Fellipe Weno

fweno.onefour.com.br

Current Conditions

São Paulo
nublado

16 ℃

93%

Temperatura

Umidade

Fonte: OpenWeatherMap. - 05:30:01

[USD] USD 62,515.20

[BRL] BRL 324,138.20 [USD] USD 62,515.20 [GBP] GBP 46,815.57 [EUR] EUR 54,643.79
Price index provided by blockchain.info.
After Bitcoin Core 0.14.0 and before Bitcoin Core 29.0, validating a specially-crafted block may cause the node to access previously freed memory.
During validation, necessary data required for checking inputs for each transaction is pre-calculated and cached. For specially crafted invalid blocks, it was possible for this data to be destroyed while it was still being accessed by a background validation thread. An attacker capable of mining a block with sufficient proof-of-work could have exploited this to crash victim nodes. Because of the nature of use-after-free bugs, it is possible that the crash could have been used for remote code execution, though constraints on the input (block) data make this unlikely.
This issue is considered High severity.

Details
By default, script validation for new blocks is dispatched to background threads via a vector of CScriptCheck functors. Each CScriptCheck holds a pointer to a PrecomputedTransactionData object which stores some data needed by each input in the transaction. Because it stores a pointer and not the data itself, care must be taken to ensure that the PrecomputedTransactionData outlives the CScriptCheck.
The script checks lifetime is enforced by an RAII class, CCheckQueueControl. However, the control is intantiated before the precomputed transaction data. Because local objects in C++ are destructed in reverse order of construction, this means the vector of PrecomputedTransactionData is destroyed before the CCheckQueueControl.
This is not an issue when the block is valid, as CCheckQueueControl::Wait() will be called before the function returns and the PrecomputedTransactionData gets destroyed. However, in case of an early return (when a separate check fails) a background script thread may read the precomputed transaction data after it was destroyed. An attacker could exploit this to crash victim nodes at the expense of a valid PoW at tip.

Attribution
Cory Fields (MIT DCI) discovered this vulnerability and responsibly disclosed it in a detailed report containing a proof of concept for reproduction and a proposed mitigation.

Timeline
- 2024-11-02 Cory Fields privately reports the bug
- 2024-11-06 Pieter Wuille pushes a covert fix to already open PR #31112 which works around the issue by removing the early returns
- 2024-12-03 PR #31112 is merged
- 2025-04-12 Bitcoin Core version 29.0 is released with a fix
- 2026-04-19 The last vulnerable Bitcoin Core version (28.x) goes end of life
- 2026-05-05 Public disclosure.

dog - 05:49:38 up 287 days, 14:20, 6 users, load average: 0.00, 0.00, 0.00

[03/07/2026 19:00] Moraes lista arsenal de Bolsonaro e dá 48 horas para ex-presidente entregar armas; veja modelos - G1

[03/07/2026 22:02] Datafolha: direita supera esquerda pela primeira vez desde 2014, aponta pesquisa - O GLOBO

[03/07/2026 11:19] Quase todos os chefes de governo de La Guaira morreram no terremoto, diz presidente da Venezuela - G1

[03/07/2026 19:58] Michelle Bolsonaro visita PL Mulher e posa para foto com antiga equipe após imagem de papelão viralizar - O GLOBO

[03/07/2026 20:50] PM divulga atualização sobre estado de saúde do tenente da Rota baleado - CNN Brasil

[03/07/2026 00:14] Flávio pede aos EUA pausa de 180 dias antes de novas tarifas - Poder360

[03/07/2026 20:01] Opinião - Adriana Fernandes: O que quer Alcolumbre para tirar a PEC 6x1 da geladeira? - Folha de S.Paulo

[03/07/2026 20:26] Michelle vira alvo de bolsonaristas após elogiar programa lançado por Lula - CNN Brasil

[03/07/2026 19:35] Ex-mulher de goleiro Bruno está desaparecida desde 5ª feira - Poder360

[03/07/2026 07:38] Operação Exchange: PF prende alvo de sanção dos EUA em operação contra o PCC - Correio Braziliense

[CVE-2026-25877] [Modified: 17-06-2026] [Analyzed] [V3.1 S6.5:MEDIUM] Chartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create charts. Prior to version 4.8.1, the application performs authorization checks based solely on the project_id parameter when handling chart-related operations (update, delete, etc.). No authorization check is performed against the chart_id itself. This allows an authenticated user who has access to any project to manipulate or access charts belonging to other users/ project. This issue has been patched in version 4.8.1.

[CVE-2026-25887] [Modified: 17-06-2026] [Analyzed] [V3.1 S7.2:HIGH] Chartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create charts. Prior to version 4.8.1, there is a remote code execution vulnerability via the MongoDB dataset Query. This issue has been patched in version 4.8.1.

[CVE-2026-25888] [Modified: 17-06-2026] [Analyzed] [V3.1 S8.8:HIGH] Chartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create charts. Prior to version 4.8.1, there is a remote code execution vulnerability via a vulnerable API. This issue has been patched in version 4.8.1.

[CVE-2026-27005] [Modified: 17-06-2026] [Analyzed] [V3.1 S9.8:CRITICAL] Chartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create charts. Prior to version 4.8.3, an unauthenticated attacker can inject arbitrary SQL into queries executed against databases connected to Chartbrew (MySQL, PostgreSQL). This allows reading, modifying, or deleting data in those databases depending on the database user's privileges. This issue has been patched in version 4.8.3.

[CVE-2026-27603] [Modified: 17-06-2026] [Analyzed] [V3.1 S7.5:HIGH] Chartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create charts. Prior to version 4.8.4, the chart filter endpoint POST /project/:project_id/chart/:chart_id/filter is missing both verifyToken and checkPermissions middleware, allowing unauthenticated users to access chart data from any team/project. This issue has been patched in version 4.8.4.

[CVE-2026-27605] [Modified: 17-06-2026] [Analyzed] [V3.1 S6.3:MEDIUM] Chartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create charts. Prior to version 4.8.4, the application allows uploading files (project logos) without validating the file type or content. It trusts the extension provided by the user. These files are saved to the uploads/ directory and served statically. An attacker can upload an HTML file containing malicious JavaScript. Since authentication tokens are likely stored in localStorage (as they are returned in the API body), this XSS can lead to account takeover. This issue has been patched in version 4.8.4.

[CVE-2026-28428] [Modified: 17-06-2026] [Analyzed] [V3.1 S5.3:MEDIUM] Talishar is a fan-made Flesh and Blood project. Prior to commit a9c218e, an authentication bypass vulnerability in Talishar's game endpoint validation logic allows any unauthenticated attacker to perform authenticated game actions — including sending chat messages and submitting game inputs — by supplying an empty authKey parameter (authKey=). The server-side validation uses a loose comparison that accepts an empty string as a valid credential, while correctly rejecting non-empty but incorrect keys. This asymmetry means the authentication mechanism can be completely bypassed without knowing any valid token. This issue has been patched in commit a9c218e.

[CVE-2026-28429] [Modified: 17-06-2026] [Analyzed] [V3.1 S7.5:HIGH] Talishar is a fan-made Flesh and Blood project. Prior to commit 6be3871, a Path Traversal vulnerability was identified in the gameName parameter. While the application's primary entry points implement input validation, the ParseGamestate.php component can be accessed directly as a standalone script. In this scenario, the absence of internal sanitization allows for directory traversal sequences (e.g., ../) to be processed, potentially leading to unauthorized file access. This issue has been patched in commit 6be3871.

[CVE-2026-28507] [Modified: 17-06-2026] [Analyzed] [V3.1 S7.2:HIGH] Idno is a social publishing platform. Prior to version 1.6.4, there is a remote code execution vulnerability via chained import file write and template path traversal. This issue has been patched in version 1.6.4.

[CVE-2026-28508] [Modified: 17-06-2026] [Analyzed] [V3.1 S8.6:HIGH] Idno is a social publishing platform. Prior to version 1.6.4, a logic error in the API authentication flow causes the CSRF protection on the URL unfurl service endpoint to be trivially bypassed by any unauthenticated remote attacker. Combined with the absence of a login requirement on the endpoint itself, this allows an attacker to force the server to make arbitrary outbound HTTP requests to any host, including internal network addresses and cloud instance metadata services, and retrieve the response content. This issue has been patched in version 1.6.4.

[CVE-2026-28509] [Modified: 17-06-2026] [Analyzed] [V3.1 S6.3:MEDIUM] LangBot is a global IM bot platform designed for LLMs. Prior to version 4.8.7, LangBot’s web UI renders user-supplied raw HTML using rehypeRaw, which can lead to a cross-site scripting (XSS) vulnerability. This issue has been patched in version 4.8.7.

[CVE-2026-28675] [Modified: 17-06-2026] [Analyzed] [V3.1 S5.3:MEDIUM] OpenSift is an AI study tool that sifts through large datasets using semantic search and generative AI. Prior to version 1.6.3-alpha, some endpoints returned raw exception strings to clients. Additionally, login token material was exposed in UI/rendered responses and token rotation output. This issue has been patched in version 1.6.3-alpha.

[CVE-2026-28676] [Modified: 17-06-2026] [Analyzed] [V3.1 S8.8:HIGH] OpenSift is an AI study tool that sifts through large datasets using semantic search and generative AI. Prior to version 1.6.3-alpha, multiple storage helpers used path construction patterns that did not uniformly enforce base-directory containment. This created path-injection risk in file read/write/delete flows if malicious path-like values were introduced. This issue has been patched in version 1.6.3-alpha.

[CVE-2026-28677] [Modified: 17-06-2026] [Analyzed] [V3.1 S8.2:HIGH] OpenSift is an AI study tool that sifts through large datasets using semantic search and generative AI. Prior to version 1.6.3-alpha, the URL ingest pipeline accepted user-controlled remote URLs with incomplete destination restrictions. Although private/local host checks existed, missing restrictions for credentialed URLs, non-standard ports, and cross-host redirects left SSRF-class abuse paths in non-localhost deployments. This issue has been patched in version 1.6.3-alpha.

[CVE-2026-28679] [Modified: 17-06-2026] [Analyzed] [V3.1 S8.6:HIGH] Home-Gallery.org is a self-hosted open-source web gallery to browse personal photos and videos. Prior to version 1.21.0, when a user requests a download, the application does not verify whether the requested file is located within the media source directory, which can result in sensitive system files being downloadable as well. This issue has been patched in version 1.21.0.

[CVE-2026-28680] [Modified: 17-06-2026] [Analyzed] [V3.1 S9.3:CRITICAL] Ghostfolio is an open source wealth management software. Prior to version 2.245.0, an attacker can exploit the manual asset import feature to perform a full-read SSRF, allowing them to exfiltrate sensitive cloud metadata (IMDS) or probe internal network services. This issue has been patched in version 2.245.0.

[CVE-2026-28681] [Modified: 17-06-2026] [Analyzed] [V3.1 S8.1:HIGH] Internet Routing Registry daemon version 4 is an IRR database server, processing IRR objects in the RPSL format. From version 4.4.0 to before version 4.4.5 and from version 4.5.0 to before version 4.5.1, an attacker can manipulate the HTTP Host header on a password reset or account creation request. The confirmation link in the resulting email can then point to an attacker-controlled domain. Opening the link in the email is sufficient to pass the token to the attacker, who can then use it on the real IRRD instance to take over the account. A compromised account can then be used to modify RPSL objects maintained by the account's mntners and perform other account actions. If the user had two-factor authentication configured, which is required for users with override access, an attacker is not able to log in, even after successfully resetting the password. This issue has been patched in versions 4.4.5 and 4.5.1.

[CVE-2026-28682] [Modified: 17-06-2026] [Analyzed] [V3.1 S6.4:MEDIUM] Gokapi is a self-hosted file sharing server with automatic expiration and encryption support. Prior to version 2.2.3, the upload status SSE implementation on /uploadStatus publishes global upload state to any authenticated listener and includes file_id values that are not scoped to the requesting user. This issue has been patched in version 2.2.3.

[CVE-2026-28683] [Modified: 17-06-2026] [Analyzed] [V3.1 S8.7:HIGH] Gokapi is a self-hosted file sharing server with automatic expiration and encryption support. Prior to version 2.2.3, if a malicious authenticated user uploads SVG and creates a hotlink for it, they can achieve stored XSS. This issue has been patched in version 2.2.3.

[CVE-2026-28685] [Modified: 17-06-2026] [Analyzed] [V3.1 S6.5:MEDIUM] Kimai is a web-based multi-user time-tracking application. Prior to version 2.51.0, "GET /api/invoices/{id}" only checks the role-based view_invoice permission but does not verify the requesting user has access to the invoice's customer. Any user with ROLE_TEAMLEAD (which grants view_invoice) can read all invoices in the system, including those belonging to customers assigned to other teams. This issue has been patched in version 2.51.0.