Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

3 records

Vendor: spesmilo Clear all filters
TI-2026-81178 CVE-2026-117603 · GHSA-98mp-7r7x-725c

Spending limit bypass in Electrum Nostr Wallet Connect plugin

Priority LOW 39

Electrum before 4.7.2 contains a spending limit bypass vulnerability in the Nostr Wallet Connect plugin that allows malicious NWC clients to exceed daily_limit_sat by exploiting non-atomic budget checks and millisatoshi…

CVSS 4.0CRITICAL 9.3 Network No auth No interaction EPSS 0.00194 Published 2026-10-27 Fixed in 4.7.2 CWE-367
TI-2026-81177 CVE-2026-117602 · GHSA-g9gm-5xmx-9r6w

Electrum external plugin authorization bypass enables local code execution

Priority LOW 38

Electrum 4.6.0 before 4.7.2 contains an authorization bypass in the external plugin loader, which executes a plugin's __init__.py module when the plugin is marked enabled in the config file, without verifying its plugin-…

CVSS 4.0HIGH 8.6 Local No auth No interaction EPSS 0.0011 Published 2026-10-27 Fixed in 4.7.2 CWE-347
TI-2026-81176 CVE-2026-117601 · GHSA-6jp4-8v48-cc5v

Missing signature verification of mempool transactions in Electrum

Priority MEDIUM 47

Electrum before 4.8.3 fails to verify signatures of wallet-owned inputs in unconfirmed mempool transactions, allowing malicious servers to replace a just-broadcast transaction with a conflicting one.

CVSS 4.0CRITICAL 9.3 Network No auth No interaction EPSS 0.00176 Published 2026-10-27 Fixed in 4.8.3 CWE-347