漏洞公告

Zebra: Finalized address balance credit-first overflow on consensus-valid blocks

Zebra has sync restart poisoning from single unauthenticated peer via above-lookahead block

zebrad has consensus divergence via P2SH sigop undercount in pure-Rust disabled-opcode parser

Zebra has block suppression via NU5 same-header body poisoning of sent-hash cache

Zebra has pre-handshake buffer capacity reservation based on attacker-claimed body length

zebrad has mempool transaction admission denial via single-peer inbound queue saturation

zebrad vulnerable to full node denial of service via crafted Sapling receiver in z_listunifiedreceivers

Grackle: Fail-open authorization in the MCP tool layer lets scoped agents perform cross-task and cross-session mutations (IDOR)

zebrad vulnerable to getblocks/getheaders locator CPU amplification via uncapped vector length

zebrad has full node denial of service via non-ASCII LongPollId in getblocktemplate

Mautic has SQL Injection in API Contact Filtering

Froxlor customer can create MySQL databases on disallowed servers via Mysqls.add API

Froxlor: Authenticated customers can read other customers' allowed sender aliases

electerm has Command Injection in File System Operations (rmrf, mv, cp)

Dragonfly Manager OAuth provider client_secret disclosure via unauthenticated GET /api/v1/oauth

electerm has Path Traversal in Zmodem and Trzsz Download Filename Handling

@conform-to/dom parseSubmission vulnerable to CPU exhaustion when parsing many unique form fields

Grackle has command/argument injection in the git worktree executor that enables RCE on provisioned hosts via an unsanitized task branch name (shell:true)

joserfc: HS256/HS384/HS512 verify accepts empty/nil HMAC key (cross-language sibling of CVE-2026-45363)

SFTPGo has stored XSS via inline parameter on public shares and user file download

SFTPGo has path confinement bypass in public browsable share partial ZIP download

@asymmetric-effort/specifyjs: CSS expression sanitization is bypassable in renderToString

@asymmetric-effort/specifyjs: No redirect target validation in secureFetch