DEBIAN-CVE-2026-117603

Electrum before 4.7.2 contains a spending limit bypass vulnerability in the Nostr Wallet Connect plugin that allows malicious NWC clients to exceed dailylimitsat by exploiting non-atomic budget checks and millisatoshi truncation. Attackers can send concurrent payinvoice requests that pass...

CVE-2026-117603 Electrum before 4.7.2 Nostr Wallet Connect Plugin Daily Spending Limit Bypass

Electrum before 4.7.2 contains a spending limit bypass vulnerability in the Nostr Wallet Connect plugin that allows malicious NWC clients to exceed dailylimitsat by exploiting non-atomic budget checks and millisatoshi truncation. Attackers can send concurrent payinvoice requests that pass...

PT-2026-126433

Electrum before 4.7.2 contains a spending limit bypass vulnerability in the Nostr Wallet Connect plugin that allows malicious NWC clients to exceed daily limit sat by exploiting non-atomic budget checks and millisatoshi truncation. Attackers can send concurrent pay invoice requests that pass budg...

CVE-2026-114117

Vyper 0.3.8 through 0.5.0b1 contains an optimizer miscompilation in which msg.value | K or lenmsg.data | K, where K is any nonzero integer literal, is compiled to the constant 1 when used as a ternary expression branch under -O gas the default or -O codesize. Affected contracts use the wrong valu...

CVE-2026-114117 Vyper 0.3.8 through 0.5.0b1 Optimizer Miscompilation of msg.value | K in Ternary Branches

Vyper 0.3.8 through 0.5.0b1 contains an optimizer miscompilation in which msg.value | K or lenmsg.data | K, where K is any nonzero integer literal, is compiled to the constant 1 when used as a ternary expression branch under -O gas the default or -O codesize. Affected contracts use the wrong valu...

CVE-2026-114117 Vyper 0.3.8 through 0.5.0b1 Optimizer Miscompilation of msg.value | K in Ternary Branches

Vyper 0.3.8 through 0.5.0b1 contains an optimizer miscompilation in which msg.value | K or lenmsg.data | K, where K is any nonzero integer literal, is compiled to the constant 1 when used as a ternary expression branch under -O gas the default or -O codesize. Affected contracts use the wrong valu...

CVE-2026-114117

The Vyper compiler (versions 0.3.8 through 0.5.0b1 ) contains an optimizer miscompilation affecting ternary expression branches. When using the -O gas (default) or -O codesize optimization flags, the expressions (msg.value | K) or (len(msg.data) | K)—where K is any nonzero integer literal—are inc...

CVE-2026-114117 Vyper 0.3.8 through 0.5.0b1 Optimizer Miscompilation of msg.value | K in Ternary Branches

Vyper 0.3.8 through 0.5.0b1 contains an optimizer miscompilation in which msg.value | K or lenmsg.data | K, where K is any nonzero integer literal, is compiled to the constant 1 when used as a ternary expression branch under -O gas the default or -O codesize. Affected contracts use the wrong valu...

CVE-2026-114117

Vyper 0.3.8 through 0.5.0b1 contains an optimizer miscompilation in which msg.value | K or lenmsg.data | K, where K is any nonzero integer literal, is compiled to the constant 1 when used as a ternary expression branch under -O gas the default or -O codesize. Affected contracts use the wrong valu...

EUVD-2026-106920

Vyper 0.3.8 through 0.5.0b1 contains an optimizer miscompilation in which msg.value | K or lenmsg.data | K, where K is any nonzero integer literal, is compiled to the constant 1 when used as a ternary expression branch under -O gas the default or -O codesize. Affected contracts use the wrong valu...

PT-2026-120243

Vyper 0.3.8 through 0.5.0b1 contains an optimizer miscompilation in which msg.value | K or lenmsg.data | K, where K is any nonzero integer literal, is compiled to the constant 1 when used as a ternary expression branch under -O gas the default or -O codesize. Affected contracts use the wrong valu...

Vyper numeric error vulnerability

In Vyper versions 0.3.8 through 0.5.0b1, there is a numeric error vulnerability stemming from improper optimizer compilation. Under conditions where -O gas or -O codesize is enabled, expressions such as msg.value | K or lenmsg.data | K are compiled as a constant value of 1 when used as ternary...

CVE-2026-93509

The Wallet System for WooCommerce WordPress plugin before 2.8.0 does not validate that a wallet transfer amount is positive, and computes the sender's new balance from a stale snapshot taken before crediting the recipient, allowing an authenticated attacker with Subscriber-level access to mint...

EUVD-2026-94830

The Wallet System for WooCommerce WordPress plugin before 2.8.0 does not validate that a wallet transfer amount is positive, and computes the sender's new balance from a stale snapshot taken before crediting the recipient, allowing an authenticated attacker with Subscriber-level access to mint...

CVE-2026-93509: Improper Input Validation

The Wallet System for WooCommerce WordPress plugin before 2.8.0 does not validate that a wallet transfer amount is positive, and computes the sender's new balance from a stale snapshot taken before crediting the recipient, allowing an authenticated attacker with Subscriber-level access to mint...

CVE-2026-106511

MultiversX's multisig-improved repository: mx-multisig-and-modules reference implementation of their on-chain multisig smart contract system contains a vulnerability where a missing independent authorization check allows any account with the Proposer role to perform explicitly barred actions. Thi...

CVE-2026-106511 CVE-2026-106511

MultiversX's multisig-improved repository: mx-multisig-and-modules reference implementation of their on-chain multisig smart contract system contains a vulnerability where a missing independent authorization check allows any account with the Proposer role to perform explicitly barred actions. Thi...

CVE-2026-106511

The MultiversX multisig-improved reference implementation (repository: mx-multisig-and-modules) contains a vulnerability in its on-chain multisig smart contract system . Due to a missing independent authorization check , any account assigned the Proposer role can perform actions that are explicit...

EUVD-2026-93662

MultiversX's multisig-improved repository: mx-multisig-and-modules reference implementation of their on-chain multisig smart contract system contains a vulnerability where a missing independent authorization check allows any account with the Proposer role to perform explicitly barred actions. Thi...

CVE-2026-106511

MultiversX's multisig-improved repository: mx-multisig-and-modules reference implementation of their on-chain multisig smart contract system contains a vulnerability where a missing independent authorization check allows any account with the Proposer role to perform explicitly barred actions. Thi...