klever-io klever-go

• CVE-2026-82405 High 8.7 Klever-Go Account takeover: `kleverUpdateAccountPermission` authorizes on attacker-controlled `RecipientAddr` instead of the authenticated caller 0.4%
• CVE-2026-82409 High 8.4 Klever-Go: Elasticsearch bulk / painless injection via on-chain account name -> explorer/indexer data forgery 0.3%
• CVE-2026-82407 High 7.0 Klever-Go: Validator registration accepts an unvalidated BLS public key → consensus liveness DoS 0.5%
• CVE-2026-86065 High 7.5 Klever-Go: Unauthenticated WebSocket /subscribe: no read-size limit, no connection cap, permissive origin -> remote node memory/goroutine exhaustion (DoS) 0.4%
• CVE-2026-86064 High 8.6 Klever-Go: /log controls global node logging 0.6%
• CVE-2026-82406 High 7.1 Klever-Go: Zombie-order theft: `Buy` missing `IsClaimed` guard in native marketplace 0.4%
• CVE-2026-55764 High 8.7 Klever-Go: SFT add-quantity `int64` overflow bypasses a finite per-nonce MaxSupply 0.5%
• CVE-2026-55763 High 8.7 Klever-Go: Percentage-transfer royalty skips the source debit at exactly-100% splits 0.5%
• CVE-2026-54755 Critical 9.6 Klever-Go: Integer overflow in split-royalty validation enables unbounded minting of KLV (native token) 0.6%
• CVE-2026-54754 Critical 9.6 Klever-Go: Marketplace settlement mints KLV when referral % + royalty % exceed the bid (negative seller share silently skipped) 0.4%
• CVE-2026-52880 High 7.5 Klever-Go: REST API slow-header connection exhaustion via Gin Engine.Run 0.5%
• CVE-2026-52879 High 7.5 Klever-Go: Unbounded goroutine spawn on direct-message ingress enables peer-driven DoS 0.5%
• CVE-2026-52878 High 7.5 Klever-Go: Unauthenticated nil-pointer DoS in P2P transaction validation can halt the chain 0.5%
• CVE-2026-49343 Medium 5.9 Klever-Go KVM: Throttler slot leak in trie account-data sync causes epoch bootstrap / state sync DoS 0.4%
• CVE-2026-47249 High 7.5 Klever-Go KVM: Hash-array amplification in P2P resolver request handling 0.5%
• CVE-2026-58262 High 7.1 Klever-Go: PubKeysBitmap padding bits bypass the BLS signature quorum 0.2%
• CVE-2026-46403 Medium 6.3 Klever-Go KVM read-only execution can commit contract delete and upgrade side effects 0.5%
• CVE-2026-44697 High 8.6 Klever-Go MultiDataInterceptor: remote OOM via crafted compressed P2P payload 0.4%