PT-2026-89852

AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a stored cross-site scripting vulnerability in the YPTWallet plugin where user-supplied CryptoWallet values are base64-encoded but not HTML-escaped before storage in wallet log.information. Administrators viewing pending...

PT-2026-89854

AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to validate ad impressions in plugin/AD Server/log.php, allowing logged-in users to submit arbitrary label values that trigger unverified wallet credits to campaign video owners. Attackers can repeatedly POST label=start request...

Alby Hub Critical Flaw Could Let Attackers Take Over Internet-Exposed Bitcoin Wallets

Bitcoin wallet company Alby has warned of a critical flaw in Alby Hub that could have let an attacker take over a wallet and send its funds, but only where the owner had made the Hub reachable from the internet. Alby Hub is a self-hosted Lightning wallet, meaning the owner runs it on their own...

CVE-2026-0054

In isCallerAllowed of WalletContextualLocationsService.kt, there is a possible way to get wallet information due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2026-86724

AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a cross-site request forgery vulnerability in plugin/YPTWallet/view/saveBalance.php that allows attackers to set arbitrary wallet balances by relying only on session cookies without token validation. Attackers can craft a...

EUVD-2026-72860

AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a cross-site request forgery vulnerability in plugin/YPTWallet/view/saveBalance.php that allows attackers to set arbitrary wallet balances by relying only on session cookies without token validation. Attackers can craft a...

CVE-2026-86724 AVideo YPTWallet saveBalance.php Cross-Site Request Forgery

AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a cross-site request forgery vulnerability in plugin/YPTWallet/view/saveBalance.php that allows attackers to set arbitrary wallet balances by relying only on session cookies without token validation. Attackers can craft a...

CVE-2026-86724

AVideo (through commit c3edcc274c389816d434acadac07ee78eaf330c1) contains a cross-site request forgery (CSRF) vulnerability in plugin/YPTWallet/view/saveBalance.php . The flaw arises because the endpoint relies solely on session cookies without token validation , allowing an attacker to craft a m...

CVE-2026-86724 AVideo YPTWallet saveBalance.php Cross-Site Request Forgery

AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a cross-site request forgery vulnerability in plugin/YPTWallet/view/saveBalance.php that allows attackers to set arbitrary wallet balances by relying only on session cookies without token validation. Attackers can craft a...

Liquid Hackers Return 3,400 Bitcoin Taken via Elements Bug, Still Holding $47M in BTC

Whoever took nearly 4,000 bitcoin from the Liquid Network on Sunday, September 6, returned 3,400 of it the next day, Bitcoin's public record shows. About 598.5 bitcoin has not come back. Liquid is a Bitcoin sidechain that holds real bitcoin to back a token called L-BTC. The network is still pause...

PT-2026-87121

AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a cross-site request forgery vulnerability in plugin/YPTWallet/view/saveBalance.php that allows attackers to set arbitrary wallet balances by relying only on session cookies without token validation. Attackers can craft a...

CVE-2026-86724: Cross-Site Request Forgery (CSRF)

AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a cross-site request forgery vulnerability in plugin/YPTWallet/view/saveBalance.php that allows attackers to set arbitrary wallet balances by relying only on session cookies without token validation. Attackers can craft a...

MAL-2026-16041 Malicious code in wallet-engine-signing (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 448194cce4cee2143b4cfee29a7c171ecab686469ac508f8fb2ad4d2fb67cf67 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in cb-wallet-analytics (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b29044036392080bdeaddb33f07b5b5b09b7b6f0792f0bc711979738a27d1557 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in cb-wallet-metadata (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ef5687a0934fb8c3bbf63f534898153c0a41c337532e5ad3a8114290badb8a13 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in cb-wallet-store (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 16b89e0045c311aec83f8b4710dc1709b64bf083541c7ad26d639b89f5c98a7b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in wallet-cds-web (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 90a2fd556bde6edbeed9d4c1ebd8dcf4b1c24a5dfda8d70d6cb91cfc7ee3fa2b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in wallet-engine-signing (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 448194cce4cee2143b4cfee29a7c171ecab686469ac508f8fb2ad4d2fb67cf67 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in cb-wallet-env (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 86afbbd47bbbe39fd4f8d9f4146149d70fbb46777c17eebf0c52fd6cef1fef8f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-16031 Malicious code in cb-wallet-store (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 16b89e0045c311aec83f8b4710dc1709b64bf083541c7ad26d639b89f5c98a7b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...