amaranth-yosys (0.50.0.0.post120), cat-agent (>=0.1.1, <=0.5.1) +4 more potentially affected by CVE-2026-34983 via wasmtime (41.0.0)

wasmtime PYPI version 41.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on wasmtime and may be impacted: - amaranth-yosys 0.50.0.0.post120 - cat-agent =0.1.1, =0.28.0, =0.0.24, =0.0.25rc1 - yowasp-runtime 1.84.0 Source cves: CVE-2026-34983 Source...

amaranth-yosys (>=0.25.0.0.post61, <=0.25.0.0.post67), yowasp-runtime (>=1.7.0, <=1.12.0) potentially affected by CVE-2026-34983 via wasmtime (5.0.0)

wasmtime PYPI version 5.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on wasmtime and may be impacted: - amaranth-yosys =0.25.0.0.post61, =1.7.0, =1.12.0 Source cves: CVE-2026-34983 Source advisory: OSV:PYSEC-2026-151...

amaranth-yosys (0.25.0.0.post70), yowasp-runtime (1.19.0) potentially affected by CVE-2026-34983 via wasmtime (7.0.0)

wasmtime PYPI version 7.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on wasmtime and may be impacted: - amaranth-yosys 0.25.0.0.post70 - yowasp-runtime 1.19.0 Source cves: CVE-2026-34983 Source advisory: OSV:PYSEC-2026-151...

amaranth-yosys (0.25.0.0.post71), yowasp-runtime (>=1.20.0, <=1.21.0) potentially affected by CVE-2026-34983 via wasmtime (8.0.1)

wasmtime PYPI version 8.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on wasmtime and may be impacted: - amaranth-yosys 0.25.0.0.post71 - yowasp-runtime =1.20.0, =1.21.0 Source cves: CVE-2026-34983 Source advisory: OSV:PYSEC-2026-151...

CVE-2026-34943

Wasmtime is a runtime for WebAssembly. Prior to 24.0.7, 36.0.7, 42.0.2, and 43.0.1, Wasmtime contains a possible panic which can happen when a flags-typed component model value is lifted with the Val type. If bits are set outside of the set of flags the component model specifies that these bits...

CVE-2026-34983

Wasmtime is a runtime for WebAssembly. In 43.0.0, cloning a wasmtime::Linker is unsound and can result in use-after-free bugs. This bug is not controllable by guest Wasm programs. It can only be triggered by a specific sequence of embedder API calls made by the host. Specifically, the following...

CVE-2026-34971

Wasmtime is a runtime for WebAssembly. From 32.0.0 to before 36.0.7, 42.0.2, and 43.0.1, Wasmtime's Cranelift compilation backend contains a bug on aarch64 when performing a certain shape of heap accesses which means that the wrong address is accessed. When combined with explicit bounds checks a...

CVE-2026-35195

Wasmtime is a runtime for WebAssembly. Prior to 24.0.7, 36.0.7, 42.0.2, and 43.0.1, Wasmtime's implementation of transcoding strings between components contains a bug where the return value of a guest component's realloc is not validated before the host attempts to write through the pointer. This...

CVE-2026-35186

Wasmtime is a runtime for WebAssembly. From 25.0.0 to before 36.0.7, 42.0.2, and 43.0.1, Wasmtime's Winch compiler backend contains a bug where translating the table.grow operator causes the result to be incorrectly typed. For 32-bit tables this means that the result of the operator, internally i...

CVE-2026-34988

Wasmtime is a runtime for WebAssembly. From 28.0.0 to before 36.0.7, 42.0.2, and 43.0.1, Wasmtime's implementation of its pooling allocator contains a bug where in certain configurations the contents of linear memory can be leaked from one instance to the next. The implementation of resetting the...

CVE-2026-34983

Wasmtime is a runtime for WebAssembly. In 43.0.0, cloning a wasmtime::Linker is unsound and can result in use-after-free bugs. This bug is not controllable by guest Wasm programs. It can only be triggered by a specific sequence of embedder API calls made by the host. Specifically, the following...

CVE-2026-34983

Wasmtime is a runtime for WebAssembly. In 43.0.0, cloning a wasmtime::Linker is unsound and can result in use-after-free bugs. This bug is not controllable by guest Wasm programs. It can only be triggered by a specific sequence of embedder API calls made by the host. Specifically, the following...

CVE-2026-34944 Wasmtime segfault or unused out-of-sandbox load with `f64x2.splat` operator on x86-64

Wasmtime is a runtime for WebAssembly. Prior to 24.0.7, 36.0.7, 42.0.2, and 43.0.1, On x86-64 platforms with SSE3 disabled Wasmtime's compilation of the f64x2.splat WebAssembly instruction with Cranelift may load 8 more bytes than is necessary. When signals-based-traps are disabled this can resul...

CVE-2026-34942 Wasmtime panics when transcoding misaligned utf-16 strings

Wasmtime is a runtime for WebAssembly. Prior to 24.0.7, 36.0.7, 42.0.2, and 43.0.1, Wasmtime's implementation of transcoding strings into the Component Model's utf16 or latin1+utf16 encodings improperly verified the alignment of reallocated strings. This meant that unaligned pointers could be...

CVE-2026-34941

Wasmtime (WebAssembly runtime) contains a heap OOB read during transcoding of UTF-16 to the latin1+utf16 component-model encoding. The bug stems from validating the input length by code units instead of by byte length, causing reads beyond the WebAssembly linear memory during bounds checking. In ...

GHSA-4F8G-77MW-3RXC OpenClaw: Gateway plugin HTTP `auth: gateway` widens identity-bearing `operator.read` requests into runtime `operator.write`

Impact Gateway plugin HTTP auth: gateway widens identity-bearing operator.read requests into runtime operator.write. Plugin HTTP routes using gateway auth could receive runtime write scopes even when the upstream trusted-proxy request only declared read. OpenClaw is a user-controlled local...

Node.js: Node.js: Denial of Service due to crafted HTTP `__proto__` header

A flaw was found in Node.js. A remote attacker can exploit this vulnerability by sending a specially crafted HTTP request that includes a header named proto. When a Node.js application processes this request and attempts to access distinct headers, it encounters an unhandled error, leading to an...

PT-2026-31719

Name of the Vulnerable Software and Affected Versions versions not specified Description A remote attacker with low privileges can manipulate Modbus register values used in odorant injection logic, potentially causing over or under-injection of odorant into a gas line. Attackers have exploited th...

OpenPLC Runtime Version 3 security vulnerabilities

OpenPLC Runtime version 3 is a programmable logic controller developed by Thiago Alves. There is a security vulnerability in OpenPLC Runtime version 3, which stems from the use of unsafe default values during resource initialization. This vulnerability could allow attackers to access the system...

OpenPLC Runtime Version 3 security vulnerabilities

OpenPLC Runtime version 3 is a programmable logic controller developed by Thiago Alves. There is a security vulnerability in OpenPLC Runtime version 3. This vulnerability stems from the REST API endpoints only checking the existence of JWTs without verifying the caller’s role. This could allow...