[ Vendor · 6 CVEs ]
klever-io
CVEs affecting klever-io published in the last 30 days, plus any klever-io CVE on CISA's exploited list.
| CVE | Published | Severity | Vulnerability | Signals |
|---|---|---|---|---|
| CVE-2026-86065 | 23 Sep 2026 | CVSS 7.5 | Klever-Go: Unauthenticated WebSocket /subscribe: no read-size limit, no connection cap, permissive origin -> remote node memory/goroutine exhaustion (DoS)Klever-Go is the Go implementation of the Klever blockchain protocol. Prior to 1.7.20, the default-open GET /subscribe endpoint in… | Fix |
| CVE-2026-86064 | 23 Sep 2026 | CVSS 8.6 | Klever-Go: /log controls global node loggingKlever-Go is the Go implementation of the Klever blockchain protocol. Prior to 1.7.20, the default-open GET /log WebSocket route configured in… | Fix |
| CVE-2026-82405 | 23 Sep 2026 | CVSS 8.7 | Klever-Go Account takeover: `kleverUpdateAccountPermission` authorizes on attacker-controlled `RecipientAddr` instead of the authenticated callerKlever-Go is the Go implementation of the Klever blockchain protocol. Prior to 1.7.20, the KleverUpdateAccountPermission built-in authorizes… | Fix |
| CVE-2026-82406 | 23 Sep 2026 | CVSS 7.1 | Klever-Go: Zombie-order theft: `Buy` missing `IsClaimed` guard in native marketplaceKlever-Go is the Go implementation of the Klever blockchain protocol. Prior to 1.7.20, the native marketplace function core/kapp/market/market.go Buy… | Fix |
| CVE-2026-82407 | 23 Sep 2026 | CVSS 7.0 | Klever-Go: Validator registration accepts an unvalidated BLS public key → consensus liveness DoSKlever-Go is the Go implementation of the Klever blockchain protocol. Prior to 1.7.20, core/kapp/validators/validators.go Register and the runtime… | Fix |
| CVE-2026-82409 | 23 Sep 2026 | CVSS 8.4 | Klever-Go: Elasticsearch bulk / painless injection via on-chain account name -> explorer/indexer data forgeryKlever-Go is the Go implementation of the Klever blockchain protocol. Prior to 1.7.20, indexer/common.go serializedDataForUpdateAccounts places the… | Fix |