CVE-2026-52736 ZEBRA: Block suppression via NU5 same-header body poisoning of sent-hash cache

ZEBRA is a Zcash node written entirely in Rust. Prior to 4.5.0, a remote unauthenticated P2P peer can stall a Zebra node by racing an invalid block body against the valid canonical body for the same block header hash. ZIP-244 permits the attacker to mutate coinbase scriptSig authentication data...

EUVD-2026-61171

ZEBRA is a Zcash node written entirely in Rust. Prior to 4.5.0, a remote unauthenticated P2P peer can stall a Zebra node by racing an invalid block body against the valid canonical body for the same block header hash. ZIP-244 permits the attacker to mutate coinbase scriptSig authentication data...

CVE-2026-52736

In Zebra versions up to v4.4.1, a remote unauthenticated P2P peer can poison the in-memory non_finalized_block_write_sent_hashes cache by racing an invalid block body sharing a header hash (via ZIP-244 scriptSig malleability). When the valid canonical body arrives, it is treated as a duplicate an...

CVE-2026-52738

Zebra (a Zcash node written in Rust) versions up to v4.4.1 are vulnerable to a persistent chain halt . The finalized-state writer in transparent.rs applies all credits before debits within a block, so a consensus-valid block with a long chain of transparent self-spends to one address can push the...

CVE-2026-52739

Affected: zebrad up to v4.4.1. Root cause: Chain::push in zebra-state/src/service/non_finalized_state/chain.rs:1608-1628 inserts the transaction hash into tx_loc_by_hash with an assert_eq! before running the duplicate shielded-nullifier guard, so a repeated shielded transaction in a child block t...

CVE-2026-52739 ZEBRA: Repeated Non-Finalized Shielded Transaction Aborts Zebra Before Duplicate-Nullifier Rejection

ZEBRA is a Zcash node written entirely in Rust. Prior to 4.5.0, a malicious block producer can terminate zebrad by placing the same shielded transaction in a non-finalized parent block and its child. In zebra-state/src/service/nonfinalizedstate/chain.rs, Chain::push originally inserted the...

CVE-2026-52739 ZEBRA: Repeated Non-Finalized Shielded Transaction Aborts Zebra Before Duplicate-Nullifier Rejection

ZEBRA is a Zcash node written entirely in Rust. Prior to 4.5.0, a malicious block producer can terminate zebrad by placing the same shielded transaction in a non-finalized parent block and its child. In zebra-state/src/service/nonfinalizedstate/chain.rs, Chain::push originally inserted the...

CVE-2026-52739 ZEBRA: Repeated Non-Finalized Shielded Transaction Aborts Zebra Before Duplicate-Nullifier Rejection

ZEBRA is a Zcash node written entirely in Rust. Prior to 4.5.0, a malicious block producer can terminate zebrad by placing the same shielded transaction in a non-finalized parent block and its child. In zebra-state/src/service/nonfinalizedstate/chain.rs, Chain::push originally inserted the...

EUVD-2026-61165

ZEBRA is a Zcash node written entirely in Rust. Prior to 4.5.0, a malicious block producer can terminate zebrad by placing the same shielded transaction in a non-finalized parent block and its child. In zebra-state/src/service/nonfinalizedstate/chain.rs, Chain::push originally inserted the...

CVE-2026-52737 ZEBRA: Sync restart poisoning from single unauthenticated peer via above-lookahead block

ZEBRA is a Zcash node written entirely in Rust. Prior to 4.5.0, a malicious unauthenticated P2P peer can answer Zebra's outbound getblocks or FindBlocks request with a small two-hash inventory and then serve a syntactically valid block whose coinbase height is far above the local chain tip. In...

CVE-2026-52737

Zebra (v4.4.1 and earlier) is vulnerable to a DoS: a malicious unauthenticated P2P peer serves a block with an above-lookahead coinbase height, triggering a 67-second global sync restart that cancels honest peer downloads indefinitely. The root cause is that BlockDownloadVerifyError::AboveLookahe...

EUVD-2026-61163

ZEBRA is a Zcash node written entirely in Rust. Prior to 4.5.0, a malicious unauthenticated P2P peer can answer Zebra's outbound getblocks or FindBlocks request with a small two-hash inventory and then serve a syntactically valid block whose coinbase height is far above the local chain tip. In...

SUSE CVE-2026-68132

In the Linux kernel, the following vulnerability has been resolved: super: fix emergency thaw deadlock on frozen block devices dothawallcallback calls bdevthaw while holding sb-sumount exclusively. If the block device was frozen via bdevfreeze dropping the last block layer freeze reference calls...

CVE-2026-66645

Contributor Cross Site Scripting XSS in Table Of Contents Block = 1.5.0 versions...

GO-2026-6143 netfoil: Incorrect block responses could lead to localhost traffic in github.com/tinfoil-factory/netfoil

netfoil: Incorrect block responses could lead to localhost traffic in github.com/tinfoil-factory/netfoil...

EUVD-2026-60929

Contributor Cross Site Scripting XSS in Table Of Contents Block = 1.5.0 versions...

CVE-2026-66645

The WordPress Table Of Contents Block plugin (≤1.5.0) allows authenticated contributors to inject cross-site scripting payloads. CVSS 3.1 scores 6.5 (Medium) with network attack vector and low privileges required. No exploit code or in-the-wild exploitation is documented in the provided materials.

CVE-2026-66645 WordPress Table Of Contents Block plugin <= 1.5.0 - Cross Site Scripting (XSS) vulnerability

Contributor Cross Site Scripting XSS in Table Of Contents Block = 1.5.0 versions...

CVE-2026-66645

Contributor Cross Site Scripting XSS in Table Of Contents Block = 1.5.0 versions...

Duplicate Advisory: 17 block metadata/content endpoints in kernel/api/block.go have zero publish-access filtering, reachable by anonymous publish-mode readers

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-4vpg-gwqq-w44c. This link is maintained to preserve external references. Original Description SiYuan before v3.7.4 is missing authorization checks in 17 block metadata/content endpoints in kernel/api/block.go...