CVE-2026-38751

creationtimestamp| type| source ---|---|--- 2026-04-23 15:00:13+00:00| published-proof-of-concept| Telegram/7RYD-KdzD7Ne0F0JHI5ZiA7kNScXDMi5uB6zWqPs3lSPss 2026-04-23 21:00:04+00:00| published-proof-of-concept| Telegram/iDpciKSSZoAuKLzHCBxsxmN8Po66tQiLuLn1GSrxH7iP5o 2026-04-24 06:00:05+00:00|...

Automated-CSRF-PoC-Generator

Description: A specialized Python script designed to automate th...

vlnr

vlnr: Autonomous Vulnerability Discovery Pipeline !Python 3...

CVE-2026-6018

creationtimestamp| type| source ---|---|--- 2026-04-23 05:00:04+00:00| published-proof-of-concept| https://t.me/GithubRedTeam/81383...

CVE-2026-41680

creationtimestamp| type| source ---|---|--- 2026-04-23 01:54:48+00:00| published-proof-of-concept| https://github.com/markedjs/marked/security/advisories/GHSA-6v9c-7cg6-27q7 2026-04-24 19:23:03+00:00| published-proof-of-concept| Telegram/KzwiN8QhKmj3TuqYtGeX9siiyoqjfAY8f7zipbEz0Wiqhk 2026-04-30...

GHSA-6973-8887-87FF

creationtimestamp| type| source ---|---|--- 2026-04-22 21:21:17+00:00| published-proof-of-concept| Telegram/he0Z1Xxb4PMjQ5eYVBKNYLHtJZg-G0d3XJmG72co7nWMuw...

CVE-2026-22192

creationtimestamp| type| source ---|---|--- 2026-04-22 21:20:09+00:00| published-proof-of-concept| Telegram/wn9Qi4rYZ0wmwM3QnYEzwEWgvyumLNiA44jY2rXcciEdxg...

CVE-2026-22191

creationtimestamp| type| source ---|---|--- 2026-04-22 21:20:09+00:00| published-proof-of-concept| Telegram/wn9Qi4rYZ0wmwM3QnYEzwEWgvyumLNiA44jY2rXcciEdxg 2026-04-22 21:21:17+00:00| published-proof-of-concept| Telegram/he0Z1Xxb4PMjQ5eYVBKNYLHtJZg-G0d3XJmG72co7nWMuw...

GHSA-G2QJ-PRGH-4G9R

creationtimestamp| type| source ---|---|--- 2026-04-22 21:20:09+00:00| published-proof-of-concept| Telegram/wn9Qi4rYZ0wmwM3QnYEzwEWgvyumLNiA44jY2rXcciEdxg...

CVE-2026-22199

creationtimestamp| type| source ---|---|--- 2026-04-22 21:20:09+00:00| published-proof-of-concept| Telegram/wn9Qi4rYZ0wmwM3QnYEzwEWgvyumLNiA44jY2rXcciEdxg...

CVE-2026-34068

nimiq-transaction provides the transaction primitive to be used in Nimiq's Rust implementation. Prior to version 1.3.0, the staking contract accepts UpdateValidator transactions that set newvotingkey=Some... while omitting newproofofknowledge. this skips the proof-of-knowledge requirement that is...

CVE-2026-34067

nimiq-transaction provides the transaction primitive to be used in Nimiq's Rust implementation. Prior to version 1.3.0, HistoryTreeProof::verify panics on a malformed proof where history.len != positions.len due to asserteq!history.len, positions.len. The proof object is derived from untrusted p2...

Uncontrolled Recursion

Overview xmldom is an A pure JavaScript W3C standard-based XML DOM Level 2 Core DOMParser and XMLSerializer module. Affected versions of this package are vulnerable to Uncontrolled Recursion in the recursive processing of deeply nested XML documents by several DOM-related operations, including...

CVE-2026-33471

nimiq-block contains block primitives to be used in Nimiq's Rust implementation. SkipBlockProof::verify computes its quorum check using BitSet.len, then iterates BitSet indices and casts each usize index to u16 slot as u16 for slot lookup. Prior to version 1.3.0, if an attacker can get a...

CVE-2026-34068 nimiq-transaction: UpdateValidator transactions allows voting key change without proof-of-knowledge

nimiq-transaction provides the transaction primitive to be used in Nimiq's Rust implementation. Prior to version 1.3.0, the staking contract accepts UpdateValidator transactions that set newvotingkey=Some... while omitting newproofofknowledge. this skips the proof-of-knowledge requirement that is...

CVE-2026-34068 nimiq-transaction: UpdateValidator transactions allows voting key change without proof-of-knowledge

nimiq-transaction provides the transaction primitive to be used in Nimiq's Rust implementation. Prior to version 1.3.0, the staking contract accepts UpdateValidator transactions that set newvotingkey=Some... while omitting newproofofknowledge. this skips the proof-of-knowledge requirement that is...

CVE-2026-34068

Summary (CVE-2026-34068) Nimiq-transaction’s staking contract (Rust) prior to v1.3.0 accepts UpdateValidator transactions that set new_voting_key=Some(...) without including new_proof_of_knowledge, bypassing the PoK requirement used to prevent BLS rogue-key attacks in aggregated signatures. Since...

CVE-2026-34068

nimiq-transaction provides the transaction primitive to be used in Nimiq's Rust implementation. Prior to version 1.3.0, the staking contract accepts UpdateValidator transactions that set newvotingkey=Some... while omitting newproofofknowledge. this skips the proof-of-knowledge requirement that is...

EUVD-2026-25086

nimiq-transaction provides the transaction primitive to be used in Nimiq's Rust implementation. Prior to version 1.3.0, the staking contract accepts UpdateValidator transactions that set newvotingkey=Some... while omitting newproofofknowledge. this skips the proof-of-knowledge requirement that is...

CVE-2026-34068 nimiq-transaction: UpdateValidator transactions allows voting key change without proof-of-knowledge

nimiq-transaction provides the transaction primitive to be used in Nimiq's Rust implementation. Prior to version 1.3.0, the staking contract accepts UpdateValidator transactions that set newvotingkey=Some... while omitting newproofofknowledge. this skips the proof-of-knowledge requirement that is...