Login Request a demo
WA
Product
wasmtime
by bytecodealliance · last CVE Oct 23, 2026
62
CVEs
0
On KEV
10.0
Max CVSS
19
New 30D
Vulnerabilities62In the news0Timeline
Severity mix
Critical 8High 16Medium 29Low 9
Severity
All severities62Critical8High16Medium29Low9
Exploitation
On CISA KEV0Exploited in the wild0
Watch

Add wasmtime to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2026-115393
New
3.8
0%
Oct 22
Wasmtime before 24.0.12, 25.0.0 before 36.0.13, 37.0.0 before 46.0.2, and 47.0.0 before 47.0.3 Cross-Engine Type Confusion
Affected: before 24.0.12; 25.0.0 before 36.0.13; 37.0.0 before 46.0.2; 47.0.0 before 47.0.3
CVE-2025-53901
3.5
0%
Jul 18
Wasmtime is a runtime for WebAssembly
Affected: before 24.0.4; 33.0.0 before 33.0.2; 34.0.0 before 34.0.2
CVE-2025-61670
3.3
0%
Oct 7
Wasmtime is a runtime for WebAssembly
Affected: 37.0.0; 37.0.1
CVE-2025-62711
3.1
0%
Oct 24
Wasmtime is a runtime for WebAssembly
Affected: 38.0.0 before 38.0.3
CVE-2024-47813
2.9
0%
Oct 9
Wasmtime is an open source runtime for WebAssembly
Affected: 19.0.0; 19.0.1; 19.0.2; 20.0.0; 20.0.1; 20.0.2; +9 more
CVE-2026-115386
New
2.6
0%
Oct 22
Wasmtime before 36.0.17, 37.0.0 before 48.0.4, and 49.0.0 before 49.0.2 Memory Disclosure via fd_readdir
Affected: before 36.0.17; 37.0.0 before 48.0.4; 49.0.0 before 49.0.2
CVE-2026-115389
New
2.3
0%
Oct 22
Wasmtime before 36.0.16, 37.0.0 before 48.0.3, and 49.0.0 before 49.0.1 Denial of Service via Val API
Affected: before 36.0.16; 37.0.0 before 48.0.3; 49.0.0 before 49.0.1
CVE-2026-104855
2.0
0%
Oct 2
Wasmtime: Preemption and traps during bulk operations enable breaking internal VM state
Affected: >= 46.0.0, < 46.0.2; >= 47.0.0, < 47.0.3
CVE-2025-64345
1.8
0%
Nov 12
Wasmtime provides unsound API access to a WebAssembly shared linear memory
Affected: >= 38.0.1, < 38.0.4; >= 37.0.0, < 37.0.3; >= 26.0.0, < 36.0.3; < 24.0.5
Showing 9