SecAlerts
b

bytecode alliance

Security Risk Profile

34
/100
low

Security Risk Score

Comprehensive risk assessment based on 18 vulnerabilities, EPSS scores, exploitation status, and remediation availability.

📅 Data spans from May 6, 2024 to present

18
Total CVEs
3
Critical+High
0
Exploited
3
Unpatched

Threat Assessment

Avg CVSS
5.3
Base severity
Avg EPSS
0%
Exploit probability
Unpatched
3
Critical/High
Risk Level
34/100
low
🆕 15Fresh (<7d)📈 15 in Last 30 Days

Severity Distribution

Critical
1
High
2
Medium
11
Low
4

Exploit Likelihood

>50% chance
0
20-50%
0
5-20%
0
<5%
2

Age Distribution

Common Weaknesses (CWE)

1
Buffer Overflow
2
2
Integer Overflow
1
3
Input Validation
1
4
Use After Free
1
5
Race Condition
1

Most Affected Products

1. Bytecode Alliance Wasmtime16
2. rust/wasmtime4
3. Bytecode Alliance wasm-micro-runtime2
4. bytecodealliance Webassembly Micro Runtime2
5. Bytecode Alliance wasmtime-wasi-http1

Recent Vulnerabilities

See more →
CVE-2026-115393
CVSS 3.8low

Wasmtime before 24.0.12, 25.0.0 before 36.0.13, 37.0.0 before 46.0.2, and 47.0.0 before 47.0.3 Cross-Engine Type Confusion

Oct 22, 2026🔧 No Patch
CVE-2026-115392
CVSS 7.9high

Wasmtime before 24.0.13, 25.0.0 before 36.0.14, 37.0.0 before 46.0.3, and 47.0.0 before 47.0.4 Sandbox Escape via Trailing Slashes

Oct 22, 2026🔧 No Patch
CVE-2026-115391
CVSS 5.8medium

Wasmtime 46.0.0 before 46.0.3 and 47.0.0 before 47.0.4 Unbounded Heap Allocation via WASIp3 Streams

Oct 22, 2026🔧 No Patch
CVE-2026-115390
CVSS 5.7medium

Wasmtime 47.0.0 before 48.0.3 and 49.0.0 before 49.0.1 Fuel Accounting Bypass DoS

Oct 22, 2026🔧 No Patch
CVE-2026-115389
CVSS 2.3low

Wasmtime before 36.0.16, 37.0.0 before 48.0.3, and 49.0.0 before 49.0.1 Denial of Service via Val API

Oct 22, 2026🔧 No Patch
CVE-2026-115388
CVSS 6.2medium

Wasmtime before 36.0.16, 37.0.0 before 48.0.3, and 49.0.0 before 49.0.1 Memory Exhaustion DoS via wasmtime-wasi-http Outgoing Body Write

Oct 22, 2026🔧 No Patch
CVE-2026-115387
CVSS 6.2medium

Wasmtime before 36.0.16, 37.0.0 before 48.0.3, and 49.0.0 before 49.0.1 Host Panic via WASI Filesystem Timestamp Overflow

Oct 22, 2026🔧 No Patch
CVE-2026-115386
CVSS 2.6low

Wasmtime before 36.0.17, 37.0.0 before 48.0.4, and 49.0.0 before 49.0.2 Memory Disclosure via fd_readdir

Oct 22, 2026🔧 No Patch
CVE-2026-115385
CVSS 6.2medium

Wasmtime 46.0.0 before 48.0.4 and 49.0.0 before 49.0.2 Host Panic via WASIp3 Timestamps

Oct 22, 2026🔧 No Patch
CVE-2026-115384
CVSS 9.9critical

Wasmtime 39.0.0 before 48.0.4 and 49.0.0 before 49.0.2 Stack Buffer Overflow

Oct 22, 2026🔧 No Patch

Monitor bytecode alliance in Real-Time

Get instant alerts when new vulnerabilities are discovered. Stay ahead of security threats with SecAlerts.

Powered bySecAlerts

Monitor Your Software Stack in Real-Time

Get instant alerts when vulnerabilities are discovered in your software stack. Stay ahead of security threats with SecAlerts.

© 2026 SecAlerts Pty Ltd. All rights reserved.