GHSA-5879-4FMR-XWF2

creationtimestamp| type| source ---|---|--- 2026-04-22 01:18:49+00:00| published-proof-of-concept| Telegram/AsK9uQCoE0LPzwbkNe8abRZIpzVzCCIAKmN05DDH2W6pw...

GHSA-793Q-XGJ6-7FRP

creationtimestamp| type| source ---|---|--- 2026-04-22 01:18:49+00:00| published-proof-of-concept| Telegram/AsK9uQCoE0LPzwbkNe8abRZIpzVzCCIAKmN05DDH2W6pw...

CVE-2026-40926

creationtimestamp| type| source ---|---|--- 2026-04-22 01:18:49+00:00| published-proof-of-concept| Telegram/AsK9uQCoE0LPzwbkNe8abRZIpzVzCCIAKmN05DDH2W6pw...

GHSA-FFW8-FWXP-H64W

creationtimestamp| type| source ---|---|--- 2026-04-22 01:18:49+00:00| published-proof-of-concept| Telegram/AsK9uQCoE0LPzwbkNe8abRZIpzVzCCIAKmN05DDH2W6pw...

CVE-2026-26903

creationtimestamp| type| source ---|---|--- 2026-04-22 01:00:05+00:00| published-proof-of-concept| https://t.me/GithubRedTeam/81236 2026-04-22 03:00:07+00:00| published-proof-of-concept| Telegram/4bKDS933-0b55qM7WdBrOYyTgLQnD9rI0Z1t-1c37mSxrw 2026-04-22 03:00:13+00:00| published-proof-of-concept|...

PT-2026-34555

Impact The staking contract accepts UpdateValidator transactions that set new voting key=Some... while omitting new proof of knowledge. this skips the proof-of-knowledge requirement that is needed to prevent BLS rogue-key attacks when public keys are aggregated. Because tendermint macro block...

PT-2026-34554

Impact HistoryTreeProof::verify panics on a malformed proof where history.len != positions.len due to assert eq!history.len, positions.len. The proof object is derived from untrusted p2p responses ResponseTransactionsProof.proof and is therefore attacker-controlled at the network boundary until...

Nimiq security vulnerabilities

Nimiq is an open-source implementation of the Albatross protocol in Rust. Versions of Nimiq prior to 1.3.0 contained a security vulnerability. This vulnerability stemmed from a panic being triggered by HistoryTreeProof::verify in the nimiq-transaction when processing proofs with incorrect formats...

Nimiq data falsification vulnerability

Nimiq is an open-source implementation of the Albatross protocol in Rust. Prior to Nimiq 1.3.0, there was a vulnerability related to data manipulation. This vulnerability stemmed from the UpdateValidator transaction in the nimiq-transaction where the was set with newvotingkey=Some…, but the...

Nimiq input validation vulnerability

Nimiq is an open-source implementation of the Albatross protocol in Rust. Prior to Nimiq 1.3.0, there was a vulnerability related to input validation. This vulnerability stemmed from the use of BitSet.len in SkipBlockProof::verify, which calculates the for slot checks. This process involves...

Taint-Style Vulnerability Detection and Confirmation for Node.Js Packages Using LLM Agent Reasoning

The rapidly evolving Node$.$js ecosystem currently includes millions of packages and is a critical part of modern software supply chains, making vulnerability detection of Node$.$js packages increasingly important. However, traditional program analysis struggles in this setting because of dynamic...

CVE-2026-33471: Improper Input Validation

nimiq-block contains block primitives to be used in Nimiq's Rust implementation. SkipBlockProof::verify computes its quorum check using BitSet.len, then iterates BitSet indices and casts each usize index to u16 slot as u16 for slot lookup. Prior to version 1.3.0, if an attacker can get a...

GHSA-GPH2-J4C9-VHHR

creationtimestamp| type| source ---|---|--- 2026-04-21 23:30:36+00:00| published-proof-of-concept| Telegram/ITN0hTjNGfPMK-REHkV5qJBsGo4t4-tf1bJT5aod5DHh0UQ...

GHSA-2WCG-W3C4-48R7

creationtimestamp| type| source ---|---|--- 2026-04-21 23:30:36+00:00| published-proof-of-concept| Telegram/ITN0hTjNGfPMK-REHkV5qJBsGo4t4-tf1bJT5aod5DHh0UQ...

CVE-2026-40892

creationtimestamp| type| source ---|---|--- 2026-04-21 23:30:36+00:00| published-proof-of-concept| Telegram/ITN0hTjNGfPMK-REHkV5qJBsGo4t4-tf1bJT5aod5DHh0UQ...

GHSA-H5RG-PXX7-R2HJ

creationtimestamp| type| source ---|---|--- 2026-04-21 23:30:36+00:00| published-proof-of-concept| Telegram/ITN0hTjNGfPMK-REHkV5qJBsGo4t4-tf1bJT5aod5DHh0UQ...

GHSA-48WV-JPF4-VJFV

creationtimestamp| type| source ---|---|--- 2026-04-21 23:30:36+00:00| published-proof-of-concept| Telegram/ITN0hTjNGfPMK-REHkV5qJBsGo4t4-tf1bJT5aod5DHh0UQ...

CVE-2026-40903

creationtimestamp| type| source ---|---|--- 2026-04-21 21:27:33+00:00| published-proof-of-concept| Telegram/PLPaRbcJDaPiLP6CzuoYppan71AlFD-MBdwXLbLZgMJCSE...

GHSA-9PP3-53P2-WW9V

creationtimestamp| type| source ---|---|--- 2026-04-21 21:27:33+00:00| published-proof-of-concept| Telegram/PLPaRbcJDaPiLP6CzuoYppan71AlFD-MBdwXLbLZgMJCSE...

CVE-2026-6819

creationtimestamp| type| source ---|---|--- 2026-04-21 21:27:33+00:00| published-proof-of-concept| Telegram/PLPaRbcJDaPiLP6CzuoYppan71AlFD-MBdwXLbLZgMJCSE 2026-05-07 23:07:07+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mlcdfhmjai25...