CVE-2026-27572
HighSummary
Wasmtime to środowisko uruchomieniowe dla WebAssembly. W wersjach wcześniejszych niż 24.0.6, 36.0.6, 4.0.04, 41.0.4 i 42.0.0, implementacja zasobu `wasi:http/types.fields` jest podatna na paniki, gdy zbyt wiele pól zostanie dodanych do zestawu nagłówków, co prowadzi do awarii.
Risk Assessment
Panika w implementacji WASI stanowi wektor Denial of Service dla osadzających, co traktowane jest jako podatność bezpieczeństwa w Wasmtime. Może to prowadzić do niedostępności usług dla użytkowników.
Recommendation
Zaleca się aktualizację do poprawionej wersji Wasmtime (24.0.6, 36.0.6, 40.0.4, 41.0.4 lub 42.0.0), aby uniknąć ryzyka związanego z tą podatnością.
Related vulnerabilities
- CVE-2026-15688Critical
A vulnerability in Mitsubishi Electric GX Works3 and Motion Control Setting stems from an incorrect implementation of the authentication algorithm. A local attacker can successfully authenticate even with an invalid block password by modifying part of the executable module in memory.
- CVE-2026-88795Critical
The wpShopGermany IT-RECHT KANZLEI WordPress plugin before 2.4 does not generate its API authentication token securely, deriving it from data the requester controls and creating it as a side effect of the check that is supposed to validate it. This allows unauthenticated attackers to predict the token and use the access it grants to write arbitrary files, leading to remote code execution.
- CVE-2026-86710Critical
The Login with QR WordPress plugin through 1.0.0 does not verify that the code used to log a user in is one it issued, matching any stored user metadata value instead. This allows unauthenticated attackers to log in as any user, including administrators.
- CVE-2026-86709Critical
The Pressengine WordPress plugin through 1.0 does not stop its login handler from issuing a session when authentication fails. This allows unauthenticated attackers to log in as any user, including administrators.
- CVE-2026-86707Critical
The Private Feed Key WordPress plugin through 0.1 does not verify that the key used to authenticate a feed request is one it issued, matching any stored user metadata value instead. This allows unauthenticated attackers to log in as any user, including administrators.
- CVE-2026-87796Critical
The Multi Uploader for Gravity Forms plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to and including 1.1.9 via the move_file function. This is due to insufficient file type validation during chunked upload handling. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible.
- CVE-2026-61594Critical
djust prior to version 1.0.7 has a vulnerability in the WebSocket transport that bypasses standard Django authorization mechanisms (such as LoginRequiredMixin, PermissionRequiredMixin, etc.) and the staff gate in the admin extension. Mount authorization is done via check_view_auth, not the View.dispatch() chain, allowing anonymous or under-privileged clients to open a WebSocket and dispatch view handlers, including admin ones.
- CVE-2026-92805Critical
UVdesk Community Skeleton through 1.1.8 fails to authenticate or validate installation state on wizard endpoints in ConfigureHelpdesk controller actions. Unauthenticated attackers can repoint the database and create super administrator accounts by submitting crafted requests to wizard endpoints, gaining full control of the instance.
- CVE-2026-92787Critical
Feast through 0.66.0 fails to verify JWT token signatures before establishing user identity, allowing attackers to bypass all role-based access control by presenting an unverified token with a hardcoded claim value. Attackers can obtain trusted internal identity and gain unchecked read and write access to all entities, feature views, data sources, and permission policies on the server.
- CVE-2026-76460CriticalActively exploited
A vulnerability in the API of Cisco Identity Services Engine (ISE) could allow an unauthenticated, remote attacker to bypass authentication. This is due to insufficient authentication control on an API endpoint. An attacker could send a crafted request to gain unauthorized access to the device by bypassing the web-based management interface.
Original NVD description (English source)
Wasmtime is a runtime for WebAssembly. Prior to versions 24.0.6, 36.0.6, 4.0.04, 41.0.4, and 42.0.0, Wasmtime's implementation of the `wasi:http/types.fields` resource is susceptible to panics when too many fields are added to the set of headers. Wasmtime's implementation in the `wasmtime-wasi-http` crate is backed by a data structure which panics when it reaches excessive capacity and this condition was not handled gracefully in Wasmtime. Panicking in a WASI implementation is a Denial of Service vector for embedders and is treated as a security vulnerability in Wasmtime. Wasmtime 24.0.6, 36.0.6, 40.0.4, 41.0.4, and 42.0.0 patch this vulnerability and return a trap to the guest instead of panicking. There are no known workarounds at this time. Embedders are encouraged to update to a patched version of Wasmtime.