EUVD-2026-24179

UltraDAG is a minimal DAG-BFT blockchain in Rust. In version 0.1, a non-council attacker can submit a signed SmartOp::Vote transaction that passes signature, nonce, and balance prechecks, but fails authorization only after state mutation has already occurred...

CVE-2026-40583 UltraDAG: SmartOp Vote Path Triggers Fatal Supply Invariant Halt

UltraDAG is a minimal DAG-BFT blockchain in Rust. In version 0.1, a non-council attacker can submit a signed SmartOp::Vote transaction that passes signature, nonce, and balance prechecks, but fails authorization only after state mutation has already occurred...

PT-2026-5751

CSA-2026-001: Tachyon Description Name: CSA-2026-001: Tachyon Criticality: Critical Catastrophic Impact; Possible Likelihood per ACMv1.2 Affected versions: All versions of CometBFT Affected users: Validators and protocols relying on block timestamps Description A consensus-level vulnerability was...

SUSE CVE-2025-24371

CometBFT is a distributed, Byzantine fault-tolerant, deterministic state machine replication engine. In the blocksync protocol peers send their base and latest heights when they connect to a new node A, which is syncing to the tip of a network. base acts as a lower ground and informs A that the...

CVE-2023-34450: Missing Release of Memory after Effective Lifetime

CometBFT is a Byzantine Fault Tolerant BFT middleware that takes a state transition machine and replicates it on many machines. An internal modification made in versions 0.34.28 and 0.37.1 to the way struct PeerState is serialized to JSON introduced a deadlock when new function MarshallJSON is...

Design/Logic Flaw

Tendermint Core is an open source Byzantine Fault Tolerant BFT middleware that takes a state transition machine - written in any programming language - and securely replicates it on many machines. Tendermint Core v0.34.0 introduced a new way of handling evidence of misbehavior. As part of this, w...

Memory Corruption Vulnerability in Schneider SFT2885 bft Project File

Schneider Electric SA is a global electrical company headquartered in France and a global specialist in energy efficiency management and automation. A memory corruption vulnerability exists in the Schneider SFT2885 bft project file, which can be exploited by an attacker to cause a denial of servi...

CVE-2018-1002005

These vulnerabilities require administrative privileges to exploit. There is an XSS vulnerability in bftlist.html.php:43: via the filtersignupdate parameter...

PT-2018-9613

Name of the Vulnerable Software and Affected Versions: No specific software or version is mentioned. Description: The issue involves an XSS vulnerability that can be exploited via the filter signup date parameter in the bft list.html.php file, specifically at line 43. This vulnerability requires...

Wordpress Arigato Autoresponder and Newsletter Cross-Site Scripting Vulnerability (CNVD-2019-29710)

WordPress is a blogging platform developed by the WordPress Software Foundation using the PHP language, which supports personal blog sites on PHP and MySQL servers.Arigato Autoresponder and Newsletter is an autoresponder plugin used in... A cross-site scripting vulnerability exists in the...