What’s Vulnerable › Products
klever-io klever-go vulnerabilities
18 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 18 published in the last 12 months.
Check whether your klever-io klever-go version is affected
Latest klever-io klever-go vulnerabilities
- CVE-2026-86065 — Klever-Go: Unauthenticated WebSocket /subscribe: no read-size limit, no connection cap, permissive origin -> remote node memory/goroutine exhaustion (DoS) (CVSS 7.5)
- CVE-2026-86064 — Klever-Go: /log controls global node logging (CVSS 8.6)
- CVE-2026-82409 — Klever-Go: Elasticsearch bulk / painless injection via on-chain account name -> explorer/indexer data forgery (CVSS 8.4)
- CVE-2026-82407 — Klever-Go: Validator registration accepts an unvalidated BLS public key → consensus liveness DoS (CVSS 7.0)
- CVE-2026-82406 — Klever-Go: Zombie-order theft: `Buy` missing `IsClaimed` guard in native marketplace (CVSS 7.1)
- CVE-2026-82405 — Klever-Go Account takeover: `kleverUpdateAccountPermission` authorizes on attacker-controlled `RecipientAddr` instead of the authenticated caller (CVSS 8.7)
- CVE-2026-55764 — Klever-Go: SFT add-quantity `int64` overflow bypasses a finite per-nonce MaxSupply (CVSS 8.7)
- CVE-2026-55763 — Klever-Go: Percentage-transfer royalty skips the source debit at exactly-100% splits (CVSS 8.7)
- CVE-2026-54755 — Klever-Go: Integer overflow in split-royalty validation enables unbounded minting of KLV (native token) (CVSS 9.6)
- CVE-2026-54754 — Klever-Go: Marketplace settlement mints KLV when referral % + royalty % exceed the bid (negative seller share silently skipped) (CVSS 9.6)
- CVE-2026-52880 — Klever-Go: REST API slow-header connection exhaustion via Gin Engine.Run (CVSS 7.5)
- CVE-2026-52879 — Klever-Go: Unbounded goroutine spawn on direct-message ingress enables peer-driven DoS (CVSS 7.5)
- CVE-2026-52878 — Klever-Go: Unauthenticated nil-pointer DoS in P2P transaction validation can halt the chain (CVSS 7.5)
- CVE-2026-49343 — Klever-Go KVM: Throttler slot leak in trie account-data sync causes epoch bootstrap / state sync DoS (CVSS 5.9)
- CVE-2026-47249 — Klever-Go KVM: Hash-array amplification in P2P resolver request handling (CVSS 7.5)
- CVE-2026-58262 — Klever-Go: PubKeysBitmap padding bits bypass the BLS signature quorum (CVSS 7.1)
- CVE-2026-46403 — Klever-Go KVM read-only execution can commit contract delete and upgrade side effects (CVSS 6.3)
- CVE-2026-44697 — Klever-Go MultiDataInterceptor: remote OOM via crafted compressed P2P payload (CVSS 8.6)