Fellipe Weno

fweno.onefour.com.br

Current Conditions

São Paulo
nublado

11 ℃

93%

Temperatura

Umidade

Fonte: OpenWeatherMap. - 05:30:01

[USD] USD 62,613.89

[BRL] BRL 323,056.35 [USD] USD 62,613.89 [GBP] GBP 47,364.78 [EUR] EUR 54,640.26
Price index provided by blockchain.info.
After Bitcoin Core 0.14.0 and before Bitcoin Core 29.0, validating a specially-crafted block may cause the node to access previously freed memory.
During validation, necessary data required for checking inputs for each transaction is pre-calculated and cached. For specially crafted invalid blocks, it was possible for this data to be destroyed while it was still being accessed by a background validation thread. An attacker capable of mining a block with sufficient proof-of-work could have exploited this to crash victim nodes. Because of the nature of use-after-free bugs, it is possible that the crash could have been used for remote code execution, though constraints on the input (block) data make this unlikely.
This issue is considered High severity.

Details
By default, script validation for new blocks is dispatched to background threads via a vector of CScriptCheck functors. Each CScriptCheck holds a pointer to a PrecomputedTransactionData object which stores some data needed by each input in the transaction. Because it stores a pointer and not the data itself, care must be taken to ensure that the PrecomputedTransactionData outlives the CScriptCheck.
The script checks lifetime is enforced by an RAII class, CCheckQueueControl. However, the control is intantiated before the precomputed transaction data. Because local objects in C++ are destructed in reverse order of construction, this means the vector of PrecomputedTransactionData is destroyed before the CCheckQueueControl.
This is not an issue when the block is valid, as CCheckQueueControl::Wait() will be called before the function returns and the PrecomputedTransactionData gets destroyed. However, in case of an early return (when a separate check fails) a background script thread may read the precomputed transaction data after it was destroyed. An attacker could exploit this to crash victim nodes at the expense of a valid PoW at tip.

Attribution
Cory Fields (MIT DCI) discovered this vulnerability and responsibly disclosed it in a detailed report containing a proof of concept for reproduction and a proposed mitigation.

Timeline
- 2024-11-02 Cory Fields privately reports the bug
- 2024-11-06 Pieter Wuille pushes a covert fix to already open PR #31112 which works around the issue by removing the early returns
- 2024-12-03 PR #31112 is merged
- 2025-04-12 Bitcoin Core version 29.0 is released with a fix
- 2026-04-19 The last vulnerable Bitcoin Core version (28.x) goes end of life
- 2026-05-05 Public disclosure.

dog - 05:55:09 up 272 days, 14:26, 5 users, load average: 0.01, 0.02, 0.00

[18/06/2026 21:54] Explicação de Jaques Wagner é "inconcebível", diz Glauber Braga - Poder360

[18/06/2026 10:51] Operação mira políticos suspeitos de ligação com facção TCP no Rio - Folha de S.Paulo

[18/06/2026 18:07] Irã publica memorando assinado por Trump para encerrar guerra - Poder360

[18/06/2026 23:24] 'Maior frio do ano a caminho': previsão indica temperaturas de até -8°C - UOL Notícias

[18/06/2026 19:48] EUA classificam condenação de Eduardo Bolsonaro como “perseguição” - Poder360

[18/06/2026 18:01] Por unanimidade, STF anula absolvição no caso Mariana Ferrer - CartaCapital

[18/06/2026 00:01] Suíte em hotel de luxo que Vorcaro bancou para Hugo Motta em Lisboa tem 247m² - Diário do Poder

[18/06/2026 11:47] Justiça torna Deolane Bezerra ré em investigação contra Marcola e PCC - CNN Brasil

[17/06/2026 22:28] Brasil rejeita seis dos nove textos aprovados pelo G7 - Valor Econômico

[18/06/2026 19:27] Rumble e Trump Media dizem que Moraes não respondeu à ação nos EUA - Poder360

[CVE-2026-24764] [Modified: 17-06-2026] [Analyzed] [V3.1 S3.7:LOW] OpenClaw (formerly Clawdbot) is a personal AI assistant users run on their own devices. In versions 2026.2.2 and below, when the Slack integration is enabled, channel metadata (topic/description) can be incorporated into the model's system prompt. Prompt injection is a documented risk for LLM-driven systems. This issue increases the injection surface by allowing untrusted Slack channel metadata to be treated as higher-trust system input. This issue has been fixed in version 2026.2.3.

[CVE-2026-25120] [Modified: 17-06-2026] [Analyzed] [V3.1 S2.7:LOW] Gogs is an open source self-hosted Git service. In versions 0.13.4 and below, the DeleteComment API does not verify that the comment belongs to the repository specified in the URL. This allows a repository administrator to delete comments from any other repository by supplying arbitrary comment IDs, bypassing authorization controls. The DeleteComment function retrieves a comment by ID without verifying repository ownership and the Database function DeleteCommentByID performs no repository validation. This issue has been fixed in version 0.14.0.

[CVE-2026-25229] [Modified: 17-06-2026] [Analyzed] [V3.1 S6.5:MEDIUM] Gogs is an open source self-hosted Git service. Versions 0.13.4 and below have a broken access control vulnerability which allows authenticated users with write access to any repository to modify labels belonging to other repositories. The UpdateLabel function in the Web UI (internal/route/repo/issue.go) fails to verify that the label being modified belongs to the repository specified in the URL path, enabling cross-repository label tampering attacks. The vulnerability exists in the Web UI's label update endpoint POST /:username/:reponame/labels/edit. The handler function UpdateLabel uses an incorrect database query function that bypasses repository ownership validation. This issue has been fixed in version 0.14.1.

[CVE-2026-25232] [Modified: 17-06-2026] [Analyzed] [V3.1 S8.8:HIGH] Gogs is an open source self-hosted Git service. Versions 0.13.4 and below have an access control bypass vulnerability which allows any repository collaborator with Write permissions to delete protected branches (including the default branch) by sending a direct POST request, completely bypassing the branch protection mechanism. This vulnerability in the DeleteBranchPost function eenables privilege escalation from Write to Admin level, allowing low-privilege users to perform dangerous operations that should be restricted to administrators only. Although Git Hook layer correctly prevents protected branch deletion via SSH push, the web interface deletion operation does not trigger Git Hooks, resulting in complete bypass of protection mechanisms. In oder to exploit this vulnerability, attackers must have write permissions to the target repository, protected branches configured to the target repository and access to the Gogs web interface. This issue has been fixed in version 0.14.1.

[CVE-2026-25242] [Modified: 17-06-2026] [Analyzed] [V3.1 S9.8:CRITICAL] Gogs is an open source self-hosted Git service. Versions 0.13.4 and below expose unauthenticated file upload endpoints by default. When the global RequireSigninView setting is disabled (default), any remote user can upload arbitrary files to the server via /releases/attachments and /issues/attachments. This enables the instance to be abused as a public file host, potentially leading to disk exhaustion, content hosting, or delivery of malware. CSRF tokens do not mitigate this attack due to same-origin cookie issuance. This issue has been fixed in version 0.14.1.

[CVE-2026-25474] [Modified: 17-06-2026] [Analyzed] [V3.1 S7.5:HIGH] OpenClaw is a personal AI assistant. In versions 2026.1.30 and below, if channels.telegram.webhookSecret is not set when in Telegram webhook mode, OpenClaw may accept webhook HTTP requests without verifying Telegram’s secret token header. In deployments where the webhook endpoint is reachable by an attacker, this can allow forged Telegram updates (for example spoofing message.from.id). If an attacker can reach the webhook endpoint, they may be able to send forged updates that are processed as if they came from Telegram. Depending on enabled commands/tools and configuration, this could lead to unintended bot actions. Note: Telegram webhook mode is not enabled by default. It is enabled only when `channels.telegram.webhookUrl` is configured. This issue has been fixed in version 2026.2.1.

[CVE-2026-2689] [Modified: 17-06-2026] [Analyzed] [V3.1 S7.3:HIGH] A vulnerability was detected in itsourcecode Event Management System 1.0. Affected is an unknown function of the file /admin/manage_booking.php. The manipulation of the argument ID results in sql injection. The attack may be performed from remote. The exploit is now public and may be used.

[CVE-2026-2690] [Modified: 17-06-2026] [Analyzed] [V3.1 S7.3:HIGH] A flaw has been found in itsourcecode Event Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /admin/ajax.php?action=login of the component Admin Login. This manipulation of the argument Username causes sql injection. It is possible to initiate the attack remotely. The exploit has been published and may be used.

[CVE-2026-2691] [Modified: 17-06-2026] [Analyzed] [V3.1 S7.3:HIGH] A vulnerability has been found in itsourcecode Event Management System 1.0. Affected by this issue is some unknown functionality of the file /admin/manage_register.php. Such manipulation of the argument ID leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.

[CVE-2026-2692] [Modified: 17-06-2026] [Analyzed] [V3.1 S4.3:MEDIUM] A vulnerability was found in CoCoTeaNet CyreneAdmin up to 1.3.0. This affects an unknown part of the file /api/system/user/getAvatar of the component Image Handler. Performing a manipulation of the argument Avatar results in path traversal. The attack can be initiated remotely. The exploit has been made public and could be used.

[CVE-2026-2693] [Modified: 17-06-2026] [Analyzed] [V3.1 S4.3:MEDIUM] A vulnerability was determined in CoCoTeaNet CyreneAdmin up to 1.3.0. This vulnerability affects unknown code of the file /api/system/dashboard/getCount of the component System Info Endpoint. Executing a manipulation can lead to improper authorization. The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized.

[CVE-2026-2703] [Modified: 17-06-2026] [Analyzed] [V3.1 S3.3:LOW] A weakness has been identified in xlnt-community xlnt up to 1.6.1. Impacted is the function xlnt::detail::decode_base64 of the file source/detail/cryptography/base64.cpp of the component Encrypted XLSX File Parser. Executing a manipulation can lead to off-by-one. The attack requires local access. The exploit has been made available to the public and could be used for attacks. This patch is called f2d7bf494e5c52706843cf7eb9892821bffb0734. Applying a patch is advised to resolve this issue.

[CVE-2026-2706] [Modified: 17-06-2026] [Analyzed] [V3.1 S6.3:MEDIUM] A flaw has been found in code-projects Patient Record Management System 1.0. This affects an unknown function of the file /fecalysis_not.php. This manipulation of the argument comp_id causes sql injection. The attack can be initiated remotely. The exploit has been published and may be used.

[CVE-2026-22269] [Modified: 17-06-2026] [Analyzed] [V3.1 S4.7:MEDIUM] Dell PowerProtect Data Manager, version(s) prior to 19.22, contain(s) an Improper Verification of Source of a Communication Channel vulnerability in the REST API. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to protection mechanism bypass.

[CVE-2026-26358] [Modified: 17-06-2026] [Analyzed] [V3.1 S8.8:HIGH] Dell Unisphere for PowerMax, version(s) 10.2, contain(s) a Missing Authorization vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Unauthorized access.

[CVE-2026-26359] [Modified: 17-06-2026] [Analyzed] [V3.1 S8.8:HIGH] Dell Unisphere for PowerMax, version(s) 10.2, contain(s) an External Control of File Name or Path vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to the ability to overwrite arbitrary files.

[CVE-2026-26360] [Modified: 17-06-2026] [Analyzed] [V3.1 S8.1:HIGH] Dell Unisphere for PowerMax, version(s) 10.2, contain(s) an External Control of File Name or Path vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability to delete arbitrary files.

[CVE-2026-26361] [Modified: 17-06-2026] [Analyzed] [V3.1 S6.5:MEDIUM] Dell Unisphere for PowerMax, version(s) 10.2, contain(s) an External Control of File Name or Path vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Information disclosure.

[CVE-2026-26362] [Modified: 17-06-2026] [Analyzed] [V3.1 S8.1:HIGH] Dell Unisphere for PowerMax, version(s) 10.2, contain(s) a Relative Path Traversal vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to unauthorized modification of critical system files.

[CVE-2026-2735] [Modified: 17-06-2026] [Analyzed] [V3.1 S5.4:MEDIUM] Stored Cross-Site Scripting (XSS) in Alkacon's OpenCms v18.0, which occurs when user input is not properly validated when sending a POST request to ‘/blog/new-article/org.opencms.ugc.CmsUgcEditService.gwt’ using the ‘text’ parameter.