Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
108 results · page 1 of 3
Oct 16, 2026Coinsnap Bitcoin Crowdfunding: Does not restrict access to the secret used to authenticate its payment gateway webhookCVE-2026-92427 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Coinsnap Bitcoin Crowdfunding WordPress plugin through 1.2.0 does not restrict access to the secret used to authenticate its payment gateway webhook, disclosing it to unauthenticated users and rendering the webhook's signature check ineffective. This allows unauthenticated attackers to forge payment-confirmation notifications and record arbitrary donations as completed, with attacker-chosen amounts, donor names and messages.
- Product
- Coinsnap Bitcoin Crowdfunding
- Affected
- up to 1.2.0
- What to do
- Affects up to 1.2.0. Update Coinsnap Bitcoin Crowdfunding to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 15, 2026A vulnerability was determined in bitcoinj up to 0.17.CVE-2026-111210 · Other software · reported by VulDBMedium 5.5
A vulnerability was determined in bitcoinj up to 0.17. Affected is the function url.openConnection of the file PaymentSession.java of the component Payment Request Handler. Executing a manipulation of the argument pki_type can lead to server-side request forgery. It is possible to launch the attack remotely. The exploit has been publicly disclosed and may be utilized. The project was informed of the problem early through an issue report but has not responded yet.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 14, 2026Cryptocurrency Donation Box – Bitcoin & Crypto Donations: Stored Cross-Site ScriptingCVE-2026-93885 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Cryptocurrency Donation Box – Bitcoin & Crypto Donations plugin for WordPress is vulnerable to Stored Cross-Site Scripting via data_object Parameter in all versions up to, and including, 2.2.13 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is exploitable by unauthenticated attackers because the cdbbc_payment_verify AJAX action is registered under wp_ajax_nopriv_ and its only authentication gate — a nonce check — is bypassable, as the cdbbc_donation_box nonce is publicly exposed to anonymous visitors via the wallets_data JavaScript object emitted by the [crypto-donation-box] shortcode.
- Product
- Cryptocurrency Donation Box – Bitcoin & Crypto Donations
- Affected
- up to 2.2.13
- What to do
- Affects up to 2.2.13. Update Cryptocurrency Donation Box – Bitcoin & Crypto Donations to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Aug 13, 2026Unauthenticated Broken Access Control in Bitcoin Lightning Payment Gateway for WooCommerce (via CLINK) <= 1.0.7 versions.CVE-2026-66431 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Unauthenticated Broken Access Control in Bitcoin Lightning Payment Gateway for WooCommerce (via CLINK) <= 1.0.7 versions.
- Affected
- up to 1.0.7
- What to do
- Affects up to 1.0.7. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 20, 2026Ledger Bitcoin app versions 2.1.0 and 2.1.1 contain an address derivation vulnerability that allows attackers to cause incorrect Bitcoin addresses to be displayCVE-2023-7346 · Other software · Ledger · reported by VulnCheckMedium 4.1
Ledger Bitcoin app versions 2.1.0 and 2.1.1 contain an address derivation vulnerability that allows attackers to cause incorrect Bitcoin addresses to be displayed by exploiting improper handling of miniscript policies containing the a: fragment. Attackers can craft malicious miniscript policies that cause the device to derive and display incorrect receiving addresses, potentially leading to funds being sent to unintended addresses.
- Product
- Ledger Bitcoin app
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddonjon.ledger.comvulncheck.com
May 15, 2026The bitcoinj library is a Java implementation of the Bitcoin protocol.CVE-2026-44714 · Other software · bitcoinj · reported by GitHubHigh 7.5
The bitcoinj library is a Java implementation of the Bitcoin protocol. Prior to 0.17.1, ScriptExecution.correctlySpends() contains two fast-path verification bugs for standard P2PKH and native P2WPKH spends in core/src/main/java/org/bitcoinj/script/ScriptExecution.java. In both branches, bitcoinj verifies an attacker-controlled signature/public-key pair but fails to verify that the public key is the one committed to by the output being spent. As a result, any attacker keypair can satisfy bitcoinj's local verification for arbitrary P2PKH and P2WPKH outputs. This vulnerability is fixed in 0.17.1.
- Product
- bitcoinj
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 5, 2026Bitcoin Core through 28.x has a security issue, the details of which are not disclosed.CVE-2024-52911 · Other software · reported by MITREHigh 7.5
Bitcoin Core through 28.x has a security issue, the details of which are not disclosed. The earliest affected version is 0.14.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbitcoincore.orgbitcoincore.org
Apr 8, 2026Cryptocurrency Donation Box – Bitcoin & Crypto Donations: Missing AuthorizationCVE-2026-39691 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in AdAstraCrypto Cryptocurrency Donation Box – Bitcoin & Crypto Donations cryptocurrency-donation-box allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Cryptocurrency Donation Box – Bitcoin & Crypto Donations: from n/a through <= 2.2.13.
- Product
- Cryptocurrency Donation Box – Bitcoin & Crypto Donations
- Affected
- up to 2.2.13
- What to do
- Affects up to 2.2.13. Update Cryptocurrency Donation Box – Bitcoin & Crypto Donations to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 20, 2026Bitcoin Core 0.13.0 through 29.x has an integer overflow.CVE-2025-46597 · Other software · Bitcoin · reported by MITREHigh 7.5
Bitcoin Core 0.13.0 through 29.x has an integer overflow.
- Product
- Bitcoin Core
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbitcoincore.orggithub.com
Mar 20, 2026Bitcoin Core through 29.0 allows a denial of service via a crafted transaction.CVE-2025-46598 · Other software · Bitcoin · reported by MITREMedium 5.3
Bitcoin Core through 29.0 allows a denial of service via a crafted transaction.
- Product
- Bitcoin Core
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbitcoincore.orggithub.com
Jan 28, 2026Bitcoin Donate Button: Cross-Site Request ForgeryCVE-2026-1380 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Bitcoin Donate Button plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0. This is due to missing or incorrect nonce validation on the settings page. This makes it possible for unauthenticated attackers to modify the plugin's settings, including donation addresses and display configurations, via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
- Product
- Bitcoin Donate Button
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update Bitcoin Donate Button to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Oct 28, 2025Bitcoin Core through 29.0 allows Uncontrolled Resource Consumption (issue 2 of 2).CVE-2025-54605 · Other software · Bitcoin · reported by MITREHigh 7.5
Bitcoin Core through 29.0 allows Uncontrolled Resource Consumption (issue 2 of 2).
- Product
- Bitcoin Core
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbitcoincore.orgen.bitcoin.it
Oct 28, 2025Bitcoin Core through 29.0 allows Uncontrolled Resource Consumption (issue 1 of 2).CVE-2025-54604 · Other software · Bitcoin · reported by MITREHigh 7.5
Bitcoin Core through 29.0 allows Uncontrolled Resource Consumption (issue 1 of 2).
- Product
- Bitcoin Core
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbitcoincore.orgen.bitcoin.it
Sep 5, 2025GoUrl Bitcoin Payment Gateway & Paid Downloads & Membership: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-48102 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in gourl GoUrl Bitcoin Payment Gateway & Paid Downloads & Membership gourl-bitcoin-payment-gateway-paid-downloads-membership allows Stored XSS.This issue affects GoUrl Bitcoin Payment Gateway & Paid Downloads & Membership: from n/a through <= 1.6.6.
- Product
- GoUrl Bitcoin Payment Gateway & Paid Downloads & Membership
- Affected
- up to 1.6.6
- What to do
- Affects up to 1.6.6. Update GoUrl Bitcoin Payment Gateway & Paid Downloads & Membership to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 30, 2025tiny-secp256k1 is a tiny secp256k1 native/JS wrapper.CVE-2024-49365 · Other software · bitcoinjs · reported by GitHubHigh 8.1
tiny-secp256k1 is a tiny secp256k1 native/JS wrapper. Prior to version 1.1.7, a malicious JSON-stringifyable message can be made passing on verify(), when global Buffer is the buffer package. This affects only environments where require('buffer') is the NPM buffer package. Buffer.isBuffer check can be bypassed, resulting in strange objects being accepted as a message, and those messages could trick verify() into returning false-positive true values. This issue has been patched in version 1.1.7.
- Product
- tiny-secp256k1
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 30, 2025tiny-secp256k1 is a tiny secp256k1 native/JS wrapper.CVE-2024-49364 · Other software · bitcoinjs · reported by GitHubHigh 8.1
tiny-secp256k1 is a tiny secp256k1 native/JS wrapper. Prior to version 1.1.7, a private key can be extracted on signing a malicious JSON-stringifiable object, when global Buffer is the buffer package. This affects only environments where require('buffer') is the NPM buffer package. The Buffer.isBuffer check can be bypassed, resulting in k reuse for different messages, leading to private key extraction over a single invalid message (and a second one for which any message/signature could be taken, e.g. previously known valid one). This issue has been patched in version 1.1.7.
- Product
- tiny-secp256k1
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 30, 2025base-x is a base encoder and decoder of any given alphabet using bitcoin style leading zero compression.CVE-2025-27611 · Other software · cryptocoinjs · reported by GitHubHigh 8.7
base-x is a base encoder and decoder of any given alphabet using bitcoin style leading zero compression. Versions 4.0.0, 5.0.0, and all prior to 3.0.11, are vulnerable to attackers potentially deceiving users into sending funds to an unintended address. This issue has been patched in versions 3.0.11, 4.0.1, and 5.0.1.
- Product
- base-x
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 26, 2025Bitcoin / AltCoin Payment Gateway for WooCommerce: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-26541 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CodeSolz Bitcoin / AltCoin Payment Gateway for WooCommerce woo-altcoin-payment-gateway allows Reflected XSS.This issue affects Bitcoin / AltCoin Payment Gateway for WooCommerce: from n/a through <= 1.7.6.
- Product
- Bitcoin / AltCoin Payment Gateway for WooCommerce
- Affected
- up to 1.7.6
- What to do
- Affects up to 1.7.6. Update Bitcoin / AltCoin Payment Gateway for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 3, 2025Bitcoin / AltCoin Payment Gateway for WooCommerce: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-26535 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in CodeSolz Bitcoin / AltCoin Payment Gateway for WooCommerce woo-altcoin-payment-gateway allows Blind SQL Injection.This issue affects Bitcoin / AltCoin Payment Gateway for WooCommerce: from n/a through <= 1.7.6.
- Product
- Bitcoin / AltCoin Payment Gateway for WooCommerce
- Affected
- up to 1.7.6
- What to do
- Affects up to 1.7.6. Update Bitcoin / AltCoin Payment Gateway for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 2, 2025In Bitaxe ESP-Miner before 2.5.0 with AxeOS, one can use an /api/system CSRF attack to update the payout address (aka stratumUser) for a Bitaxe Bitcoin miner, oCVE-2025-27579 · Other software · Bitaxe · reported by MITREMedium 5.4
In Bitaxe ESP-Miner before 2.5.0 with AxeOS, one can use an /api/system CSRF attack to update the payout address (aka stratumUser) for a Bitaxe Bitcoin miner, or change the frequency and voltage settings.
- Product
- ESP-MIner
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 3, 2025Bitcoin and Altcoin Wallets: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-24544 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in dashed-slug.net Bitcoin and Altcoin Wallets wallets allows Reflected XSS.This issue affects Bitcoin and Altcoin Wallets: from n/a through <= 6.3.1.
- Product
- Bitcoin and Altcoin Wallets
- Affected
- up to 6.3.1
- What to do
- Affects up to 6.3.1. Update Bitcoin and Altcoin Wallets to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 24, 2024Bitcoin Lightning Publisher for: Reflected Cross-Site ScriptingCVE-2024-12100 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Bitcoin Lightning Publisher for WordPress plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 1.4.1. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
- Product
- Bitcoin Lightning Publisher for
- Affected
- up to 1.4.1
- What to do
- Affects up to 1.4.1. Update Bitcoin Lightning Publisher for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Dec 8, 2024Bitcoin Core through 27.2 allows transaction-relay jamming via an off-chain protocol attack, a related issue to CVE-2024-52913.CVE-2024-55563 · Other software · Bitcoin · reported by MITREMedium 5.3
Bitcoin Core through 27.2 allows transaction-relay jamming via an off-chain protocol attack, a related issue to CVE-2024-52913. For example, the outcome of an HTLC (Hashed Timelock Contract) can be changed because a flood of transaction traffic prevents propagation of certain Lightning channel transactions.
- Product
- Bitcoin Core
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordariard.github.iobitcoincore.org
Nov 19, 2024Bitcoin Payments: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-51826 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jandal Bitcoin Payments bitcoin-payments allows DOM-Based XSS.This issue affects Bitcoin Payments: from n/a through <= 1.4.2.
- Product
- Bitcoin Payments
- Affected
- up to 1.4.2
- What to do
- Affects up to 1.4.2. Update Bitcoin Payments to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 17, 2024In Bitcoin Core before 25.1, an attacker can cause a node to not download the latest block, because there can be minutes of delay when an announcing peer stallsCVE-2024-52922 · Other software · bitcoin · reported by MITREMedium 6.5
In Bitcoin Core before 25.1, an attacker can cause a node to not download the latest block, because there can be minutes of delay when an announcing peer stalls instead of complying with the peer-to-peer protocol specification.
- Product
- bitcoin_core
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbitcoincore.orgen.bitcoin.it
Nov 17, 2024In Bitcoin Core before 25.0, a peer can affect the download state of other peers by sending a mutated block.CVE-2024-52921 · Other software · bitcoin · reported by MITREMedium 5.3
In Bitcoin Core before 25.0, a peer can affect the download state of other peers by sending a mutated block.
- Product
- bitcoin_core
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbitcoincore.orgen.bitcoin.it
Nov 17, 2024Bitcoin Core before 0.20.0 allows remote attackers to cause a denial of service (infinite loop) via a malformed GETDATA message.CVE-2024-52920 · Other software · bitcoin · reported by MITREHigh 7.5
Bitcoin Core before 0.20.0 allows remote attackers to cause a denial of service (infinite loop) via a malformed GETDATA message.
- Product
- bitcoin_core
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbitcoincore.orgen.bitcoin.it
Nov 17, 2024Bitcoin Core before 22.0 has a CAddrMan nIdCount integer overflow and resultant assertion failure (and daemon exit) via a flood of addr messages.CVE-2024-52919 · Other software · bitcoin · reported by MITREMedium 6.5
Bitcoin Core before 22.0 has a CAddrMan nIdCount integer overflow and resultant assertion failure (and daemon exit) via a flood of addr messages.
- Product
- bitcoin_core
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbitcoincore.orgen.bitcoin.it
Nov 17, 2024Bitcoin-Qt in Bitcoin Core before 0.20.0 allows remote attackers to cause a denial of service (memory consumption and application crash) via a BIP21 r parameterCVE-2024-52918 · Other software · bitcoin · reported by MITREMedium 6.5
Bitcoin-Qt in Bitcoin Core before 0.20.0 allows remote attackers to cause a denial of service (memory consumption and application crash) via a BIP21 r parameter for a URL that has a large file.
- Product
- bitcoin_core
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbitcoincore.orgen.bitcoin.it
Nov 17, 2024Bitcoin Core before 22.0 has a miniupnp infinite loop in which it allocates memory on the basis of random data received over the network, e.g., large M-SEARCH rCVE-2024-52917 · Other software · bitcoin · reported by MITREMedium 6.5
Bitcoin Core before 22.0 has a miniupnp infinite loop in which it allocates memory on the basis of random data received over the network, e.g., large M-SEARCH replies from a fake UPnP device.
- Product
- bitcoin_core
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbitcoincore.orgen.bitcoin.it
Nov 17, 2024Bitcoin Core before 0.15.0 allows a denial of service (OOM kill of a daemon process) via a flood of minimum difficulty headers.CVE-2024-52916 · Other software · bitcoin · reported by MITREHigh 7.5
Bitcoin Core before 0.15.0 allows a denial of service (OOM kill of a daemon process) via a flood of minimum difficulty headers.
- Product
- bitcoin_core
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbitcoincore.orgen.bitcoin.it
Nov 17, 2024Bitcoin Core before 0.20.0 allows remote attackers to cause a denial of service (memory consumption) via a crafted INV message.CVE-2024-52915 · Other software · bitcoin · reported by MITREHigh 7.5
Bitcoin Core before 0.20.0 allows remote attackers to cause a denial of service (memory consumption) via a crafted INV message.
- Product
- bitcoin_core
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbitcoincore.orgen.bitcoin.it
Nov 17, 2024In Bitcoin Core before 0.18.0, a node could be stalled for hours when processing the orphans of a crafted unconfirmed transaction.CVE-2024-52914 · Other software · bitcoin · reported by MITREHigh 7.5
In Bitcoin Core before 0.18.0, a node could be stalled for hours when processing the orphans of a crafted unconfirmed transaction.
- Product
- bitcoin_core
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbitcoincore.orgen.bitcoin.it
Nov 17, 2024In Bitcoin Core before 0.21.0, an attacker could prevent a node from seeing a specific unconfirmed transaction, because transaction re-requests are mishandled.CVE-2024-52913 · Other software · bitcoin · reported by MITREMedium 5.3
In Bitcoin Core before 0.21.0, an attacker could prevent a node from seeing a specific unconfirmed transaction, because transaction re-requests are mishandled.
- Product
- bitcoin_core
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbitcoincore.orgen.bitcoin.it
Nov 17, 2024Bitcoin Core before 0.21.0 allows a network split that is resultant from an integer overflow (calculating the time offset for newly connecting peers) and an absCVE-2024-52912 · Other software · bitcoin · reported by MITREHigh 7.5
Bitcoin Core before 0.21.0 allows a network split that is resultant from an integer overflow (calculating the time offset for newly connecting peers) and an abs64 logic bug.
- Product
- bitcoin_core
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbitcoincore.orgen.bitcoin.it
Nov 17, 2024Bitcoin Core before 24.0.1 allows remote attackers to cause a denial of service (daemon crash) via a flood of low-difficulty header chains (aka a "Chain Width ECVE-2019-25220 · Other software · bitcoin · reported by MITREHigh 7.5
Bitcoin Core before 24.0.1 allows remote attackers to cause a denial of service (daemon crash) via a flood of low-difficulty header chains (aka a "Chain Width Expansion" attack) because a node does not first verify that a presented chain has enough work before committing to store it.
- Product
- bitcoin_core
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbitcoincore.orgen.bitcoin.it
Nov 17, 2024miniupnp before 4c90b87, as used in Bitcoin Core before 0.12 and other products, lacks checks for snprintf return values, leading to a buffer overflow and signiCVE-2015-20111 · Other software · bitcoin · reported by MITRECritical 9.8
miniupnp before 4c90b87, as used in Bitcoin Core before 0.12 and other products, lacks checks for snprintf return values, leading to a buffer overflow and significant data leak, a different vulnerability than CVE-2019-12107. In Bitcoin Core before 0.12, remote code execution was possible in conjunction with CVE-2015-6031 exploitation.
- Product
- bitcoin_core
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbitcoincore.orgen.bitcoin.it
Oct 11, 2024btcd is an alternative full node bitcoin implementation written in Go (golang).CVE-2024-38365 · Other software · btcsuite · reported by GitHubHigh 7.4
btcd is an alternative full node bitcoin implementation written in Go (golang). The btcd Bitcoin client (versions 0.10 to 0.24) did not correctly re-implement Bitcoin Core's "FindAndDelete()" functionality. This logic is consensus-critical: the difference in behavior with the other Bitcoin clients can lead to btcd clients accepting an invalid Bitcoin block (or rejecting a valid one). This consensus failure can be leveraged to cause a chain split (accepting an invalid Bitcoin block) or be exploited to DoS the btcd nodes (rejecting a valid Bitcoin block). An attacker can create a standard transaction where FindAndDelete doesn't return a match but removeOpCodeByData does making btcd get a different sighash, leading to a chain split. Importantly, this vulnerability can be exploited remotely by any Bitcoin user and does not require any hash power. This is because the difference in behavior can be triggered by a "standard" Bitcoin transaction, that is a transaction which gets relayed through the P2P network before it gets included in a Bitcoin block. `removeOpcodeByData(script []byte, dataToRemove []byte)` removes any data pushes from `script` that contain `dataToRemove`. However, `FindA
- Product
- btcd
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddelvingbitcoin.orggithub.com
Oct 10, 2024Bitcoin Core before 25.0 allows remote attackers to cause a denial of service (blocktxn message-handling assertion and node exit) by including transactions in aCVE-2024-35202 · Other software · bitcoin · reported by MITREHigh 7.5
Bitcoin Core before 25.0 allows remote attackers to cause a denial of service (blocktxn message-handling assertion and node exit) by including transactions in a blocktxn message that are not committed to in a block's merkle root. FillBlock can be called twice for one PartiallyDownloadedBlock instance.
- Product
- bitcoin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbitcoincore.orgen.bitcoin.it
Aug 18, 2024The Miniscript (aka rust-miniscript) library before 12.2.0 for Rust allows stack consumption because it does not properly track tree depth.CVE-2024-44073 · Other software · rust-bitcoin · reported by MITREHigh 7.5
The Miniscript (aka rust-miniscript) library before 12.2.0 for Rust allows stack consumption because it does not properly track tree depth.
- Product
- miniscript
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 30, 2024In Bitcoin Core through 27.0 and Bitcoin Knots before 25.1.knots20231115, tapscript lacks a policy size limit check, a different issue than CVE-2023-50428.CVE-2024-34149 · Other software · bitcoincore · reported by MITREMedium 6.3
In Bitcoin Core through 27.0 and Bitcoin Knots before 25.1.knots20231115, tapscript lacks a policy size limit check, a different issue than CVE-2023-50428. NOTE: some parties oppose this new limit check (for example, because they agree with the objective but disagree with the technical mechanism, or because they have a different objective).
- Product
- bitcoin_core
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 30, 2024Weak password requirement vulnerability in Lamassu Bitcoin ATM Douro machines, in its 7.1 version , which allows a local user to interact with the machine whCVE-2024-0676 · Other software · Lamassu · reported by cve-coordination@incibe.esMedium 5.6
Weak password requirement vulnerability in Lamassu Bitcoin ATM Douro machines, in its 7.1 version , which allows a local user to interact with the machine where the application is installed, retrieve stored hashes from the machine and crack long 4-character passwords using a dictionary attack.
- Product
- Bitcoin ATM Douro machines
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 30, 2024Vulnerability of improper checking for unusual or exceptional conditions in Lamassu Bitcoin ATM Douro machines, in its 7.1 version, the exploitation of whichCVE-2024-0675 · Other software · Lamassu · reported by cve-coordination@incibe.esMedium 6.3
Vulnerability of improper checking for unusual or exceptional conditions in Lamassu Bitcoin ATM Douro machines, in its 7.1 version, the exploitation of which could allow an attacker with physical access to the ATM to escape kiosk mode, access the underlying Xwindow interface and execute arbitrary commands as an unprivileged user.
- Product
- Bitcoin ATM Douro machines
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 30, 2024Privilege escalation vulnerability in Lamassu Bitcoin ATM Douro machines, in its 7.1 version, which could allow a local user to acquire root permissions by modiCVE-2024-0674 · Other software · Lamassu · reported by cve-coordination@incibe.esMedium 6.3
Privilege escalation vulnerability in Lamassu Bitcoin ATM Douro machines, in its 7.1 version, which could allow a local user to acquire root permissions by modifying the updatescript.js, inserting special code inside the script and creating the done.txt file. This would cause the watchdog process to run as root and execute the payload stored in the updatescript.js.
- Product
- Bitcoin ATM Douro machines
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 9, 2023In Bitcoin Core through 26.0 and Bitcoin Knots before 25.1.knots20231115, datacarrier size limits can be bypassed by obfuscating data as code (e.g., with OP_FALCVE-2023-50428 · Other software · Bitcoin · reported by MITREMedium 5.3
In Bitcoin Core through 26.0 and Bitcoin Knots before 25.1.knots20231115, datacarrier size limits can be bypassed by obfuscating data as code (e.g., with OP_FALSE OP_IF), as exploited in the wild by Inscriptions in 2022 and 2023. NOTE: although this is a vulnerability from the perspective of the Bitcoin Knots project, some others consider it "not a bug."
- Product
- Bitcoin Core
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorden.bitcoin.itgithub.com
Sep 25, 2023MultiBit HD before 0.1.2 allows attackers to conduct bit-flipping attacks that insert unspendable Bitcoin addresses into the list that MultiBit uses to send feeCVE-2015-6964 · Other software · multibit · reported by MITREMedium 5.3
MultiBit HD before 0.1.2 allows attackers to conduct bit-flipping attacks that insert unspendable Bitcoin addresses into the list that MultiBit uses to send fees to the developers. (Attackers cannot realistically steal these fees for themselves.) This occurs because there is no message authentication code (MAC).
- Product
- multibit_hd
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordweb.archive.orgweb.archive.org
Aug 8, 2023The cryptocurrency wallet entropy seeding mechanism used in Libbitcoin Explorer 3.0.0 through 3.6.0 is weak, aka the Milk Sad issue.CVE-2023-39910 · Other software · Libbitcoin · reported by MITREHigh 7.5
The cryptocurrency wallet entropy seeding mechanism used in Libbitcoin Explorer 3.0.0 through 3.6.0 is weak, aka the Milk Sad issue. The use of an mt19937 Mersenne Twister PRNG restricts the internal entropy to 32 bits regardless of settings. This allows remote attackers to recover any wallet private keys generated from "bx seed" entropy output and steal funds. (Affected users need to move funds to a secure new cryptocurrency wallet.) NOTE: the vendor's position is that there was sufficient documentation advising against "bx seed" but others disagree. NOTE: this was exploited in the wild in June and July 2023.
- Product
- Libbitcoin Explorer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 6, 2023Memory management and protection issues in Bitcoin Core v22 allows attackers to modify the stored sending address within the app's memory, potentially allowing CVE-2023-37192 · Other software · Bitcoin · reported by MITREHigh 7.5
Memory management and protection issues in Bitcoin Core v22 allows attackers to modify the stored sending address within the app's memory, potentially allowing them to redirect Bitcoin transactions to wallets of their own choosing.
- Product
- Bitcoin Core
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbitcoin.orgsatoshihunter1.blogspot.com
May 22, 2023Bitcoin Core before 24.1, when debug mode is not used, allows attackers to cause a denial of service (e.g., CPU consumption) because draining the inventory-to-sCVE-2023-33297 · Other software · Bitcoin · reported by MITREHigh 7.5
Bitcoin Core before 24.1, when debug mode is not used, allows attackers to cause a denial of service (e.g., CPU consumption) because draining the inventory-to-send queue is inefficient, as exploited in the wild in May 2023.
- Product
- Bitcoin Core
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorden.bitcoin.itgithub.com
May 8, 2023Bitcoin / AltCoin Payment Gateway for WooCommerce & Multivendor store / shop: Does not properly sanitise and escape a parameter before using it in a SQL statementCVE-2022-4118 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Bitcoin / AltCoin Payment Gateway for WooCommerce & Multivendor store / shop WordPress plugin through 1.7.1 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by authenticated users
- Product
- Bitcoin / AltCoin Payment Gateway for WooCommerce & Multivendor store / shop
- Affected
- up to 1.7.1
- What to do
- Affects up to 1.7.1. Update Bitcoin / AltCoin Payment Gateway for WooCommerce & Multivendor store / shop to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.