295292 matches found
DEBIAN-CVE-2026-117602
Electrum 4.6.0 before 4.7.2 contains an authorization bypass in the external plugin loader, which executes a plugin's init.py module when the plugin is marked enabled in the config file, without verifying its plugin-password signature. A rogue local process with write access to the Electrum data...
DEBIAN-CVE-2026-117603
Electrum before 4.7.2 contains a spending limit bypass vulnerability in the Nostr Wallet Connect plugin that allows malicious NWC clients to exceed dailylimitsat by exploiting non-atomic budget checks and millisatoshi truncation. Attackers can send concurrent payinvoice requests that pass...
CVE-2026-117602
Electrum 4.6.0 before 4.7.2 contains an authorization bypass in the external plugin loader, which executes a plugin's init.py module when the plugin is marked enabled in the config file, without verifying its plugin-password signature. A rogue local process with write access to the Electrum data...
CVE-2026-117558
The ai-sdlc plugin MCP server through 0.31.2 contains an OS command injection vulnerability that allows attackers to execute commands by supplying shell metacharacters in the repo argument. The unvalidated repo value is interpolated into gh issue view or gh pr view commands run via execSync,...
CVE-2026-117603
Electrum before 4.7.2 contains a spending limit bypass vulnerability in the Nostr Wallet Connect plugin that allows malicious NWC clients to exceed dailylimitsat by exploiting non-atomic budget checks and millisatoshi truncation. Attackers can send concurrent payinvoice requests that pass...
CVE-2026-117602
Electrum 4.6.0 before 4.7.2 contains an authorization bypass in the external plugin loader, which executes a plugin's init.py module when the plugin is marked enabled in the config file, without verifying its plugin-password signature. A rogue local process with write access to the Electrum data...
Output Messenger Server Unauthenticated Zip-Slip Plugin RCE
Pre-auth chain on Output Messenger Server 2.0.x = 2.0.63: plaintext XMPP 14121 linkserver registration, SI offline synclog IQ, SOCKS5 zip upload 14135 with SharpZipLib 0.85.4 zip-slip. Plants OM.EvilMail.dll; RCE on next OutputMessengerServer restart as NT AUTHORITY\SYSTEM. !/usr/bin/env python3 ...
iMonnit Express Unauthenticated Auth Bypass + Path Traversal + Plugin Load SYSTE — Detect
Fingerprint / reachability check for iMonnit Express Unauthenticated Auth Bypass + Path Traversal + Plugin Load SYSTEM RCE !/usr/bin/env python3 -- coding: utf-8 -- """Detection for iMonnit Express Unauthenticated Auth Bypass + Path Traversal + Plugin Load SYSTEM RCE""" from kittysploit import fr...
CVE-2026-117603
Electrum versions prior to 4.7.2 are vulnerable to a spending limit bypass in the Nostr Wallet Connect (NWC) plugin . The vulnerability arises from non-atomic budget checks and millisatoshi truncation , allowing malicious NWC clients to exceed the daily_limit_sat threshold. Attackers can achieve ...
CVE-2026-117602 Electrum before 4.7.2 External Plugin Authorization Bypass Local Code Execution
Electrum 4.6.0 before 4.7.2 contains an authorization bypass in the external plugin loader, which executes a plugin's init.py module when the plugin is marked enabled in the config file, without verifying its plugin-password signature. A rogue local process with write access to the Electrum data...
EUVD-2026-110852
Electrum before 4.7.2 contains a spending limit bypass vulnerability in the Nostr Wallet Connect plugin that allows malicious NWC clients to exceed dailylimitsat by exploiting non-atomic budget checks and millisatoshi truncation. Attackers can send concurrent payinvoice requests that pass...
CVE-2026-117603
Electrum before 4.7.2 contains a spending limit bypass vulnerability in the Nostr Wallet Connect plugin that allows malicious NWC clients to exceed dailylimitsat by exploiting non-atomic budget checks and millisatoshi truncation. Attackers can send concurrent payinvoice requests that pass...
CVE-2026-117602 Electrum before 4.7.2 External Plugin Authorization Bypass Local Code Execution
Electrum 4.6.0 before 4.7.2 contains an authorization bypass in the external plugin loader, which executes a plugin's init.py module when the plugin is marked enabled in the config file, without verifying its plugin-password signature. A rogue local process with write access to the Electrum data...
CVE-2026-117603 Electrum before 4.7.2 Nostr Wallet Connect Plugin Daily Spending Limit Bypass
Electrum before 4.7.2 contains a spending limit bypass vulnerability in the Nostr Wallet Connect plugin that allows malicious NWC clients to exceed dailylimitsat by exploiting non-atomic budget checks and millisatoshi truncation. Attackers can send concurrent payinvoice requests that pass...
CVE-2026-117603 Electrum before 4.7.2 Nostr Wallet Connect Plugin Daily Spending Limit Bypass
Electrum before 4.7.2 contains a spending limit bypass vulnerability in the Nostr Wallet Connect plugin that allows malicious NWC clients to exceed dailylimitsat by exploiting non-atomic budget checks and millisatoshi truncation. Attackers can send concurrent payinvoice requests that pass...
EUVD-2026-110851
Electrum 4.6.0 before 4.7.2 contains an authorization bypass in the external plugin loader, which executes a plugin's init.py module when the plugin is marked enabled in the config file, without verifying its plugin-password signature. A rogue local process with write access to the Electrum data...
CVE-2026-117602
Electrum versions 4.6.0 through 4.7.2 are affected by an authorization bypass in the external plugin loader. The vulnerability exists because the application executes a plugin's __init__.py module when marked as enabled in the configuration file without verifying its plugin-password signature . A...
CVE-2026-117603 Electrum before 4.7.2 Nostr Wallet Connect Plugin Daily Spending Limit Bypass
Electrum before 4.7.2 contains a spending limit bypass vulnerability in the Nostr Wallet Connect plugin that allows malicious NWC clients to exceed dailylimitsat by exploiting non-atomic budget checks and millisatoshi truncation. Attackers can send concurrent payinvoice requests that pass...
CVE-2026-117602
Electrum 4.6.0 before 4.7.2 contains an authorization bypass in the external plugin loader, which executes a plugin's init.py module when the plugin is marked enabled in the config file, without verifying its plugin-password signature. A rogue local process with write access to the Electrum data...
EUVD-2026-110836
The ai-sdlc plugin MCP server through 0.31.2 contains an OS command injection vulnerability that allows attackers to execute commands by supplying shell metacharacters in the repo argument. The unvalidated repo value is interpolated into gh issue view or gh pr view commands run via execSync,...