CVE records

Every CVE as the CVE Program publishes it, refreshed every ten minutes, with NVD's analysis, CISA's known-exploited status and a healthcare tag. Subscribers get the CVEs that match their own systems on My program, by email as they are published. Where the data comes from: sources.

Updated under an hour ago ()

What this means for you

This week: 5,500 CVEs published, 358 critical, and 7 newly confirmed exploited. Add your stack to see whether any of them hit you.

Published in the last 7 days
5,500
Show in the list
Critical, last 7 days
358
Show in the list
Healthcare-tagged, last 7 days
5
Show in the list
Known exploited (CISA KEV)
1,747
Show in the list

Showing CVEs that name the product klever_io:klever_go. Show all products

16 CVEs, showing 1 to 16
CVESeverityTitlePublished
CVE-2026-82405High 8.7Klever-Go Account takeover: `kleverUpdateAccountPermission` authorizes on attacker-controlled `RecipientAddr` instead of the authenticated caller
Assigned by GitHub_M
Sep 23, 2026
CVE-2026-82409High 8.4Klever-Go: Elasticsearch bulk / painless injection via on-chain account name -> explorer/indexer data forgery
Assigned by GitHub_M
Sep 23, 2026
CVE-2026-82407High 7.0Klever-Go: Validator registration accepts an unvalidated BLS public key → consensus liveness DoS
Assigned by GitHub_M
Sep 23, 2026
CVE-2026-86065High 7.5Klever-Go: Unauthenticated WebSocket /subscribe: no read-size limit, no connection cap, permissive origin -> remote node memory/goroutine exhaustion (DoS)
Assigned by GitHub_M
Sep 23, 2026
CVE-2026-86064High 8.6Klever-Go: /log controls global node logging
Assigned by GitHub_M
Sep 23, 2026
CVE-2026-82406High 7.1Klever-Go: Zombie-order theft: `Buy` missing `IsClaimed` guard in native marketplace
Assigned by GitHub_M
Sep 23, 2026
CVE-2026-55764High 8.7Klever-Go: SFT add-quantity `int64` overflow bypasses a finite per-nonce MaxSupply
Assigned by GitHub_M
Aug 28, 2026
CVE-2026-55763High 8.7Klever-Go: Percentage-transfer royalty skips the source debit at exactly-100% splits
Assigned by GitHub_M
Aug 28, 2026
CVE-2026-54755Critical 9.6Klever-Go: Integer overflow in split-royalty validation enables unbounded minting of KLV (native token)
Assigned by GitHub_M
Aug 28, 2026
CVE-2026-54754Critical 9.6Klever-Go: Marketplace settlement mints KLV when referral % + royalty % exceed the bid (negative seller share silently skipped)
Assigned by GitHub_M
Aug 28, 2026
CVE-2026-52880High 7.5Klever-Go: REST API slow-header connection exhaustion via Gin Engine.Run
Assigned by GitHub_M
Aug 7, 2026
CVE-2026-52879High 7.5Klever-Go: Unbounded goroutine spawn on direct-message ingress enables peer-driven DoS
Assigned by GitHub_M
Aug 7, 2026
CVE-2026-52878High 7.5Klever-Go: Unauthenticated nil-pointer DoS in P2P transaction validation can halt the chain
Assigned by GitHub_M
Aug 7, 2026
CVE-2026-49343Medium 5.9Klever-Go KVM: Throttler slot leak in trie account-data sync causes epoch bootstrap / state sync DoS
Assigned by GitHub_M
Aug 7, 2026
CVE-2026-47249High 7.5Klever-Go KVM: Hash-array amplification in P2P resolver request handling
Assigned by GitHub_M
Aug 7, 2026
CVE-2026-58262High 7.1Klever-Go: PubKeysBitmap padding bits bypass the BLS signature quorum
Assigned by GitHub_M
Aug 7, 2026

CVSS is the assigning CNA's score where it gives one, otherwise NVD's. The healthcare tag is a documented heuristic (a list of clinical and health IT vendors, and clinical terms in the description), not a classification. The CVE record is authoritative.

Your cookie choices
We use essential cookies to run this site, and, only with your consent, an advertising cookie from Google to measure whether our ads lead to sign-ups and subscriptions. See our for details.