15434 matches found
CVE-2026-52739 ZEBRA: Repeated Non-Finalized Shielded Transaction Aborts Zebra Before Duplicate-Nullifier Rejection
ZEBRA is a Zcash node written entirely in Rust. Prior to 4.5.0, a malicious block producer can terminate zebrad by placing the same shielded transaction in a non-finalized parent block and its child. In zebra-state/src/service/nonfinalizedstate/chain.rs, Chain::push originally inserted the...
CVE-2026-52739
Affected: zebrad up to v4.4.1. Root cause: Chain::push in zebra-state/src/service/non_finalized_state/chain.rs:1608-1628 inserts the transaction hash into tx_loc_by_hash with an assert_eq! before running the duplicate shielded-nullifier guard, so a repeated shielded transaction in a child block t...
CVE-2026-52739 ZEBRA: Repeated Non-Finalized Shielded Transaction Aborts Zebra Before Duplicate-Nullifier Rejection
ZEBRA is a Zcash node written entirely in Rust. Prior to 4.5.0, a malicious block producer can terminate zebrad by placing the same shielded transaction in a non-finalized parent block and its child. In zebra-state/src/service/nonfinalizedstate/chain.rs, Chain::push originally inserted the...
CVE-2026-52737
Zebra (v4.4.1 and earlier) is vulnerable to a DoS: a malicious unauthenticated P2P peer serves a block with an above-lookahead coinbase height, triggering a 67-second global sync restart that cancels honest peer downloads indefinitely. The root cause is that BlockDownloadVerifyError::AboveLookahe...
CVE-2026-52737 ZEBRA: Sync restart poisoning from single unauthenticated peer via above-lookahead block
ZEBRA is a Zcash node written entirely in Rust. Prior to 4.5.0, a malicious unauthenticated P2P peer can answer Zebra's outbound getblocks or FindBlocks request with a small two-hash inventory and then serve a syntactically valid block whose coinbase height is far above the local chain tip. In...
SUSE CVE-2026-68132
In the Linux kernel, the following vulnerability has been resolved: super: fix emergency thaw deadlock on frozen block devices dothawallcallback calls bdevthaw while holding sb-sumount exclusively. If the block device was frozen via bdevfreeze dropping the last block layer freeze reference calls...
CVE-2026-66645
Contributor Cross Site Scripting XSS in Table Of Contents Block = 1.5.0 versions...
CVE-2026-66645 WordPress Table Of Contents Block plugin <= 1.5.0 - Cross Site Scripting (XSS) vulnerability
Contributor Cross Site Scripting XSS in Table Of Contents Block = 1.5.0 versions...
CVE-2026-66645
Contributor Cross Site Scripting XSS in Table Of Contents Block = 1.5.0 versions...
EUVD-2026-60929
Contributor Cross Site Scripting XSS in Table Of Contents Block = 1.5.0 versions...
CVE-2026-66645
The WordPress Table Of Contents Block plugin (≤1.5.0) allows authenticated contributors to inject cross-site scripting payloads. CVSS 3.1 scores 6.5 (Medium) with network attack vector and low privileges required. No exploit code or in-the-wild exploitation is documented in the provided materials.
CVE-2026-74904
SiYuan before v3.7.4 is missing authorization checks in 17 block metadata/content endpoints in kernel/api/block.go including getRefText, checkBlockExist, and getBlockBreadcrumb. These handlers are gated only by basic authentication model.CheckAuth and lack publish-access filtering, allowing...
CVE-2026-74904
In SiYuan before v3.7.4, 17 block endpoints in kernel/api/block.go (getRefText, checkBlockExist, getBlockBreadcrumb) are gated only by model.CheckAuth without publish-access filtering, letting anonymous publish-mode readers disclose private block content, metadata, and existence info. Patch to v3...
CVE-2026-74904 SiYuan before v3.7.4 Missing Authorization via block API
SiYuan before v3.7.4 is missing authorization checks in 17 block metadata/content endpoints in kernel/api/block.go including getRefText, checkBlockExist, and getBlockBreadcrumb. These handlers are gated only by basic authentication model.CheckAuth and lack publish-access filtering, allowing...
EUVD-2026-60585
SiYuan before v3.7.4 is missing authorization checks in 17 block metadata/content endpoints in kernel/api/block.go including getRefText, checkBlockExist, and getBlockBreadcrumb. These handlers are gated only by basic authentication model.CheckAuth and lack publish-access filtering, allowing...
CVE-2026-72142
A flaw was found in the i2c-imx driver of the Linux kernel. When an I2C slave device performs an SMBus block-read operation with a byte count of zero, the atomic polling path in the driver fails to properly release the I2C bus. This can cause the bus to become stuck, requiring a power cycle of th...
WordPress WPZOOM Forms – Contact Form Plugin for Gutenberg plugin <= 2.0.7 - Cross Site Scripting (XSS) vulnerability
Cross Site Scripting XSS vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin WPZOOM Forms – Contact Form Plugin for Gutenberg versions = 2.0.7...
EUVD-2026-60548
Mahara before 25.04.5 and 26.04.0 is vulnerable in the Text block/section functionality when a call is crafted in a certain way that allows it to recall the backed-up content from another Text section...
SUSE CVE-2026-53792
rsync before 3.5.0 contains an out-of-bounds read vulnerability in the sender-side block matching logic that allows a malicious receiver to trigger memory access before the start of an allocated buffer by sending a crafted checksum block with a length of zero. Attackers can send a specially craft...
