CVE-2026-40093

nimiq-blockchain provides persistent block storage for Nimiq's Rust implementation. In 1.3.0 and earlier, block timestamp validation enforces that timestamp = parent.timestamp for non-skip blocks and timestamp == parent.timestamp + MINPRODUCERTIMEOUT for skip blocks, but there is no visible upper...

CVE-2026-6155

creationtimestamp| type| source ---|---|--- 2026-04-13 04:17:39+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mjdz3p4yk72k 2026-04-13 05:18:10+00:00| published-proof-of-concept| Telegram/38C7MAAhnpHd5NceAwXcFYw5n56xIYZ8i0J7F3P3ZbI98 2026-04-13 05:43:26+00:00| seen|...

CVE-2026-6120

creationtimestamp| type| source ---|---|--- 2026-04-12 06:58:07+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mjbrllzwu22x 2026-04-12 07:07:53+00:00| seen| https://bsky.app/profile/postac001.bsky.social/post/3mjbs56pkt22r 2026-04-12 07:15:59+00:00| published-proof-of-concept|...

CVE-2026-31845

creationtimestamp| type| source ---|---|--- 2026-04-11 19:00:13+00:00| seen| https://infosec.exchange/users/offseq/statuses/116387611437440642 2026-04-11 19:00:15+00:00| seen| https://bsky.app/profile/offseq.bsky.social/post/3mjaji2nnue2c 2026-04-11 20:02:31+00:00| seen|...

CVE-2026-5809

creationtimestamp| type| source ---|---|--- 2026-04-11 09:00:29+00:00| seen| https://infosec.exchange/users/offseq/statuses/116385253239941232 2026-04-11 09:00:32+00:00| seen| https://bsky.app/profile/offseq.bsky.social/post/3mj7hxoc4mn2o 2026-04-11 09:15:27+00:00| published-proof-of-concept|...

CVE-2026-4152

creationtimestamp| type| source ---|---|--- 2026-04-11 03:21:08+00:00| published-proof-of-concept| Telegram/jQJESTxAnDJkcV3IOr4zcsYk9e3AhwwItG0ad6oUuWk-UR8 2026-04-11 06:10:59+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mj76ijpaqj2a 2026-04-11 06:11:37+00:00| seen|...

CVE-2026-5055

creationtimestamp| type| source ---|---|--- 2026-04-11 02:40:39+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mj6sqgkwlk2r 2026-04-11 03:21:45+00:00| seen| Telegram/oNJqzE-05Zhzc8NPQW-z5MMZ2uUFxP7FYrJiMTOKneUM6w 2026-04-11 05:00:55+00:00| seen|...

CVE-2026-5144

creationtimestamp| type| source ---|---|--- 2026-04-11 02:12:40+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mj6r6feokr2o 2026-04-11 03:21:49+00:00| seen| Telegram/-uyrs94fGKBZTNu2mzMK-L-9Rc5lrbCygfSEFHI7W39U14 2026-04-11 05:00:48+00:00| seen|...

CVE-2026-5217

creationtimestamp| type| source ---|---|--- 2026-04-11 02:09:14+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mj6qyaeuv42t 2026-04-11 03:22:02+00:00| published-proof-of-concept| Telegram/qUc7Bg1mtpLkc1l9EDpxbLzBpTm3H6GzOTVEjPbt6Wa7k 2026-04-12 00:00:42+00:00| seen|...

CVE-2026-33618

creationtimestamp| type| source ---|---|--- 2026-04-10 21:24:11+00:00| seen| Telegram/FBFE1jRDxJPr8K8KBUfFYtlwI9wezi1OF7LpQ32tR7vo 2026-04-10 21:31:05+00:00| seen| https://bsky.app/profile/postac001.bsky.social/post/3mj6bgva46m22 2026-04-11 07:03:47+00:00| seen|...

EUVD-2026-21146

nimiq-blockchain is missing a wall-clock upper bound on block timestamps...

GHSA-49XC-52MP-CC9J nimiq-blockchain is missing a wall-clock upper bound on block timestamps

Impact Block timestamp validation enforces that timestamp = parent.timestamp for non-skip blocks and timestamp == parent.timestamp + MINPRODUCERTIMEOUT for skip blocks, but there is no visible upper bound check against the wall clock. A malicious block-producing validator can set block timestamps...

nimiq-blockchain is missing a wall-clock upper bound on block timestamps

Impact Block timestamp validation enforces that timestamp = parent.timestamp for non-skip blocks and timestamp == parent.timestamp + MINPRODUCERTIMEOUT for skip blocks, but there is no visible upper bound check against the wall clock. A malicious block-producing validator can set block timestamps...

nodejs: Nodejs filesystem permissions bypass

A file access flaw has been discovered in NodeJS. A file's access and modification timestamps to be changed via futimes even when the process has only read permissions. Unlike utimes, futimes does not apply the expected write-permission checks, which means file metadata can be modified in read-on...

nodejs: Nodejs filesystem permissions bypass

A file access flaw has been discovered in NodeJS. A file's access and modification timestamps to be changed via futimes even when the process has only read permissions. Unlike utimes, futimes does not apply the expected write-permission checks, which means file metadata can be modified in read-on...

CVE-2025-5804

creationtimestamp| type| source ---|---|--- 2026-04-10 14:36:32+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mj5kbm5uqb2d 2026-04-10 15:17:16+00:00| seen| Telegram/lguE38htKCDsrEIHzbRJLgqsKSDV6aHHtfYRxKZkwP2V8 2026-04-10 15:17:37+00:00| seen|...

CVE-2026-33092

creationtimestamp| type| source ---|---|--- 2026-04-10 14:08:27+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mj5ipfh2sy2j 2026-04-10 15:17:37+00:00| seen| Telegram/BHjpIBo0iRlJvCTjCc1tWATK3ONpTPYFFDHwGYF-bIOT41U 2026-04-12 06:00:33+00:00| seen|...

CVE-2026-6067

creationtimestamp| type| source ---|---|--- 2026-04-10 14:02:06+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mj5idzzocv22 2026-04-10 17:21:41+00:00| published-proof-of-concept| Telegram/VrQ9Ov0zxRZi9WqN3kvWB9KwPzyBbBtKpr0H2dFm10XhQ 2026-04-11 09:00:45+00:00| seen|...

nodejs: Nodejs filesystem permissions bypass

A file access flaw has been discovered in NodeJS. A file's access and modification timestamps to be changed via futimes even when the process has only read permissions. Unlike utimes, futimes does not apply the expected write-permission checks, which means file metadata can be modified in read-on...

CVE-2026-6026

creationtimestamp| type| source ---|---|--- 2026-04-10 07:17:56+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mj4rrch34w2m 2026-04-10 08:57:52+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mj4xdzoraq2i 2026-04-10 09:17:31+00:00| seen|...