🚨 CVE-2026-104430
Zebra zebrad 4.5.0 and zebra-script 7.0.0 count P2SH redeem script signature operations in legacy mode rather than zcashd's accurate P2SH mode, overcounting CHECKMULTISIG preceded by OP_1 through OP_16 as 20 sigops and causing a consensus divergence. Remote attackers can broadcast P2SH spends using low-threshold multisig redeem scripts so that a block zcashd accepts exceeds Zebra's inflated MAX_BLOCK_SIGOPS count, causing Zebra nodes to reject it and stall off the chain.
🎖@cveNotify
Zebra zebrad 4.5.0 and zebra-script 7.0.0 count P2SH redeem script signature operations in legacy mode rather than zcashd's accurate P2SH mode, overcounting CHECKMULTISIG preceded by OP_1 through OP_16 as 20 sigops and causing a consensus divergence. Remote attackers can broadcast P2SH spends using low-threshold multisig redeem scripts so that a block zcashd accepts exceeds Zebra's inflated MAX_BLOCK_SIGOPS count, causing Zebra nodes to reject it and stall off the chain.
🎖@cveNotify
GitHub
P2SH Sigop Undercount Not Correctly Fixed
### Am I affected
You are affected if:
- You run zebrad version v4.5.0 (note that older versions have other vulnerabilites)
- Your node validates blocks on mainnet, testnet, or any network w...
You are affected if:
- You run zebrad version v4.5.0 (note that older versions have other vulnerabilites)
- Your node validates blocks on mainnet, testnet, or any network w...
🚨 CVE-2026-104431
Zebra before 6.0.0 contains a denial of service vulnerability that allows unauthenticated peers to stall Tokio workers by submitting mempool transactions requiring expensive synchronous script verification. Attackers can send non-standard high-sigop P2SH transactions that reach CachedFfiTransaction::is_valid() before standardness checks, saturating the verifier buffer and rendering the node unresponsive.
🎖@cveNotify
Zebra before 6.0.0 contains a denial of service vulnerability that allows unauthenticated peers to stall Tokio workers by submitting mempool transactions requiring expensive synchronous script verification. Attackers can send non-standard high-sigop P2SH transactions that reach CachedFfiTransaction::is_valid() before standardness checks, saturating the verifier buffer and rendering the node unresponsive.
🎖@cveNotify
GitHub
Peer-Advertised Mempool Transactions Can Stall Tokio Workers via Synchronous Transparent Script FFI Before Policy Rejection
## Am I affected?
You are affected if you run an affected version with default peer-to-peer networking. The condition is reachable by any peer that can connect and send transactions; no authenti...
You are affected if you run an affected version with default peer-to-peer networking. The condition is reachable by any peer that can connect and send transactions; no authenti...
🚨 CVE-2026-104432
Zebra before 6.3.0 contains an improper exceptional condition check in ChainSync::obtain_tips that discards valid one-hash FindBlocks responses, falsely reporting close-to-tip status. Peers returning only the next block hash cause a zero-length sync sample, making the /ready endpoint return 200 OK while the node remains behind the tip.
🎖@cveNotify
Zebra before 6.3.0 contains an improper exceptional condition check in ChainSync::obtain_tips that discards valid one-hash FindBlocks responses, falsely reporting close-to-tip status. Peers returning only the next block hash cause a zero-length sync sample, making the /ready endpoint return 200 OK while the node remains behind the tip.
🎖@cveNotify
GitHub
Valid one-hash FindBlocks response discarded, causing false close-to-tip status and a false /ready result while behind the chain…
# Valid one-hash FindBlocks response discarded, causing false close-to-tip status and a false /ready result while behind the chain tip
| Field | Value |
|---|---|
| Severity | Medium |
| CVSS...
| Field | Value |
|---|---|
| Severity | Medium |
| CVSS...
🚨 CVE-2026-104434
ZcashFoundation Zebra zebra-rpc before 8.0.0 and zebrad before 4.5.0 contain a reachable assertion in the z_listunifiedreceivers RPC handler, which calls expect() on Sapling receiver parsing that fails for Unified Addresses carrying invalid Jubjub points. Authenticated RPC clients can submit such an address to abort the zebrad process, repeatably keeping the node offline.
🎖@cveNotify
ZcashFoundation Zebra zebra-rpc before 8.0.0 and zebrad before 4.5.0 contain a reachable assertion in the z_listunifiedreceivers RPC handler, which calls expect() on Sapling receiver parsing that fails for Unified Addresses carrying invalid Jubjub points. Authenticated RPC clients can submit such an address to abort the zebrad process, repeatably keeping the node offline.
🎖@cveNotify
GitHub
Full node denial of service via crafted Sapling receiver in z_listunifiedreceivers
### Am I affected
You are affected if:
1. You run `zebrad` up to and including `v4.4.1`.
2. Your `zebrad.toml` sets `rpc.listen_addr` to a TCP address (RPC server is enabled).
3. An attacke...
You are affected if:
1. You run `zebrad` up to and including `v4.4.1`.
2. Your `zebrad.toml` sets `rpc.listen_addr` to a TCP address (RPC server is enabled).
3. An attacke...
🚨 CVE-2026-104435
Zebra zebrad 4.4.0 and zebra-script 6.0.0 fail to enforce a ZIP-244 consensus rule, accepting V5 transparent inputs signed with SIGHASH_SINGLE that lack a corresponding output. Attackers can broadcast crafted V5 transactions with more inputs than outputs that Zebra accepts but zcashd rejects, causing a network consensus split.
🎖@cveNotify
Zebra zebrad 4.4.0 and zebra-script 6.0.0 fail to enforce a ZIP-244 consensus rule, accepting V5 transparent inputs signed with SIGHASH_SINGLE that lack a corresponding output. Attackers can broadcast crafted V5 transactions with more inputs than outputs that Zebra accepts but zcashd rejects, causing a network consensus split.
🎖@cveNotify
GitHub
Zebra v4.4.0 still accepts V5 SIGHASH_SINGLE without a corresponding output
# Consensus Divergence in V5 Transparent SIGHASH_SINGLE With No Corresponding Output
## Summary
Zebra failed to enforce a ZIP-244 consensus rule for V5 transparent transactions: when an input...
## Summary
Zebra failed to enforce a ZIP-244 consensus rule for V5 transparent transactions: when an input...
🚨 CVE-2026-104436
Zebra before 4.5.0 contains an uncontrolled resource consumption vulnerability that allows remote P2P peers to exhaust blocking-pool threads by sending oversized block locator vectors. Attackers can send getblocks or getheaders messages with up to 65,535 locator hashes, triggering per-hash chain lookups that degrade block validation, RPC, and mempool performance.
🎖@cveNotify
Zebra before 4.5.0 contains an uncontrolled resource consumption vulnerability that allows remote P2P peers to exhaust blocking-pool threads by sending oversized block locator vectors. Attackers can send getblocks or getheaders messages with up to 65,535 locator hashes, triggering per-hash chain lookups that degrade block validation, RPC, and mempool performance.
🎖@cveNotify
GitHub
getblocks/getheaders locator CPU amplification via uncapped vector length
### Am I affected
You are affected if:
1. You run `zebrad` up to and including `v4.4.1`.
2. Your node accepts inbound P2P connections.
### Summary
The `read_getblocks` and `read_gethea...
You are affected if:
1. You run `zebrad` up to and including `v4.4.1`.
2. Your node accepts inbound P2P connections.
### Summary
The `read_getblocks` and `read_gethea...
🚨 CVE-2026-104437
Zebra before 4.4.0 contains a consensus divergence vulnerability in V5 transparent signature verification, computing a ZIP-244 digest for SIGHASH_SINGLE inputs lacking corresponding outputs instead of failing. Attackers can craft V5 transactions with fewer outputs than inputs that Zebra accepts and templates via getblocktemplate, producing blocks zcashd rejects.
🎖@cveNotify
Zebra before 4.4.0 contains a consensus divergence vulnerability in V5 transparent signature verification, computing a ZIP-244 digest for SIGHASH_SINGLE inputs lacking corresponding outputs instead of failing. Attackers can craft V5 transactions with fewer outputs than inputs that Zebra accepts and templates via getblocktemplate, producing blocks zcashd rejects.
🎖@cveNotify
GitHub
Zebra Transparent SIGHASH_SINGLE Corresponding-Output Handling Diverges From zcashd
# `Zebra` Transparent `SIGHASH_SINGLE` Corresponding-Output Handling Diverges From `zcashd`
### Summary
For V5+ transparent spends, `Zebra` and `zcashd` disagree on the same consensus rule: `SI...
### Summary
For V5+ transparent spends, `Zebra` and `zcashd` disagree on the same consensus rule: `SI...
🚨 CVE-2026-104438
YesWiki before 4.6.7 contains a missing authorization vulnerability in the listpagestag and includepages actions of the tags tool, which enumerate pages without applying read-ACL filtering. Unauthenticated or unprivileged attackers can embed these actions with a chosen tag or page name to disclose the names and body-derived titles of ACL-restricted pages.
🎖@cveNotify
YesWiki before 4.6.7 contains a missing authorization vulnerability in the listpagestag and includepages actions of the tags tool, which enumerate pages without applying read-ACL filtering. Unauthenticated or unprivileged attackers can embed these actions with a chosen tag or page name to disclose the names and body-derived titles of ACL-restricted pages.
🎖@cveNotify
GitHub
Tags actions disclose names of ACL-restricted pages
### Summary
The tags actions `{{listpagestag}}` and `{{includepages}}` enumerate pages by tag or by name
without applying read-ACL filtering, exposing the existence, names, and titles of pages tha...
The tags actions `{{listpagestag}}` and `{{includepages}}` enumerate pages by tag or by name
without applying read-ACL filtering, exposing the existence, names, and titles of pages tha...
🚨 CVE-2026-104439
YesWiki before 4.6.7 contains a user enumeration vulnerability in LostPasswordAction.php that allows unauthenticated attackers to confirm registered email addresses through differing responses. Attackers can submit emails to the MotDePassePerdu recovery page without rate limiting to identify valid accounts for targeted phishing or password-spraying.
🎖@cveNotify
YesWiki before 4.6.7 contains a user enumeration vulnerability in LostPasswordAction.php that allows unauthenticated attackers to confirm registered email addresses through differing responses. Attackers can submit emails to the MotDePassePerdu recovery page without rate limiting to identify valid accounts for targeted phishing or password-spraying.
🎖@cveNotify
GitHub
User enumeration via the lost-password flow
### Summary
The password-recovery page answers differently depending on whether the submitted email
belongs to an existing account, letting any unauthenticated attacker confirm which email
address...
The password-recovery page answers differently depending on whether the submitted email
belongs to an existing account, letting any unauthenticated attacker confirm which email
address...
🚨 CVE-2026-104440
YesWiki before 4.6.7 contains a blind server-side request forgery vulnerability that allows unauthenticated attackers to make arbitrary server-side requests via the idtypeannonce parameter of /api/entries/bazarlist. Because isValidURL() always returns true, attackers can supply internal URLs fetched by curl in loadURLContent() to probe internal networks and reach internal services or metadata endpoints.
🎖@cveNotify
YesWiki before 4.6.7 contains a blind server-side request forgery vulnerability that allows unauthenticated attackers to make arbitrary server-side requests via the idtypeannonce parameter of /api/entries/bazarlist. Because isValidURL() always returns true, attackers can supply internal URLs fetched by curl in loadURLContent() to probe internal networks and reach internal services or metadata endpoints.
🎖@cveNotify
GitHub
Unauthenticated blind Server-Side Request Forgery in the public Bazar API via idtypeannonce
### Summary
The public API route `GET /api/entries/bazarlist` accepts an attacker-controlled URL in the
`idtypeannonce` parameter and fetches it server-side with no scheme, host, or IP
validation,...
The public API route `GET /api/entries/bazarlist` accepts an attacker-controlled URL in the
`idtypeannonce` parameter and fetches it server-side with no scheme, host, or IP
validation,...
🚨 CVE-2026-104441
YesWiki before 4.6.7 contains an unauthenticated server-side request forgery vulnerability that allows remote attackers to make the server fetch arbitrary hosts and ports via the {{valeur}} action's url parameter. Attackers can submit the action through the content parameter of handlers/page/render.php to probe internal HTTP services and read back response content matching fiche markup.
🎖@cveNotify
YesWiki before 4.6.7 contains an unauthenticated server-side request forgery vulnerability that allows remote attackers to make the server fetch arbitrary hosts and ports via the {{valeur}} action's url parameter. Attackers can submit the action through the content parameter of handlers/page/render.php to probe internal HTTP services and read back response content matching fiche markup.
🎖@cveNotify
GitHub
Unauthenticated Server-Side Request Forgery with partial read-back via the {{valeur}} action
### Summary
Any unauthenticated visitor can make the YesWiki server perform HTTP requests to arbitrary
hosts and ports via the `{{valeur}}` wiki action, and parts of the fetched response are
echoe...
Any unauthenticated visitor can make the YesWiki server perform HTTP requests to arbitrary
hosts and ports via the `{{valeur}}` wiki action, and parts of the fetched response are
echoe...
🚨 CVE-2026-104442
YesWiki before 4.6.7 contains an unauthenticated server-side request forgery vulnerability that allows remote attackers to make the server fetch arbitrary URLs by supplying a syndication action through the render handler's content parameter. Attackers can target internal hosts and ports, read back fetched feed content in the rendered page, and cause feed enclosures to be downloaded into the files directory.
🎖@cveNotify
YesWiki before 4.6.7 contains an unauthenticated server-side request forgery vulnerability that allows remote attackers to make the server fetch arbitrary URLs by supplying a syndication action through the render handler's content parameter. Attackers can target internal hosts and ports, read back fetched feed content in the rendered page, and cause feed enclosures to be downloaded into the files directory.
🎖@cveNotify
GitHub
Unauthenticated Server-Side Request Forgery with response read-back via the {{syndication}} action
### Summary
Any unauthenticated visitor can make the YesWiki server issue HTTP requests to arbitrary
hosts and ports, including internal/loopback addresses, and read back the fetched feed
content ...
Any unauthenticated visitor can make the YesWiki server issue HTTP requests to arbitrary
hosts and ports, including internal/loopback addresses, and read back the fetched feed
content ...
🚨 CVE-2026-104443
YesWiki before 4.6.7 contains an empty-filter scope bypass in the triples delete API that allows any authenticated user to delete or forge arbitrary semantic triples regardless of ownership. Attackers can send an empty filter to the triples delete endpoint to remove the admins-group membership triple, emptying the admin group and causing a site-wide authorization lockout.
🎖@cveNotify
YesWiki before 4.6.7 contains an empty-filter scope bypass in the triples delete API that allows any authenticated user to delete or forge arbitrary semantic triples regardless of ownership. Attackers can send an empty filter to the triples delete endpoint to remove the admins-group membership triple, emptying the admin group and causing a site-wide authorization lockout.
🎖@cveNotify
GitHub
Arbitrary semantic-triple delete/create by any authenticated user via empty-filter scope bypass (admin-group lockout)
## Summary
Any user with a low-privilege authenticated account (route ACL `+`) can delete or forge arbitrary semantic triples in YesWiki regardless of ownership, via the triples REST API. Deleting ...
Any user with a low-privilege authenticated account (route ACL `+`) can delete or forge arbitrary semantic triples in YesWiki regardless of ownership, via the triples REST API. Deleting ...
🚨 CVE-2026-104444
YesWiki before 4.6.7 contains an authorization bypass vulnerability in the comments API editComment route that allows authenticated low-privilege users to overwrite arbitrary pages or comments by supplying their own page as the pagetag field. Attackers can send a POST request to the api/comments endpoint targeting a victim tag, bypassing per-page write ACLs to replace content and reparent existing pages or comments.
🎖@cveNotify
YesWiki before 4.6.7 contains an authorization bypass vulnerability in the comments API editComment route that allows authenticated low-privilege users to overwrite arbitrary pages or comments by supplying their own page as the pagetag field. Attackers can send a POST request to the api/comments endpoint targeting a victim tag, bypassing per-page write ACLs to replace content and reparent existing pages or comments.
🎖@cveNotify
GitHub
Comments API editComment authorization keyed to attacker-supplied pagetag enables arbitrary page/comment overwrite
## Summary
The comments REST API `editComment` route (`POST /api/comments/{tag}`, route ACL `+`) keys its authorization on an attacker-supplied POST field (`pagetag`) instead of on the `{tag}` bein...
The comments REST API `editComment` route (`POST /api/comments/{tag}`, route ACL `+`) keys its authorization on an attacker-supplied POST field (`pagetag`) instead of on the `{tag}` bein...
🚨 CVE-2026-104445
YesWiki before 4.6.7 contains an authentication bypass vulnerability in the ActivityPub inbox that fails to bind the verified HTTP signature signer to the activity actor. Unauthenticated attackers with any ActivityPub keypair can send signed Delete or Update activities referencing a mirrored entry's sourceUrl to delete or overwrite other actors' federated entries.
🎖@cveNotify
YesWiki before 4.6.7 contains an authentication bypass vulnerability in the ActivityPub inbox that fails to bind the verified HTTP signature signer to the activity actor. Unauthenticated attackers with any ActivityPub keypair can send signed Delete or Update activities referencing a mirrored entry's sourceUrl to delete or overwrite other actors' federated entries.
🎖@cveNotify
GitHub
ActivityPub inbox does not bind the verified signer to the activity actor, allowing cross-actor delete and update
## Summary
The ActivityPub inbox verifies that the request carries a valid HTTP signature, then processes the activity body without ever checking that the verified signer is the actor named in tha...
The ActivityPub inbox verifies that the request carries a valid HTTP signature, then processes the activity body without ever checking that the verified signer is the actor named in tha...
🚨 CVE-2026-104447
YesWiki before 4.6.7 contains a cross-site request forgery vulnerability in the autoupdate UpdateAction that allows attackers to delete installed packages via unprotected GET requests. Attackers can lure a logged-in administrator to a crafted link with action=delete and a package parameter to remove extensions like bazar, breaking core site functionality.
🎖@cveNotify
YesWiki before 4.6.7 contains a cross-site request forgery vulnerability in the autoupdate UpdateAction that allows attackers to delete installed packages via unprotected GET requests. Attackers can lure a logged-in administrator to a crafted link with action=delete and a package parameter to remove extensions like bazar, breaking core site functionality.
🎖@cveNotify
GitHub
CSRF: arbitrary installed-package/extension deletion via GET in autoupdate UpdateAction
## Summary
The YesWiki autoupdate action (`{{update}}`, `tools/autoupdate/actions/UpdateAction.php`) deletes an installed package/extension on a **GET** request with **no CSRF token**. An attacker ...
The YesWiki autoupdate action (`{{update}}`, `tools/autoupdate/actions/UpdateAction.php`) deletes an installed package/extension on a **GET** request with **no CSRF token**. An attacker ...
🚨 CVE-2026-104448
YesWiki before 4.6.7 contains a cross-site request forgery vulnerability in the ajaxdeletepage handler, which permanently deletes a page on any GET request carrying a jsonp_callback parameter without checking a CSRF token. Attackers can lure a logged-in administrator or page owner to a crafted link to delete arbitrary pages along with their ACLs, links, triples, comments and referrers.
🎖@cveNotify
YesWiki before 4.6.7 contains a cross-site request forgery vulnerability in the ajaxdeletepage handler, which permanently deletes a page on any GET request carrying a jsonp_callback parameter without checking a CSRF token. Attackers can lure a logged-in administrator or page owner to a crafted link to delete arbitrary pages along with their ACLs, links, triples, comments and referrers.
🎖@cveNotify
GitHub
CSRF arbitrary page deletion via GET in ajaxdeletepage handler
## Summary
The `ajaxdeletepage` handler (`tools/tags/handlers/page/ajaxdeletepage.php`) permanently deletes a wiki page on a **GET** request with **no CSRF token**. An attacker who lures a logged-i...
The `ajaxdeletepage` handler (`tools/tags/handlers/page/ajaxdeletepage.php`) permanently deletes a wiki page on a **GET** request with **no CSRF token**. An attacker who lures a logged-i...
🚨 CVE-2026-104449
YesWiki before 4.6.7 contains an access control vulnerability allowing unauthenticated attackers to overwrite any existing wiki page, including pages whose write ACL restricts editing, via the Bazar entry-creation flow. Attackers can submit a crafted entry with an attacker-controlled id_fiche matching an existing page, overwriting its body for mass defacement and content destruction.
🎖@cveNotify
YesWiki before 4.6.7 contains an access control vulnerability allowing unauthenticated attackers to overwrite any existing wiki page, including pages whose write ACL restricts editing, via the Bazar entry-creation flow. Attackers can submit a crafted entry with an attacker-controlled id_fiche matching an existing page, overwriting its body for mass defacement and content destruction.
🎖@cveNotify
GitHub
Unauthenticated arbitrary page overwrite via Bazar entry creation with attacker-controlled id_fiche
## Summary
An unauthenticated visitor who reaches any YesWiki page that renders the `{{bazar}}` action can drive it into entry-creation mode via URL query parameters and overwrite the body of ANY e...
An unauthenticated visitor who reaches any YesWiki page that renders the `{{bazar}}` action can drive it into entry-creation mode via URL query parameters and overwrite the body of ANY e...
🚨 CVE-2026-104450
YesWiki before 4.6.7 contains a missing authorization flaw in the pointimage action (tools/attach/actions/pointimage.php), which saves content to an attacker-chosen page with write ACL checks bypassed. Unauthenticated attackers can POST pagetag, title, and description fields to any page rendering {{pointimage}} to append raw HTML or JavaScript to any wiki page, including pages whose write ACL restricts editing, causing stored cross-site scripting in viewers' and administrators' browsers.
🎖@cveNotify
YesWiki before 4.6.7 contains a missing authorization flaw in the pointimage action (tools/attach/actions/pointimage.php), which saves content to an attacker-chosen page with write ACL checks bypassed. Unauthenticated attackers can POST pagetag, title, and description fields to any page rendering {{pointimage}} to append raw HTML or JavaScript to any wiki page, including pages whose write ACL restricts editing, causing stored cross-site scripting in viewers' and administrators' browsers.
🎖@cveNotify
GitHub
Unauthenticated ACL-bypassing arbitrary page write and stored XSS via pointimage action
## Summary
The `pointimage` action (`tools/attach/actions/pointimage.php`) lets an **unauthenticated** attacker write to **any** wiki page, bypassing that page's write ACL, and — with the defau...
The `pointimage` action (`tools/attach/actions/pointimage.php`) lets an **unauthenticated** attacker write to **any** wiki page, bypassing that page's write ACL, and — with the defau...
🚨 CVE-2026-104451
YesWiki before 4.6.7 contains a cross-site request forgery vulnerability in RevisionsHandler that allows attackers to restore old page revisions through GET requests lacking CSRF token validation. Attackers can lure write-capable users into a top-level navigation with the restoreRevisionId parameter, silently overwriting current page content with stale or vandalized revisions.
🎖@cveNotify
YesWiki before 4.6.7 contains a cross-site request forgery vulnerability in RevisionsHandler that allows attackers to restore old page revisions through GET requests lacking CSRF token validation. Attackers can lure write-capable users into a top-level navigation with the restoreRevisionId parameter, silently overwriting current page content with stale or vandalized revisions.
🎖@cveNotify
GitHub
CSRF: page-revision restore (content overwrite) via GET in RevisionsHandler
## Summary
The YesWiki revisions handler (`<page>/revisions`, `handlers/RevisionsHandler.php`) restores an arbitrary old page revision — overwriting the current page body — on a **GET** reque...
The YesWiki revisions handler (`<page>/revisions`, `handlers/RevisionsHandler.php`) restores an arbitrary old page revision — overwriting the current page body — on a **GET** reque...
🚨 CVE-2026-104452
YesWiki before 4.6.7 contains a cross-site request forgery vulnerability in the filemanager page handler, which deletes page attachments on GET requests without validating a CSRF token. Attackers can lure a logged-in page owner or administrator into a top-level GET navigation with do=del, erase, or emptytrash, deleting or permanently purging the page's attachments.
🎖@cveNotify
YesWiki before 4.6.7 contains a cross-site request forgery vulnerability in the filemanager page handler, which deletes page attachments on GET requests without validating a CSRF token. Attackers can lure a logged-in page owner or administrator into a top-level GET navigation with do=del, erase, or emptytrash, deleting or permanently purging the page's attachments.
🎖@cveNotify
GitHub
CSRF: page attachment deletion/purge via GET in filemanager handler
## Summary
The YesWiki file-manager handler (`<page>/filemanager`, `tools/attach/handlers/page/filemanager.php`) deletes/erases/purges a page's attachments on a **GET** request with **no...
The YesWiki file-manager handler (`<page>/filemanager`, `tools/attach/handlers/page/filemanager.php`) deletes/erases/purges a page's attachments on a **GET** request with **no...