By weakness (CWE)

CWE-281: related vulnerabilities

CVEs classified under CWE-281. Understanding the weakness class helps prioritize systemic fixes over one-off patches.

2 published vulnerabilities

• CVE-2026-58494MEDIUM 6.5

  Wasmtime is a WebAssembly runtime that enables sandboxed execution of wasm code. A permission-checking flaw in wasmtime-wasi (the WASI interface layer) allows a guest WebAssembly program with only read-only access to a file to bypass safety controls and modify or overwrite files on the host system that are exposed as read-only through the WASI filesystem interface. The vulnerability affects versions before 24.0.11, 36.0.12, 45.0.3, and 46.0.1, and stems from insufficient permission validation during hard-link creation and file renaming operations.

• CVE-2026-4360MEDIUM 5.3

  CVE-2026-4360 is a vulnerability in Python's tarfile extraction mechanism where the security filter parameter is bypassed when extracting hardlinks from tar archives. When a developer uses the `filter='data'` parameter—intended to restrict file ownership changes—the filter is not applied to hardlinks, allowing an attacker to craft a malicious tar file that assigns unexpected user and group identifiers (uid/gid) to extracted files. This could lead to privilege escalation or file ownership manipulation on systems processing untrusted archives.