Zero-Day & Vulnerability Intelligence Hub
Echtzeit-Tracking mit EPSS Exploit-Wahrscheinlichkeiten, Angriffsvektor-Decodern und KI-Patch-Anleitungen.
📊 Historien-Charts — Criticals-Trend · Vendors · EPSS-Verteilung
| Tier | CVEs | Anteil |
|---|---|---|
| ≥90 % | 725 | 0,2 % |
| ≥50 % | 3.222 | 0,9 % |
| ≥10 % | 22.088 | 5,9 % |
| <10 % | 347.069 | 93,0 % |
PHP2Shell: gescheiterte RCE-Versuche treiben Mirai-Fork Potassium an
LONDON (IT BOLTWISE) – Angreifer versuchen vergeblich, die neu offengelegten PHP2Shell-Lücken (CVE-2026-109618 und -109619) für Remote Code Execution auszunutzen und damit eine Mirai-nahe Botnet-Variante namens Potassium zu betreiben. Laut
Node.js RCE über Brotli: Sicherheitslücke in gepackten Build-Images behebt
LONDON (IT BOLTWISE) – Sicherheitsforscher zeigen, dass manipulierte Brotli-Daten auf einem offiziellen Node.js-Build Codeausführung auslösen können. Der Auslöser steckt im eingebundenen Brotli-Decoder und betrifft Node.js 22.x, 24.x und 26
CVE-2025-9802 | RemoteClinic 2.0 /staff/profile.php id sql injection (EUVD-2025-26366)
A vulnerability was found in RemoteClinic 2.0 and classified as critical. This vulnerability affects unknown code of the file /staff/profile.php. The manipulation of the argument ID results in sql injection. This vulnerability is identified
CVE-2025-9799 | Langfuse up to 3.88.0 Webhook promptRouter.ts promptChangeEventSourcing server-side request forgery (Issue 8522 / EUVD-2025-26361)
A vulnerability, which was classified as critical, has been found in Langfuse up to 3.88.0. Affected by this vulnerability is the function promptChangeEventSourcing of the file web/src/features/prompts/server/routers/promptRouter.ts of the
CVE-2025-9775 | RemoteClinic up to 2.0 edit-my-profile.php image unrestricted upload (EUVD-2025-26337)
A vulnerability was found in RemoteClinic up to 2.0 and classified as critical. Impacted is an unknown function of the file /staff/edit-my-profile.php. The manipulation of the argument image results in unrestricted upload. This vulnerabilit
CVE-2025-9774 | RemoteClinic up to 2.0 edit-patient.php Email information disclosure (EUVD-2025-26338)
A vulnerability has been found in RemoteClinic up to 2.0 and classified as problematic. This issue affects some unknown processing of the file /patients/edit-patient.php. The manipulation of the argument Email leads to information disclosur
CVE-2025-9773 | RemoteClinic up to 2.0 /staff/edit.php Last Name cross site scripting (EUVD-2025-26335)
A vulnerability, which was classified as problematic, was found in RemoteClinic up to 2.0. This vulnerability affects unknown code of the file /staff/edit.php. Executing a manipulation of the argument Last Name can lead to cross site script
CVE-2025-8662 | OpenAM Consortium Edition 14.0.0/14.0.1 SAML IdP denial of service
A vulnerability was found in OpenAM Consortium Edition 14.0.0/14.0.1. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the component SAML IdP Handler. The manipulation results in denial of s
CVE-2025-58162 | MobSF Mobile-Security-Framework-MobSF 4.4.0 path traversal (GHSA-9gh8-9r95-3fc3 / EUVD-2025-26368)
A vulnerability was found in MobSF Mobile-Security-Framework-MobSF 4.4.0. It has been classified as critical. Affected is an unknown function. The manipulation leads to path traversal. This vulnerability is referenced as CVE-2025-58162. Rem
CVE-2025-58161 | MobSF Mobile-Security-Framework-MobSF 4.4.0 Download File /download/ os.path.commonprefix path traversal (GHSA-ccc3-fvfx-mw3v / EUVD-2025-26369)
A vulnerability was found in MobSF Mobile-Security-Framework-MobSF 4.4.0 and classified as critical. This impacts the function os.path.commonprefix of the file /download/ of the component Download File Handler. Executing a manipulation can
CVE-2025-57808 | ESPHome 2025.8.0 web_server incorrect implementation of authentication algorithm (GHSA-mxh2-ccgj-8635)
A vulnerability has been found in ESPHome 2025.8.0 and classified as critical. This affects an unknown function of the component web_server. Performing a manipulation results in incorrect implementation of authentication algorithm. This vul
CVE-2019-5645 | Rapid7 Metasploit Framework HTTP Regular Expression resource consumption
A vulnerability, which was classified as problematic, was found in Rapid7 Metasploit Framework. The affected element is an unknown function of the component HTTP Handler. Executing a manipulation as part of Regular Expression can lead to re
Hackers Exploit Critical Citrix NetScaler RCE Flaw to Deploy Web Shells and Malware
A critical flaw in Citrix NetScaler ADC and NetScaler Gateway is being used to run commands on exposed appliances, install web shells and deliver malware. Tracked as CVE-2026-88771, the vulnerability stems from improper input validation and
CVE-2024-26503 | Greek Universities Network Open eClass up to 3.15 File certbadge.php unrestricted upload (EDB-52698)
A vulnerability was found in Greek Universities Network Open eClass up to 3.15. It has been classified as critical. Impacted is an unknown function of the file certbadge.php of the component File Handler. The manipulation leads to unrestric
PHP: Fragen und Antworten zur Sicherheitslücke - rbb24
"Server übernehmen" - heißt hier: Hacker könnten Seiten manipulieren und die Daten für ihre Zwecke nutzen oder einfach nur Schäden und Verwirrung ... Weiterlesen
Critical Fortinet FortiSIEM Flaw (CVE-2026-106173) Public Exploit Released
HOC Shorts | Security agencies issued urgent advisories for a CVSS 9.8 critical vulnerability (`CVE-2026-106173`) impacting Fortinet FortiSIEM,… This article has been indexed from Hackers Online Club Read the original article: Critical For
Hackerangriff nach PHP-Sicherheitslücke: So ist München betroffen
Als besonders knifflig erwies es sich offenbar, sicherzustellen, dass Hacker keine angriffsbereite Software in den IT-Systemen der Stadt hinterlassen ... Weiterlesen
Oracle Patches Critical Java Security Flaw That Could Allow Hackers to Steal Data
Oracle released emergency Java security updates to address CVE-2026-91403, a critical vulnerability that could expose sensitive information and undermine data integrity. Published on October 21, 2026, the advisory assigns the flaw a CVSS 3.
CVE-2026-115416 – Incorrect authorization checks in Amazon Athena engine version 3 query processing
Bulletin ID: 2026-144-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 10/22/2026 09:30 AM PDT Description: Amazon Athena is an interactive query service that allows you to analyze data in Amazon S3 using standa
CVE-2026-112408 – Missing bucket ownership verification in Amazon SageMaker Python SDK default_bucket()
Bulletin ID: 2026-142-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 10/21/2026 12:30 PM PDT Description: The Amazon SageMaker Python SDK is an open-source library for training and deploying machine learning m
CVE-2026-115414 – OS Command Injection Issue in SAM CLI Terraform Hook
Bulletin ID: 2026-145-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 10/22/2026 11:30 AM PDT Description: AWS SAM CLI is an open-source framework for building serverless applications. We identified CVE-2026-11
Spionageakteur nutzt Zero Day in Beyondtrust Remote Support aus
Beyondtrust hat eine kritische Schwachstelle in Remote Support gepatcht, die laut Hersteller als Zero Day ausgenutzt wurde. Dahinter steckt mutmaßlich ein chinesischer Spionageakteur. Wer Remote Support selbst betreibt, sollte sofort patc
Sicherheitslücke der Programmiersprache PHP führt weltweit zu Problemen | tagesschau.de
... 22.10.2026 • 22:15 Uhr. schnell informiert · Sicherheitslücke · Internet · Hacker · weltweit · Facebook · WhatsApp; Teilen; Mail; Drucken. Zur ... Weiterlesen
CVE-2026-54631 | Part-DB is an open source inventory management system for electronic components. Prior to version 2.12.1, the file .env committed in the Part-DB repository contains a fixed value for APP_SECRET (a03498528f5a5fc089273ec9ae5b2849). The official Docker image jbtronics/part-db1 does not override or randomize this value at container start-up. Because Symfony uses APP_SECRET (via kernel.secret) as the HMAC key for signing remember-me cookies, any attacker who knows
Part-DB is an open source inventory management system for electronic components. Prior to version 2.12.1, the file .env committed in the Part-DB repository contains a fixed value for APP_SECRET (a03498528f5a5fc089273ec9ae5b2849). The offici
CVE-2026-54630 | Part-DB is an open source inventory management system for electronic components. Prior to version 2.12.1, the part attachment upload handler stores uploaded files under the web-served media directory using the client-supplied file extension, and its extension blocklist does not include phar. AttachmentSubmitHandler::renameBlacklistedExtensions() rewrites dangerous extensions (php, phtml, sh, cgi, py, js, html, htaccess, ...) to .txt, but phar is absent from t
Part-DB is an open source inventory management system for electronic components. Prior to version 2.12.1, the part attachment upload handler stores uploaded files under the web-served media directory using the client-supplied file extension
CVE-2026-54615 | Part-DB is an open source inventory management system for electronic components. Prior to version 2.12.1, LogEntryExtraFormatter builds the HTML shown in the "Extra" column of the activity-log table (/log) and in element history tables. Every branch of LogEntryExtraFormatter::getInternalFormat() runs user-controlled strings through htmlspecialchars() before placing them into the HTML it returns — except the CollectionElementDeleted branch, which interpolates
Part-DB is an open source inventory management system for electronic components. Prior to version 2.12.1, LogEntryExtraFormatter builds the HTML shown in the "Extra" column of the activity-log table (/log) and in element history tables. Eve
CVE-2026-115638 | OpenStack Ironic through 39.0.1 allows a denial of service via a configdrive that results in a very large amount of uncompressed data, aka a gzip bomb.
OpenStack Ironic through 39.0.1 allows a denial of service via a configdrive that results in a very large amount of uncompressed data, aka a gzip bomb.
PHP-Sicherheitslücke: Wie KI zur Gefahr für Websites wird - RND
Hacker können Websites übernehmen. Grund für den Internet ... Entdecken Hacker mit bösen Absichten eine solche Lücke mithilfe von ChatGPT ... Weiterlesen
CVE-2026-115547 | An input validation issue in the Okta Access Gateway (OAG) Admin Console allows the processing of specially formatted configuration values. An authenticated administrator can leverage this to execute system commands within the context of the OAG service account.
An input validation issue in the Okta Access Gateway (OAG) Admin Console allows the processing of specially formatted configuration values. An authenticated administrator can leverage this to execute system commands within the context of th
CVE-2026-115546 | Okta Access Gateway (OAG) does not validate the selected authentication source during sign-on. An authenticated user with an active session can modify the authentication source parameter, which may generate a SAML assertion granting access to the Admin Console.
Okta Access Gateway (OAG) does not validate the selected authentication source during sign-on. An authenticated user with an active session can modify the authentication source parameter, which may generate a SAML assertion granting access
Sicherheitslücke im Internet: „Millionen“ Hacker-Versuche: Viele Webseiten wieder online
Sicherheitslücke im Internet: „Millionen“ Hacker-Versuche: Viele Webseiten wieder online. Millionen automatisierte Angriffsversuche, während ... Weiterlesen
CVE-2026-115537 | A weakness has been identified in gedelumbung HospitalManagement up to c2d45543789a3887067d3915f69d44cfc2cf76a8. This affects the function simpan of the file application/modules/admin/controllers/routing_pages.php of the component URL Validation. This manipulation of the argument url_route causes open redirect. It is possible to initiate the attack remotely. The exploit has been made available to the public and could be used for attacks. This product is usin
A weakness has been identified in gedelumbung HospitalManagement up to c2d45543789a3887067d3915f69d44cfc2cf76a8. This affects the function simpan of the file application/modules/admin/controllers/routing_pages.php of the component URL Valid
CVE-2026-19678 | A server-side request forgery (SSRF) vulnerability in the unauthenticated form service in version 11.0.14 in onPhase Forms allows an unauthenticated remote attacker to access sensitive internal Apache Solr data via an attacker-controlled URL supplied to a publicly accessible form.
A server-side request forgery (SSRF) vulnerability in the unauthenticated form service in version 11.0.14 in onPhase Forms allows an unauthenticated remote attacker to access sensitive internal Apache Solr data via an attacker-controlled UR
CVE-2026-19677 | An authentication bypass vulnerability in the public onPhase/ frevvo registration form version 11.0.14 allows an unauthenticated remote attacker to authenticate as an arbitrary tenant user, obtain TenantAdmin and Designer privileges, and execute arbitrary operating system commands via manipulation of registration parameters containing a valid tenant name and existing user identifier.
An authentication bypass vulnerability in the public onPhase/ frevvo registration form version 11.0.14 allows an unauthenticated remote attacker to authenticate as an arbitrary tenant user, obtain TenantAdmin and Designer privileges, and ex
CVE-2026-115536 | A security flaw has been discovered in gedelumbung HospitalManagement up to c2d45543789a3887067d3915f69d44cfc2cf76a8. The impacted element is the function simpan of the file application/modules/admin/controllers/routing_pages.php of the component Admin Routing Page. The manipulation of the argument content results in cross site scripting. The attack may be performed from remote. The exploit has been released to the public and may be used for attacks. This pr
A security flaw has been discovered in gedelumbung HospitalManagement up to c2d45543789a3887067d3915f69d44cfc2cf76a8. The impacted element is the function simpan of the file application/modules/admin/controllers/routing_pages.php of the com
CVE-2026-115486 | A flaw was found in the iscsiuio component of open-iscsi. The IPv6 Neighbor Discovery handler accesses link-layer address options at a fixed offset without verifying the packet contains them. Additionally, the ARP table is updated unconditionally with attacker-controlled addresses from the packet headers. An attacker on the same network segment can send a minimal Neighbor Advertisement to poison the ARP table and redirect network traffic.
A flaw was found in the iscsiuio component of open-iscsi. The IPv6 Neighbor Discovery handler accesses link-layer address options at a fixed offset without verifying the packet contains them. Additionally, the ARP table is updated unconditi
CVE-2026-115485 | A flaw was found in the iscsiuio component of open-iscsi. The DHCPv6 option parser calls strlen() on raw network data without ensuring a NUL terminator is present, causing it to read past the buffer into heap memory. This can result in a daemon crash, a 1-byte heap overwrite, or corruption of the iSCSI initiator name. An attacker on the same network segment can trigger this by sending a crafted DHCPv6 Advertise message.
A flaw was found in the iscsiuio component of open-iscsi. The DHCPv6 option parser calls strlen() on raw network data without ensuring a NUL terminator is present, causing it to read past the buffer into heap memory. This can result in a da
CVE-2026-115484 | A flaw was found in the iscsiuio component of open-iscsi. The DHCPv4 option parser incorrectly calculates the length of the options data, causing it to read beyond the allocated buffer into adjacent heap memory. An attacker on the same network segment can send a crafted DHCP response to crash the daemon or corrupt its network configuration.
A flaw was found in the iscsiuio component of open-iscsi. The DHCPv4 option parser incorrectly calculates the length of the options data, causing it to read beyond the allocated buffer into adjacent heap memory. An attacker on the same netw
CVE-2026-115535 | A vulnerability was identified in gedelumbung HospitalManagement up to c2d45543789a3887067d3915f69d44cfc2cf76a8. The affected element is the function sistem.php::simpan of the file application/modules/admin/controllers/sistem.php of the component Settings Handler. The manipulation of the argument Title leads to cross site scripting. The attack is possible to be carried out remotely. The exploit is publicly available and might be used. This product adopts a r
A vulnerability was identified in gedelumbung HospitalManagement up to c2d45543789a3887067d3915f69d44cfc2cf76a8. The affected element is the function sistem.php::simpan of the file application/modules/admin/controllers/sistem.php of the com
CVE-2026-115534 | A vulnerability was determined in gedelumbung HospitalManagement up to c2d45543789a3887067d3915f69d44cfc2cf76a8. Impacted is the function kirim of the file application/modules/web/controllers/contact.php of the component Contact Form. Executing a manipulation of the argument nama/email/alamat/telepon/pesan can lead to cross site scripting. The attack can be executed remotely. The exploit has been publicly disclosed and may be utilized. This product implement
A vulnerability was determined in gedelumbung HospitalManagement up to c2d45543789a3887067d3915f69d44cfc2cf76a8. Impacted is the function kirim of the file application/modules/web/controllers/contact.php of the component Contact Form. Execu
CVE-2026-110825 | The ONVIF device service on affected Kiloview E3 NDI encoder firmware accepts hostname, DNS, and NTP configuration write operations without requiring authentication, regardless of the device's configured authentication setting for this service. A remote, unauthenticated attacker can alter the device hostname, redirect DNS resolution, or modify the configured time source, enabling follow on attacks such as traffic interception or certificate validation bypass
The ONVIF device service on affected Kiloview E3 NDI encoder firmware accepts hostname, DNS, and NTP configuration write operations without requiring authentication, regardless of the device's configured authentication setting for this serv
CVE-2026-92450 | The authentication framework used by affected Kiloview E3 NDI encoder firmware signs session JSON Web Tokens using an HMAC-SHA256 secret hardcoded as a static string within the firmware image, identical across all deployed devices. An attacker with access to the publicly distributed firmware can recover this secret and forge arbitrary session tokens, including administrative tokens, without valid credentials, enabling unauthenticated access to privileged devi
The authentication framework used by affected Kiloview E3 NDI encoder firmware signs session JSON Web Tokens using an HMAC-SHA256 secret hardcoded as a static string within the firmware image, identical across all deployed devices. An attac
CVE-2026-110243 | The network management service on affected Kiloview E3 NDI encoder firmware fails to validate the network interface name accepted by its link maintenance address configuration endpoint before passing it to a shell command, unlike sibling handlers that perform the same validation. An authenticated web user with permission to configure network settings can exploit this to execute arbitrary operating system commands as root.
The network management service on affected Kiloview E3 NDI encoder firmware fails to validate the network interface name accepted by its link maintenance address configuration endpoint before passing it to a shell command, unlike sibling ha
CVE-2026-107861 | The system control service on affected Kiloview E3 NDI encoder firmware fails to sanitize the hostname parameter accepted by its device naming endpoint, passing it unquoted into a shell command. An authenticated web user with access to this function can embed characters to execute arbitrary operating system commands as root, resulting in full device compromise.
The system control service on affected Kiloview E3 NDI encoder firmware fails to sanitize the hostname parameter accepted by its device naming endpoint, passing it unquoted into a shell command. An authenticated web user with access to this
CVE-2026-110491 | The ONVIF service on the E3 can be rendered unresponsive by sending malformed or incomplete requests to certain operations. The affected service stops accepting new connections while the rest of the device continues operating normally, and will recover automatically after a period. This can be triggered repeatedly by any unauthenticated party with network access to the device.
The ONVIF service on the E3 can be rendered unresponsive by sending malformed or incomplete requests to certain operations. The affected service stops accepting new connections while the rest of the device continues operating normally, and
CVE-2026-105265 | A vulnerability exists in the the time zone parameter and does not properly validate user input, which may allow an authenticated user to cause /etc/localtime to point to a file outside the intended zoneinfo directory .
A vulnerability exists in the the time zone parameter and does not properly validate user input, which may allow an authenticated user to cause /etc/localtime to point to a file outside the intended zoneinfo directory .
CVE-2026-96616 | Authentication tokens issued by the E3's web management interface on login are given an expiration time far beyond any reasonable session lifetime, effectively making them non-expiring. A token obtained through interception or device compromise remains valid for authenticated access for an extended period.
Authentication tokens issued by the E3's web management interface on login are given an expiration time far beyond any reasonable session lifetime, effectively making them non-expiring. A token obtained through interception or device compro
CVE-2026-111100 | The ONVIF device service on the E3 responds to certain informational requests without requiring authentication. A remote, unauthenticated party can retrieve detailed device identifiers along with a list of configured user accounts and their privilege levels. This aids attackers in fingerprinting vulnerable devices and preparing targeted credential attacks.
The ONVIF device service on the E3 responds to certain informational requests without requiring authentication. A remote, unauthenticated party can retrieve detailed device identifiers along with a list of configured user accounts and their
CVE-2026-109122 | The network management service on affected Kiloview E3 NDI encoder firmware fails to sanitize one field used when configuring static routes via the web management API. An authenticated web user with permission to configure static routes can exploit this to execute arbitrary operating system commands as root, and the malicious configuration persists across reboots. Successful exploitation could result in full device compromise, including exposure of stored cr
The network management service on affected Kiloview E3 NDI encoder firmware fails to sanitize one field used when configuring static routes via the web management API. An authenticated web user with permission to configure static routes can
CVE-2026-83938 | Missing authentication for critical function in Azure Kubernetes Configuration Service allows an unauthorized attacker to elevate privileges over a network.
Missing authentication for critical function in Azure Kubernetes Configuration Service allows an unauthorized attacker to elevate privileges over a network.
CVE-2026-110063 | Improper link resolution before file access ('link following') in VM Inspector for Azure Virtual Machines allows an unauthorized attacker to elevate privileges over a network.
Improper link resolution before file access ('link following') in VM Inspector for Azure Virtual Machines allows an unauthorized attacker to elevate privileges over a network.
CVE-2026-97785 | Improper authentication in AAD App Proxy allows an unauthorized attacker to elevate privileges over a network.
Improper authentication in AAD App Proxy allows an unauthorized attacker to elevate privileges over a network.
CVE-2026-96185 | Stack-based buffer overflow in Microsoft Exchange Online allows an authorized attacker to execute code over a network.
Stack-based buffer overflow in Microsoft Exchange Online allows an authorized attacker to execute code over a network.
CVE-2026-108456 | Server-side request forgery (ssrf) in Azure AI Foundry allows an authorized attacker to elevate privileges over a network.
Server-side request forgery (ssrf) in Azure AI Foundry allows an authorized attacker to elevate privileges over a network.
CVE-2026-105014 | Improper neutralization of special elements used in a command ('command injection') in Azure Pipelines allows an unauthorized attacker to execute code over a network.
Improper neutralization of special elements used in a command ('command injection') in Azure Pipelines allows an unauthorized attacker to execute code over a network.
CVE-2026-111594 | InterSystems IRIS for Health has TLS/SSL encryption turned off by default, which may enable an attacker to view transmitted data and use that data to log into the device.
InterSystems IRIS for Health has TLS/SSL encryption turned off by default, which may enable an attacker to view transmitted data and use that data to log into the device.
CVE-2026-114620 | Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to 1.9.0, Authlib's RFC 9101 JWTAuthenticationRequest passes the unauthenticated, client-controlled request_uri parameter to the abstract get_request_object() hook before applying a destination or registration policy; the hook itself performs no network request, while the documentation demonstrates an unrestricted HTTP fetch. In deployments whose integrator implements that hook
Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to 1.9.0, Authlib's RFC 9101 JWTAuthenticationRequest passes the unauthenticated, client-controlled request_uri parameter to the abstract get_request_object()
CVE-2026-115386 | Wasmtime before 36.0.17, 37.0.0 before 48.0.4, and 49.0.0 before 49.0.2 contains an information disclosure vulnerability in the WASIp1 fd_readdir implementation that copies uninitialized struct padding into guest memory. Guests with a preopened directory can list entries to receive three bytes of leftover host stack or heap memory per directory entry.
Wasmtime before 36.0.17, 37.0.0 before 48.0.4, and 49.0.0 before 49.0.2 contains an information disclosure vulnerability in the WASIp1 fd_readdir implementation that copies uninitialized struct padding into guest memory. Guests with a preop
CVE-2026-115385 | Wasmtime 46.0.0 before 48.0.4 and 49.0.0 before 49.0.2 contains a denial of service vulnerability in the wasmtime-wasi WASIp3 implementation that allows guests to abort the Unix host process. Guests with mutable preopened directory access can call set-times or set-times-at with negative seconds timestamps before the epoch, triggering an assertion failure that crashes the host.
Wasmtime 46.0.0 before 48.0.4 and 49.0.0 before 49.0.2 contains a denial of service vulnerability in the wasmtime-wasi WASIp3 implementation that allows guests to abort the Unix host process. Guests with mutable preopened directory access c
CVE-2026-115384 | Wasmtime 39.0.0 before 48.0.4 and 49.0.0 before 49.0.2 contains a stack buffer overflow vulnerability that allows malicious guests to write ~16KB to the native stack via unvalidated async callback result types. Attackers can supply components with mistyped component-model-async callback functions to overwrite return addresses, crashing the host or escaping the sandbox.
Wasmtime 39.0.0 before 48.0.4 and 49.0.0 before 49.0.2 contains a stack buffer overflow vulnerability that allows malicious guests to write ~16KB to the native stack via unvalidated async callback result types. Attackers can supply componen