Zebra 4.5.0 Consensus Split via P2SH Sigop Overcount
CVE-2026-104430
Zebra zebrad 4.5.0 and zebra-script 7.0.0 count P2SH redeem script signature operations in legacy mode rather than zcash
2026-10-03 归档
今日共收录 1361 条安全情报，包含 499 个 CVE，489 篇安全通告，以及 100 篇研究论文。
← 返回归档列表Zebra before 6.0.0-rc.0 Per-Peer Mempool Admission Bypass via P2P tx Messages
CVE-2026-104429
Zebra (zebrad) 5.0.0 before 6.0.0-rc.0 does not apply its per-peer mempool admission cap to transactions received as dir
Zebra before 11.0.0 Denial of Service via getblock Verbosity 2
CVE-2026-104428
The getblock RPC method in zebra-rpc before 11.0.0, used by the Zcash Foundation's Zebra node, panics on verbosity 2 for
Zebra before 6.1.0 Chain Stall via Stale parent_error_map Entry
CVE-2026-104427
Zebra before 6.1.0 contains an incomplete cleanup vulnerability in the state write task that allows remote unauthenticat
Zebra before 6.1.0 Quadratic Complexity DoS via Block Transparent Value Check
CVE-2026-104426
Zebra before 6.1.0 contains an inefficient algorithmic complexity vulnerability in remaining_transaction_value that clon
Zebra before 6.1.0 Batch-Verification Poisoning DoS via Unattributed Pushed Transactions
CVE-2026-104425
ZcashFoundation Zebra before 6.1.0 contains a resource exhaustion vulnerability that allows unauthenticated peers to deg
Zebra before 6.1.0 Incorrect Block Size Calculation in getblocktemplate
CVE-2026-104424
Zebra before 6.1.0 contains an incorrect calculation vulnerability in its ZIP-317 block template selector that omits hea
Zebra before 6.2.1 Denial of Service via Uncapped V6 Shielded Proof Verification
CVE-2026-104423
Zebra (zebrad) before 6.2.1 contains an asymmetric resource consumption vulnerability that allows unauthenticated peers
Zebra before 6.3.0 Block Sync Denial of Service via Coinbase scriptSig Rewrite
CVE-2026-104422
The block sync download path in Zebra (zebrad) before 6.3.0 reads a block's height from its unvalidated coinbase scriptS
Zebra before 6.2.1 Block Download Denial of Service via KnownBlock SentHashes Lockout
CVE-2026-104421
Zebra before 6.2.1 contains an incomplete cleanup vulnerability that allows unauthenticated peers to block downloading o
Zebra before 6.3.0 Honest Peer Banning via Far-Ahead FindBlocks Hashes
CVE-2026-104419
Zebra (zebrad) 4.5.0 before 6.3.0 discards which peer supplied the block hashes in FindBlocks responses, then assigns 10
Ghost from 6.10.3 before 6.64.0 RCE via Theme Translation Files
CVE-2026-104418
Ghost from 6.10.3 before 6.64.0 contains a remote code execution vulnerability that allows authenticated administrators
Ghost 1.20.0 before 6.64.0 Path Traversal via Locale Setting
CVE-2026-104417
Ghost from 1.20.0 before 6.64.0 contains a path traversal vulnerability in theme translation file loading that allows au
Ghost 4.39.0 before 6.64.0 Invite Token Disclosure via Admin API
CVE-2026-104416
Ghost from 4.39.0 before 6.64.0 contains an information disclosure vulnerability in the Admin API that allows staff user
Ghost 0.7.2 before 6.64.0 Password Hash Ordering Disclosure via Admin API
CVE-2026-104415
Ghost from 0.7.2 before 6.64.0 contains an information disclosure vulnerability in the Admin API that allows staff-level
Ghost from 2.5.0 before 6.64.0 Stored XSS via oEmbed Photo Responses
CVE-2026-104414
Ghost from 2.5.0 before 6.64.0 contains a stored cross-site scripting vulnerability that allows attackers to inject untr
Ghost 5.94.0 before 6.64.0 Stored XSS via Bookmark Card Images
CVE-2026-104413
Ghost from 5.94.0 before 6.64.0 contains a stored cross-site scripting vulnerability that allows staff users, including
Ghost 0.5.0 before 6.64.0 Privilege Escalation via Staff Role Assignment
CVE-2026-104412
Ghost 0.5.0 before 6.64.0 does not correctly restrict staff role assignment, allowing users with the Editor or Super Edi
Ghost 6.22.1 before 6.64.0 Stored XSS via Local Storage File Uploads
CVE-2026-104411
Ghost from 6.22.1 before 6.64.0 contains a stored cross-site scripting vulnerability that allows staff users to host scr
SiYuan before 3.8.5 Information Disclosure via /api/export/preview
CVE-2026-104410
SiYuan before 3.8.5 contains an information disclosure vulnerability that allows publish readers to read password-protec