klever-io vulnerabilities

Newest CVEs

• CVE-2026-82405

  Klever-Go Account takeover: `kleverUpdateAccountPermission` authorizes on attacker-controlled `RecipientAddr` instead of the authenticated caller

  klever-io · klever-go

  High8.7
• CVE-2026-82409

  Klever-Go: Elasticsearch bulk / painless injection via on-chain account name -> explorer/indexer data forgery

  klever-io · klever-go

  High8.4
• CVE-2026-82407

  Klever-Go: Validator registration accepts an unvalidated BLS public key → consensus liveness DoS

  klever-io · klever-go

  High7.0
• CVE-2026-86065

  Klever-Go: Unauthenticated WebSocket /subscribe: no read-size limit, no connection cap, permissive origin -> remote node memory/goroutine exhaustion (DoS)

  klever-io · klever-go

  High7.5
• CVE-2026-86064

  Klever-Go: /log controls global node logging

  klever-io · klever-go

  High8.6
• CVE-2026-82406

  Klever-Go: Zombie-order theft: `Buy` missing `IsClaimed` guard in native marketplace

  klever-io · klever-go

  High7.1
• CVE-2026-55764

  Klever-Go: SFT add-quantity `int64` overflow bypasses a finite per-nonce MaxSupply

  klever-io · klever-go

  High8.7
• CVE-2026-55763

  Klever-Go: Percentage-transfer royalty skips the source debit at exactly-100% splits

  klever-io · klever-go

  High8.7
• CVE-2026-54755

  Klever-Go: Integer overflow in split-royalty validation enables unbounded minting of KLV (native token)

  klever-io · klever-go

  Critical9.6
• CVE-2026-54754

  Klever-Go: Marketplace settlement mints KLV when referral % + royalty % exceed the bid (negative seller share silently skipped)

  klever-io · klever-go

  Critical9.6