ShippethEthereum releases, writing, news and network upgrades
Everything11,175Releases5,824Articles5,051Advisories300

Security advisories of the clients, exploited vulnerabilities in the software and hardware node operators run, and incidents at certificate authorities.

Network upgradeNothing scheduled. Glamsterdam is on devnet 11

Security advisories and exploited vulnerabilities

300 items match, 123 of them low signal.

The stream

Newest first
Tue 14 April
Unsafe usage of `assert_always_fail` (opens in a new tab) · Noir Security High
Tue 14 April
Repeat-load / known-load incorrectly eliminated across call that mutates memory via indirect reference (opens in a new tab) · Noir Security High
Tue 14 April
Array only used in while condition not cloned (opens in a new tab) · Noir Security Critical
Tue 14 April
Can pop from an empty slice (opens in a new tab) · Noir Security Critical
Tue 14 April
Heap corruption in foreign call results with nested tuple arrays (opens in a new tab) · Noir Security Critical CVE-2026-41197
Sat 11 April
SP1 V6 Recursion Circuit Row-Count Binding Gap (opens in a new tab) · SP1 (Succinct) Security High CVE-2026-40323
Mon 30 March
Citrix NetScaler Out-of-Bounds Read Vulnerability (opens in a new tab) · Citrix NetScaler Security CVE-2026-3055 CVE published
Fri 27 March
F5 BIG-IP Stack-Based Buffer Overflow Vulnerability (opens in a new tab) · F5 BIG-IP Security CVE-2025-53521 CVE published
Thu 19 March
Cisco Secure Firewall Management Center (FMC) Software and Cisco Security Cloud Control (SCC) Firewall Management Deserialization of Untrusted Data Vulnerability (opens in a new tab) · Cisco network devices Security CVE-2026-20131 CVE published
Tue 3 March
ECDSA blackbox functions should not be pure as they have side effects (opens in a new tab) · Noir Security High
Tue 3 March
`convert_slice_push_back` doesn't update length (opens in a new tab) · Noir Security High
Tue 3 March
Unsafe usage of `read_array` (opens in a new tab) · Noir Security High
Tue 3 March
Slice operations create incorrect element_type_sizes array (opens in a new tab) · Noir Security Critical
Tue 3 March
RemoveIfElse incorrectly tracks slice sizes (opens in a new tab) · Noir Security Critical
Tue 3 March
Index in `convert_slice_pop_back` incorrectly calculated (opens in a new tab) · Noir Security Critical
Wed 18 February
GitLab Server-Side Request Forgery (SSRF) Vulnerability (opens in a new tab) · GitLab CE/EE Security CVE-2021-22175 CVE published
Tue 17 February
DoS via malicious p2p message (opens in a new tab) · Go Ethereum Security High CVE-2026-26314
Fri 13 February
BeyondTrust Remote Support (RS) and Privileged Remote Access (PRA) OS Command Injection Vulnerability (opens in a new tab) · BeyondTrust remote access Security CVE-2026-1731 CVE published
Tue 3 February
GitLab Community and Enterprise Editions Server-Side Request Forgery (SSRF) Vulnerability (opens in a new tab) · GitLab CE/EE Security CVE-2021-39935 CVE published
Tue 27 January
Fortinet Multiple Products Authentication Bypass Using an Alternate Path or Channel Vulnerability (opens in a new tab) · Fortinet security appliances Security CVE-2026-24858
Mon 26 January
Linux Kernel Integer Overflow Vulnerability (opens in a new tab) · Linux kernel Security CVE-2018-14634 CVE published
Fri 23 January
Broadcom VMware vCenter Server Out-of-bounds Write Vulnerability (opens in a new tab) · VMware vCenter Server Security CVE-2024-37079 CVE published
Tue 13 January
DoS via malicious p2p message (opens in a new tab) · Go Ethereum Security High CVE-2026-22862
Wed 7 January
Missing `get_inputs_vec` inputs for AES128Encrypt (opens in a new tab) · Noir Security High
Mon, 29 December 2025
MongoDB and MongoDB Server Improper Handling of Length Parameter Inconsistency Vulnerability (opens in a new tab) · MongoDB Server Security CVE-2025-14847 CVE published
Fri, 19 December 2025
WatchGuard Firebox Out of Bounds Write Vulnerability (opens in a new tab) · WatchGuard Firebox Security CVE-2025-14733
Wed, 17 December 2025
SonicWall SMA1000 Missing Authorization Vulnerability (opens in a new tab) · SonicWall Security CVE-2025-40602 CVE published
Tue, 16 December 2025
Fortinet Multiple Products Improper Verification of Cryptographic Signature Vulnerability (opens in a new tab) · Fortinet security appliances Security CVE-2025-59718 CVE published
Mon, 8 December 2025
D-Link Routers Buffer Overflow Vulnerability (opens in a new tab) · D-Link routers Security CVE-2022-37055 CVE published
Thu, 4 December 2025
Pacaya inbox verification pointer corruption (opens in a new tab) · Taiko Security High CVE-2025-66559
Mon, 1 December 2025
Soundness bug allowing proof forgery when casting from Field to u128 (opens in a new tab) · Noir Security Critical
Tue, 18 November 2025
Fortinet FortiWeb OS Command Injection Vulnerability (opens in a new tab) · Fortinet security appliances Security CVE-2025-58034
Fri, 14 November 2025
Fortinet FortiWeb Path Traversal Vulnerability (opens in a new tab) · Fortinet security appliances Security CVE-2025-64446
Wed, 12 November 2025
WatchGuard Firebox Out-of-Bounds Write Vulnerability (opens in a new tab) · WatchGuard Firebox Security CVE-2025-9242 CVE published
Tue, 3 June 2025
Vulnerability in Plonky3, Insufficient checks in the Rust verifier and embedded allocators (opens in a new tab) · SP1 (Succinct) Security High
Tue, 1 April 2025
Incorrect processing of effective balances in Electra epoch processing (opens in a new tab) · Lighthouse Security High
Thu, 30 January 2025
DoS via malicious p2p message (opens in a new tab) · Go Ethereum Security High CVE-2025-24883
Wed, 15 January 2025
Missing verifier checks and fiat-shamir observations (opens in a new tab) · SP1 (Succinct) Security High
Mon, 28 October 2024
Insufficient range checks of BabyBear arithmetic (opens in a new tab) · SP1 (Succinct) Security High
Mon, 6 May 2024
DoS via malicious p2p message (opens in a new tab) · Go Ethereum Security High CVE-2024-32972
Wed, 31 January 2024
Bounds check on built-in `slice()` function can be overflowed (opens in a new tab) · Vyper Security High CVE-2024-24561
Thu, 18 January 2024
concat built-in can corrupt memory (opens in a new tab) · Vyper Security High CVE-2024-22419
Tue, 12 December 2023
incorrect storage layout for contracts containing large arrays (opens in a new tab) · Vyper Security High CVE-2023-46247
Wed, 6 September 2023
DoS via malicious p2p message (opens in a new tab) · Go Ethereum Security High CVE-2023-40591
Sat, 5 August 2023
Incorrectly allocated named re-entrancy locks (opens in a new tab) · Vyper Security Critical CVE-2023-39363
Thu, 11 May 2023
incorrect ordering of default arguments passed to internal calls (opens in a new tab) · Vyper Security High CVE-2023-32059
Thu, 11 May 2023
OOB DynArray access when array is on both LHS and RHS of an assignment (opens in a new tab) · Vyper Security High CVE-2023-31146
Fri, 23 September 2022
Gas allocation error in CALL operations in Besu EVM (opens in a new tab) · Besu Security Critical CVE-2022-36025
Wed, 13 April 2022
external calls are not clamped in certain complex expressions (opens in a new tab) · Vyper Security High CVE-2022-24845
Fri, 10 December 2021
SHL, SHR, and SAR operations trigger native exception at key values (opens in a new tab) · Besu Security High CVE-2021-41272
Wed, 6 October 2021
Memory corruption when returning a literal struct with a private call inside of it (opens in a new tab) · Vyper Security High CVE-2021-41121
Tue, 24 August 2021
RETURNDATA corruption via datacopy (opens in a new tab) · Go Ethereum Security High CVE-2021-39137
Tue, 27 July 2021
VVE-2021-0003: Storage variables overwritten by re-entrancy locks (opens in a new tab) · Vyper Security High
Fri, 11 December 2020
Consensus flaw during block processing (opens in a new tab) · Go Ethereum Security High CVE-2020-26265
Tue, 24 November 2020
Denial of service via `MulMod` (opens in a new tab) · Go Ethereum Security High CVE-2020-26242
Tue, 24 November 2020
Denial of service due to Go CVE-2020-28362 (opens in a new tab) · Go Ethereum Security Critical CVE-2020-28362
Tue, 24 November 2020
Shallow copy in the 0x4 precompile could lead to EVM memory corruption (opens in a new tab) · Go Ethereum Security High CVE-2020-26241