Fellipe Weno

fweno.onefour.com.br

Current Conditions

São Paulo
nuvens quebradas

15 ℃

97%

Temperatura

Umidade

Fonte: OpenWeatherMap. - 05:30:01

[USD] USD 78,359.75

[BRL] BRL 398,108.29 [USD] USD 78,359.75 [GBP] GBP 58,791.13 [EUR] EUR 67,394.64
Price index provided by blockchain.info.
After Bitcoin Core 0.14.0 and before Bitcoin Core 29.0, validating a specially-crafted block may cause the node to access previously freed memory.
During validation, necessary data required for checking inputs for each transaction is pre-calculated and cached. For specially crafted invalid blocks, it was possible for this data to be destroyed while it was still being accessed by a background validation thread. An attacker capable of mining a block with sufficient proof-of-work could have exploited this to crash victim nodes. Because of the nature of use-after-free bugs, it is possible that the crash could have been used for remote code execution, though constraints on the input (block) data make this unlikely.
This issue is considered High severity.

Details
By default, script validation for new blocks is dispatched to background threads via a vector of CScriptCheck functors. Each CScriptCheck holds a pointer to a PrecomputedTransactionData object which stores some data needed by each input in the transaction. Because it stores a pointer and not the data itself, care must be taken to ensure that the PrecomputedTransactionData outlives the CScriptCheck.
The script checks lifetime is enforced by an RAII class, CCheckQueueControl. However, the control is intantiated before the precomputed transaction data. Because local objects in C++ are destructed in reverse order of construction, this means the vector of PrecomputedTransactionData is destroyed before the CCheckQueueControl.
This is not an issue when the block is valid, as CCheckQueueControl::Wait() will be called before the function returns and the PrecomputedTransactionData gets destroyed. However, in case of an early return (when a separate check fails) a background script thread may read the precomputed transaction data after it was destroyed. An attacker could exploit this to crash victim nodes at the expense of a valid PoW at tip.

Attribution
Cory Fields (MIT DCI) discovered this vulnerability and responsibly disclosed it in a detailed report containing a proof of concept for reproduction and a proposed mitigation.

Timeline
- 2024-11-02 Cory Fields privately reports the bug
- 2024-11-06 Pieter Wuille pushes a covert fix to already open PR #31112 which works around the issue by removing the early returns
- 2024-12-03 PR #31112 is merged
- 2025-04-12 Bitcoin Core version 29.0 is released with a fix
- 2026-04-19 The last vulnerable Bitcoin Core version (28.x) goes end of life
- 2026-05-05 Public disclosure.

dog - 05:32:02 up 238 days, 14:03, 3 users, load average: 0.01, 0.01, 0.00

[15/05/2026 22:59] Após negar, Eduardo confirma ter assinado contrato de gestão financeira de filme de Bolsonaro; entenda - BBC

[15/05/2026 20:30] STF determina prisão de Ricardo Magro, do Refit; empresário entra em lista da Interpol - ICL Notícias

[15/05/2026 20:17] Após ataque de Zema, Flávio volta a se reunir com deputada cotada para vice - CNN Brasil

[15/05/2026 10:35] Flávio Bolsonaro assina pedido de criação de CPMI do Banco Master - O Antagonista

[15/05/2026 23:22] Gilmar diz que Fachin "não sabe perder" e obstrui julgamentos - Poder360

[15/05/2026 18:52] PEC do fim da escala 6x1 muda a Constituição, reduz jornada para 40 horas e prevê punição a empresas - Revista Oeste

[15/05/2026 18:07] PGR denuncia ao STJ Romeu Zema por calúnia contra ministro Gilmar Mendes - G1

[15/05/2026 17:00] PF troca delegado que investigava Lulinha no caso do INSS - Poder360

[15/05/2026 20:29] Mãe de adolescente acusado de matar Orelha desabafa: 'Que ninguém passe pelo que passamos' - ND Mais

[15/05/2026 15:50] Previsão Fim de Semana (16 e 17/05): Frentes frias e temporais em parte do Centro-Sul do país - Climatempo

[CVE-2026-0858] [Modified: 29-04-2026] [Analyzed] [V3.1 S6.1:MEDIUM] Versions of the package net.sourceforge.plantuml:plantuml before 1.2026.0 are vulnerable to Stored XSS due to insufficient sanitization of interactive attributes in GraphViz diagrams. As a result, a crafted PlantUML diagram can inject malicious JavaScript into generated SVG output, leading to arbitrary script execution in the context of applications that render the SVG.

[CVE-2026-0975] [Modified: 20-01-2026] [Analyzed] [V3.1 S7.8:HIGH] Delta Electronics DIAView has Command Injection vulnerability.

[CVE-2026-23768] [Modified: 23-01-2026] [Analyzed] [V3.1 S6.1:MEDIUM] lucy-xss-filter before commit 7c1de6d allows an attacker to induce server-side HEAD requests to arbitrary URLs when the ObjectSecurityListener or EmbedSecurityListener option is enabled and embed or object tags are used with a src attribute missing a file extension.

[CVE-2026-23769] [Modified: 23-01-2026] [Analyzed] [V3.1 S6.1:MEDIUM] lucy-xss-filter before commit e5826c0 allows an attacker to execute malicious JavaScript due to improper sanitization caused by misconfigured default superset rule files.

[CVE-2025-14757] [Modified: 23-01-2026] [Analyzed] [V3.1 S5.3:MEDIUM] The Cost Calculator Builder plugin for WordPress is vulnerable to Unauthenticated Payment Status Bypass in all versions up to, and including, 3.6.9 only when used in combination with Cost Calculator Builder PRO. This is due to the complete_payment AJAX action being registered via wp_ajax_nopriv, making it accessible to unauthenticated users, and the complete() function only verifying a nonce without checking user capabilities or order ownership. Since nonces are exposed to all visitors via window.ccb_nonces in the page source, any unauthenticated attacker can mark any order's payment status as "completed" without actual payment.

[CVE-2025-14822] [Modified: 20-01-2026] [Analyzed] [V3.1 S3.1:LOW] Mattermost versions 10.11.x <= 10.11.8 fail to validate input size before processing hashtags which allows an authenticated attacker to exhaust CPU resources via a single HTTP request containing a post with thousands space-separated tokens

[CVE-2025-60021] [Modified: 21-01-2026] [Analyzed] [V3.1 S9.8:CRITICAL] Remote command injection vulnerability in heap profiler builtin service in Apache bRPC ((all versions < 1.15.0)) on all platforms allows attacker to inject remote command. Root Cause: The bRPC heap profiler built-in service (/pprof/heap) does not validate the user-provided extra_options parameter and executes it as a command-line argument. Attackers can execute remote commands using the extra_options parameter.. Affected scenarios: Use the built-in bRPC heap profiler service to perform jemalloc memory profiling. How to Fix: we provide two methods, you can choose one of them: 1. Upgrade bRPC to version 1.15.0. 2. Apply this patch ( https://github.com/apache/brpc/pull/3101 ) manually.

[CVE-2025-14844] [Modified: 23-01-2026] [Analyzed] [V3.1 S8.2:HIGH] The Membership Plugin – Restrict Content plugin for WordPress is vulnerable to Missing Authentication in all versions up to, and including, 3.2.16 via the 'rcp_stripe_create_setup_intent_for_saved_card' function due to missing capability check. Additionally, the plugin does not check a user-controlled key, which makes it possible for unauthenticated attackers to leak Stripe SetupIntent client_secret values for any membership.

[CVE-2025-59870] [Modified: 23-01-2026] [Analyzed] [V3.1 S7.4:HIGH] HCL MyXalytics is affected by improper management of a static JWT signing secret in the web application, where the secret lacks rotation , introducing a security risk

[CVE-2025-68438] [Modified: 21-01-2026] [Analyzed] [V3.1 S7.5:HIGH] In Apache Airflow versions before 3.1.6, when rendered template fields in a Dag exceed [core] max_templated_field_length, sensitive values could be exposed in cleartext in the Rendered Templates UI. This occurred because serialization of those fields used a secrets masker instance that did not include user-registered mask_secret() patterns, so secrets were not reliably masked before truncation and display. Users are recommended to upgrade to 3.1.6 or later, which fixes this issue

[CVE-2025-14435] [Modified: 20-01-2026] [Analyzed] [V3.1 S6.8:MEDIUM] Mattermost versions 10.11.x <= 10.11.8, 11.1.x <= 11.1.1, 11.0.x <= 11.0.6 fail to prevent infinite re-renders on API errors which allows authenticated users to cause application-level DoS via triggering unbounded component re-render loops.

[CVE-2025-14894] [Modified: 23-01-2026] [Analyzed] [V3.1 S9.8:CRITICAL] Livewire Filemanager, commonly used in Laravel applications, contains LivewireFilemanagerComponent.php, which does not perform file type and MIME validation, allowing for RCE through upload of a malicious php file that can then be executed via the /storage/ URL if a commonly performed setup process within Laravel applications has been completed.

[CVE-2026-0612] [Modified: 23-01-2026] [Analyzed] [V3.1 S7.5:HIGH] The Librarian contains a information leakage vulnerability through the `web_fetch` tool, which can be used to retrieve arbitrary external content provided by an attacker, which can be used to proxy requests through The Librarian infrastructure. The vendor has fixed the vulnerability in all versions of TheLibrarian.

[CVE-2026-0613] [Modified: 23-01-2026] [Analyzed] [V3.1 S7.5:HIGH] The Librarian contains an internal port scanning vulnerability, facilitated by the `web_fetch` tool, which can be used with SSRF-style behavior to perform GET requests to internal IP addresses and services, enabling scanning of the Hertzner cloud environment that TheLibrarian uses. The vendor has fixed the vulnerability in all affected versions.

[CVE-2026-0615] [Modified: 23-01-2026] [Analyzed] [V3.1 S7.3:HIGH] The Librarian `supervisord` status page can be retrieved by the `web_fetch` tool, which can be used to retrieve running processes within TheLibrarian backend. The vendor has fixed the vulnerability in all affected versions.

[CVE-2026-0616] [Modified: 23-01-2026] [Analyzed] [V3.1 S7.5:HIGH] TheLibrarians web_fetch tool can be used to retrieve the Adminer interface content, which can then be used to log into the internal TheLibrarian backend system. The vendor has fixed the vulnerability in all affected versions.

[CVE-2025-15104] [Modified: 23-01-2026] [Analyzed] [V3.1 S5.3:MEDIUM] Nu Html Checker (validator.nu) contains a restriction bypass that allows remote attackers to make the server perform arbitrary HTTP/HTTPS requests to internal resources, including localhost services. While the validator implements hostname-based protections to block direct access to localhost and 127.0.0.1, these controls can be bypassed using DNS rebinding techniques or domains that resolve to loopback addresses.This issue affects The Nu Html Checker (vnu): latest (commit 23f090a11bab8d0d4e698f1ffc197a4fe226a9cd).

[CVE-2025-68921] [Modified: 23-01-2026] [Analyzed] [V3.1 S7.8:HIGH] SteelSeries Nahimic 3 1.10.7 allows Directory traversal.

[CVE-2026-21623] [Modified: 30-01-2026] [Analyzed] [V3.1 S5.4:MEDIUM] Lack of input filterung leads to a persistent XSS vulnerability in the forum post handling of the Easy Discuss component for Joomla.

[CVE-2026-21624] [Modified: 30-01-2026] [Analyzed] [V3.1 S5.4:MEDIUM] Lack of input filterung leads to a persistent XSS vulnerability in the user avatar text handling of the Easy Discuss component for Joomla.