Log in Start free

stellar

Products

ProductCVEsExploitedLatest
rs-soroban-sdk3–Mar 12, 2026
js-stellar-sdk1–Jul 2, 2021
rs-soroban-poseidon1–Mar 12, 2026
freighter1–Aug 25, 2023
rs-stellar-strkey1–Oct 25, 2023
rs-stellar-xdr1–Mar 6, 2026
stellar-core1–May 9, 2024

Exploited and recent CVEs

  • CVE-2026-32322 Medium 5.3 soroban-sdk: `Fr` scalar field equality comparison bypasses modular reduction 0.3%
  • CVE-2026-32129 High 8.7 Poseidon V1 variable-length input collision via implicit zero-padding 0.2%
  • CVE-2026-29795 Medium 4.0 stellar-xdr: `StringM::from_str` bypasses max length validation 0.2%
  • CVE-2026-26267 High 7.5 rs-soroban-sdk #[contractimpl] macro calls inherent function instead of trait function when names collide 0.4%
  • CVE-2026-24889 Medium 5.3 soroban-sdk has overflow in Bytes::slice, Vec::slice, GenRange::gen_range for u64 0.4%
  • CVE-2024-32985 Medium 5.9 Stellar-core's Overlay - security fix for DDoS mitigation 0.4%
  • CVE-2023-46135 Medium 5.3 Panic in SignedPayload::from_payload 1.0%
  • CVE-2023-40580 High 8.1 Freighter mnemonic phrase may be accessed by Javascript through a private API 0.8%
  • CVE-2021-32738 Medium 6.5 Utils.readChallengeTx does not verify the server account signature 0.5%