Bitcoin Core security vulnerabilities

Bitcoin Core is an open-source client for verifying the validity of blockchain transactions. Versions of Bitcoin Core 29.x and earlier contain security vulnerabilities, which stem from integer overflow issues...

CVE-2025-46597: Integer Overflow or Wraparound

Bitcoin Core 0.13.0 through 29.x has an integer overflow...

CVE-2025-46597

Bitcoin Core 0.13.0 through 29.x has an integer overflow...

CVE-2025-46597

Bitcoin Core 0.13.0 through 29.x has an integer overflow...

CVE-2025-46597

Bitcoin Core 0.13.0 through 29.x has an integer overflow...

CVE-2025-46597

Bitcoin Core 0.13.0 through 29.x has an integer overflow...

CVE-2025-46598

Bitcoin Core through 29.0 allows a denial of service via a crafted transaction...

CVE-2025-46598

Bitcoin Core through 29.0 allows a denial of service via a crafted transaction...

CVE-2025-46598

Bitcoin Core through 29.0 allows a denial of service via a crafted transaction...

CVE-2025-46598

Bitcoin Core through 29.0 allows a denial of service via a crafted transaction...

CVE-2025-46598

Bitcoin Core versions prior to 30.0 and Bitcoin Knots versions prior to 20251110 are vulnerable to a denial of service (DoS) attack. The root cause is a resource exhaustion issue triggered by the processing of unconfirmed, specially crafted transactions. This flaw allows for asymmetric resource c...

CVE-2025-46597

Bitcoin Core versions 0.13.0 through 29.x are affected by an integer overflow vulnerability. Specifically, the issue can be triggered on old 32-bit systems with a large, non-standard mempool configuration. An attacker must craft an invalid 1 GB block to potentially exploit the flaw, which is cons...

CVE-2025-46597

Bitcoin Core 0.13.0 through 29.x has an integer overflow...

Sextortion “I recorded you” emails reuse passwords found in disposable inboxes

Our malware removal support team recently flagged a new wave of sextortion emails, with the subject line: “You pervert, I recorded you!” If the message sounds familiar, that's because it's a variation of the long-running "Hello pervert" scam. The email claims the target’s device has been infected...

BSV SDK security vulnerabilities

The BSV SDK is an open-source developer toolkit for BSV Blockchain. Versions of the BSV SDK prior to 2.0.0 contained security vulnerabilities. These vulnerabilities stemmed from errors in the signature data preparation process within the BRC-104 authentication mechanism, which could lead to...

Improper Following of Specification by Caller

Overview @bsv/sdk is a BSV Blockchain Software Development Kit Affected versions of this package are vulnerable to Improper Following of Specification by Caller in the Peer class, used by the processInitialRequest and processInitialResponse methods. An attacker can cause a signature to be...

GHSA-Q66H-M87M-J2Q6 Bitcoinrb Vulnerable to Command injection via RPC

Summary: Remote Code Execution Unsafe handling of request parameters in the RPC HTTP server results in command injection Details In lib/bitcoin/rpc/httpserver.rb line 30-39, the JSON body of a POST request is parsed into command and args variables. These values are then passed to send, which is...

Bithumb Mistakenly Sends 620,000 Bitcoin ($40B) to Customer Accounts

A system error at Bithumb sent 620,000 Bitcoin worth about $40B to hundreds of users during a promotion, briefly disrupting prices and drawing scrutiny...

CVE-2025-14554

The Sell BTC - Cryptocurrency Selling Calculator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'orderformdata' AJAX action in all versions up to, and including, 1.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated...

EUVD-2025-206583

The Sell BTC - Cryptocurrency Selling Calculator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'orderformdata' AJAX action in all versions up to, and including, 1.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated...