or .desktop shortcut files using attacker-controlled webpageurl or filename metadata without sufficient validation or escaping,...

CVE-2026-59922

creationtimestamp| type| source ---|---|--- 2026-07-08 19:36:21+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mq5ujo2lbl2q 2026-07-20 22:35:27+00:00| published-proof-of-concept| https://github.com/lepture/mistune/security/advisories/GHSA-c8j7-8cv4-2xmq...

CVE-2026-59926

creationtimestamp| type| source ---|---|--- 2026-07-08 19:32:36+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mq5ucwsjg62g...

CVE-2026-59883

creationtimestamp| type| source ---|---|--- 2026-07-08 19:23:30+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mq5tsoicmx2x 2026-07-13 17:48:40+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqkatpltbc2e 2026-07-16 08:03:53+00:00| seen|...

CVE-2026-59887

creationtimestamp| type| source ---|---|--- 2026-07-08 19:21:00+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mq5to6wxdf2t 2026-07-09 05:02:17+00:00| seen| https://bsky.app/profile/hugovalters.bsky.social/post/3mq6u5ij4ws2n 2026-07-21 20:35:13+00:00| published-proof-of-concept|...

CVE-2026-0278

creationtimestamp| type| source ---|---|--- 2026-07-08 19:03:37+00:00| seen| https://bsky.app/profile/ripjyr.bsky.social/post/3mq5sp4zwv22m 2026-07-10 00:15:02+00:00| seen| https://www.incibe.es/incibe-cert/alerta-temprana/vulnerabilidades/cve-2026-0278...

CVE-2026-0286

creationtimestamp| type| source ---|---|--- 2026-07-08 19:03:22+00:00| seen| https://bsky.app/profile/ripjyr.bsky.social/post/3mq5soorub227 2026-07-09 04:46:28+00:00| seen| https://www.hkcert.org/security-bulletin/palo-alto-products-multiple-vulnerabilities20260709 2026-07-09 20:59:24+00:00| seen...