ZcashFoundation
- Total products in the ecosystem
- 8
- Total vulnerabilities (90 days)
- 39
en
A short verification protects source data and prevents automated AI requests.
Verifying...
As of 11/08/2026, ZcashFoundation recorded 39 security vulnerabilities in the last 90 days across 5 products, including 19 rated High or above and 0 known exploited vulnerabilities (KEV) that should be prioritized for immediate remediation.
Over the last 90 days, zebra had the most security vulnerabilities in the ZcashFoundation ecosystem, with 39 vulnerabilities—approximately 100% of the provider's total vulnerabilities during this period.
CyStack VulnScan continuously discovers assets, validates vulnerabilities, and helps security teams prioritize remediation across the organization.
CVE-2026-123560Zebra before 7.0.0 Sync Denial of Service via Forged Checkpoint Block BodyCVE-2026-123559Zebra before 7.0.0 Denial of Service via Quadratic Sighash ComputationCVE-2026-123558Zebra before 7.0.0 Checkpoint Sync Denial of Service via Cancelled Verifier RewindCVE-2026-123557Zebra zebrad before 7.0.0 Reachable Assertion DoS via Peer DisconnectionCVE-2026-123556Zebra 4.5.0 before 7.0.0 Honest Peer Ban via Mempool Lock-Time Scoring| Vulnerability | Exploitation status | Fix | Affected product | Published | Severity |
|---|---|---|---|---|---|
CVE-2026-123560Zebra before 7.0.0 Sync Denial of Service via Forged Checkpoint Block Body | Exploitation statusNot confirmed | FixYes |
| Published11/08/2026 |
| SeverityHigh |
CVE-2026-123559Zebra before 7.0.0 Denial of Service via Quadratic Sighash Computation | Exploitation statusNot confirmed | FixYes | Affected productzebra | Published11/08/2026 | SeverityHigh |
|---|
CVE-2026-123558Zebra before 7.0.0 Checkpoint Sync Denial of Service via Cancelled Verifier Rewind | Exploitation statusNot confirmed | FixYes | Affected productzebra | Published11/08/2026 | SeverityHigh |
|---|
CVE-2026-123557Zebra zebrad before 7.0.0 Reachable Assertion DoS via Peer Disconnection | Exploitation statusNot confirmed | FixYes | Affected productzebra | Published11/08/2026 | SeverityHigh |
|---|
CVE-2026-123556Zebra 4.5.0 before 7.0.0 Honest Peer Ban via Mempool Lock-Time Scoring | Exploitation statusNot confirmed | FixYes | Affected productzebra | Published11/08/2026 | SeverityMedium |
|---|
CVE-2026-123555Zebra 2.3.0 before 7.0.0 Denial of Service via Unscored Script Verification Failures | Exploitation statusNot confirmed | FixYes | Affected productzebra | Published11/08/2026 | SeverityHigh |
|---|
CVE-2026-123554Zebra zebrad 6.4.0 before 7.0.0 Denial of Service via Mempool Coinbase-Maturity Check | Exploitation statusNot confirmed | FixYes | Affected productzebra | Published11/08/2026 | SeverityHigh |
|---|
CVE-2026-109366Zebra before 6.4.0 Gossiped Block Drop via Forged Coinbase scriptSig Height | Exploitation statusActively exploited | FixYes | Affected productzebra | Published10/12/2026 | SeverityMedium |
|---|
CVE-2026-109365Zebra before 6.4.0 Denial of Service via Same-Hash Forged Block Bodies | Exploitation statusNot exploited | FixYes | Affected productzebra | Published10/12/2026 | SeverityMedium |
|---|
CVE-2026-109364Zebra 2.3.0 before 6.4.0 Peer Ban Bypass via Exact-IP Keying | Exploitation statusNot exploited | FixYes | Affected productzebra | Published10/12/2026 | SeverityMedium |
|---|
CVE-2026-109363Zebra 6.4.0 before 6.4.2 Denial of Service via Malformed v6 Transaction | Exploitation statusNot exploited | FixYes | Affected productzebra | Published10/12/2026 | SeverityHigh |
|---|
CVE-2026-104437Zebra before 4.4.0 Consensus Split via SIGHASH_SINGLE Missing-Output Handling | Exploitation statusActively exploited | FixYes | Affected productzebra | Published10/02/2026 | SeverityHigh |
|---|
CVE-2026-104436Zebra before 4.5.0 CPU Amplification via Uncapped getblocks/getheaders Locator Length | Exploitation statusNot exploited | FixYes | Affected productzebra | Published10/02/2026 | SeverityMedium |
|---|
CVE-2026-104435Zebra 4.4.0 Consensus Divergence via V5 SIGHASH_SINGLE Without Output | Exploitation statusNot exploited | FixYes | Affected productzebra | Published10/02/2026 | SeverityHigh |
|---|
CVE-2026-104434Zebra before 8.0.0 Denial of Service via z_listunifiedreceivers RPC | Exploitation statusNot exploited | FixYes | Affected productzebra | Published10/02/2026 | SeverityHigh |
|---|
CVE-2026-104432Zebra before 6.3.0 False Readiness via Discarded One-Hash FindBlocks Response | Exploitation statusNot exploited | FixYes | Affected productzebra | Published10/02/2026 | SeverityMedium |
|---|
CVE-2026-104431Zebra before 6.0.0 Denial of Service via Synchronous Script FFI Verification | Exploitation statusNot exploited | FixYes | Affected productzebra | Published10/02/2026 | SeverityHigh |
|---|
CVE-2026-104430Zebra 4.5.0 Consensus Split via P2SH Sigop Overcount | Exploitation statusNot exploited | FixYes | Affected productzebra | Published10/02/2026 | SeverityHigh |
|---|
CVE-2026-104429Zebra before 6.0.0-rc.0 Per-Peer Mempool Admission Bypass via P2P tx Messages | Exploitation statusNot exploited | FixYes | Affected productzebra | Published10/02/2026 | SeverityMedium |
|---|
CVE-2026-104428Zebra before 11.0.0 Denial of Service via getblock Verbosity 2 | Exploitation statusNot exploited | FixYes | Affected productzebra | Published10/02/2026 | SeverityMedium |
|---|
CVE-2026-104427Zebra before 6.1.0 Chain Stall via Stale parent_error_map Entry | Exploitation statusNot exploited | FixYes | Affected productzebra | Published10/02/2026 | SeverityHigh |
|---|
CVE-2026-104426Zebra before 6.1.0 Quadratic Complexity DoS via Block Transparent Value Check | Exploitation statusNot exploited | FixYes | Affected productzebra | Published10/02/2026 | SeverityHigh |
|---|
CVE-2026-104425Zebra before 6.1.0 Batch-Verification Poisoning DoS via Unattributed Pushed Transactions | Exploitation statusNot exploited | FixYes | Affected productzebra | Published10/02/2026 | SeverityMedium |
|---|
CVE-2026-104424Zebra before 6.1.0 Incorrect Block Size Calculation in getblocktemplate | Exploitation statusNot exploited | FixYes | Affected productzebra | Published10/02/2026 | SeverityMedium |
|---|
CVE-2026-104423Zebra before 6.2.1 Denial of Service via Uncapped V6 Shielded Proof Verification | Exploitation statusNot exploited | FixYes | Affected productzebra | Published10/02/2026 | SeverityHigh |
|---|
CVE-2026-104422Zebra before 6.3.0 Block Sync Denial of Service via Coinbase scriptSig Rewrite | Exploitation statusNot exploited | FixYes | Affected productzebra | Published10/02/2026 | SeverityHigh |
|---|
CVE-2026-104421Zebra before 6.2.1 Block Download Denial of Service via KnownBlock SentHashes Lockout | Exploitation statusNot exploited | FixYes | Affected productzebra | Published10/02/2026 | SeverityMedium |
|---|
CVE-2026-104420Zebra before 6.3.0 Peer Misbehavior Ban Bypass via Gossiped Blocks | Exploitation statusNot exploited | FixYes | Affected productzebra | Published10/02/2026 | SeverityMedium |
|---|
CVE-2026-104419Zebra before 6.3.0 Honest Peer Banning via Far-Ahead FindBlocks Hashes | Exploitation statusNot exploited | FixYes | Affected productzebra | Published10/02/2026 | SeverityMedium |
|---|
CVE-2026-52829ZEBRA: IPv4-Mapped Mempool Misbehavior Update Aborts Zebra Address Book | Exploitation statusNot exploited | FixYes | Affected productzebra | Published08/18/2026 | SeverityHigh |
|---|
CVE-2026-52739ZEBRA: Repeated Non-Finalized Shielded Transaction Aborts Zebra Before Duplicate-Nullifier Rejection | Exploitation statusNot exploited | FixYes | Affected productzebra | Published08/18/2026 | SeverityMedium |
|---|
CVE-2026-52738ZEBRA: Finalized address balance credit-first overflow on consensus-valid blocks | Exploitation statusNot exploited | FixYes | Affected productzebra | Published08/18/2026 | SeverityMedium |
|---|
CVE-2026-52737ZEBRA: Sync restart poisoning from single unauthenticated peer via above-lookahead block | Exploitation statusNot exploited | FixYes | Affected productzebra | Published08/18/2026 | SeverityMedium |
|---|
CVE-2026-52736ZEBRA: Block suppression via NU5 same-header body poisoning of sent-hash cache | Exploitation statusNot exploited | FixYes | Affected productzebra | Published08/18/2026 | SeverityHigh |
|---|
CVE-2026-52735ZEBRA: Consensus divergence via P2SH sigop undercount in pure-Rust disabled-opcode parser | Exploitation statusNot exploited | FixYes | Affected productzebra | Published08/18/2026 | SeverityCritical |
|---|
CVE-2026-52734ZEBRA: Unbounded memory leak in mempool download pipeline via timeout path cancel_handles retention | Exploitation statusNot exploited | FixYes | Affected productzebra | Published08/18/2026 | SeverityMedium |
|---|
CVE-2026-52733ZEBRA: Persistent on-disk corruption of Sapling/Orchard subtree roots after chain fork via pop_tip | Exploitation statusNot exploited | FixYes | Affected productzebra | Published08/18/2026 | SeverityMedium |
|---|
CVE-2026-52732ZEBRA: Mempool transaction admission denial via single-peer inbound queue saturation | Exploitation statusActively exploited | FixYes | Affected productzebra | Published08/18/2026 | SeverityMedium |
|---|
CVE-2026-52731ZEBRA: Full node denial of service via non-ASCII LongPollId in getblocktemplate | Exploitation statusNot exploited | FixYes | Affected productzebra | Published08/18/2026 | SeverityMedium |
|---|
CVE-2026-54496Missing copy constraint in halo2_gadgets variable-base scalar multiplication allows under-constrained base, breaking Orchard Action circuit soundness | Exploitation statusNot exploited | FixYes | Affected producthalo2_gadgets | Published07/17/2026 | SeverityCritical |
|---|
CVE-2026-44500ZEBRA: Allocation Amplification in Inbound Network Deserializers | Exploitation statusNot exploited | FixYes | Affected productzebra | Published05/08/2026 | SeverityMedium |
|---|
CVE-2026-44499ZEBRA: Permanent Block Discovery Halt via Gossip Queue Saturation and Syncer Poisoning | Exploitation statusNot exploited | FixYes | Affected productzebra | Published05/08/2026 | SeverityHigh |
|---|
CVE-2026-44498ZEBRA: Block Validator Undercounts Coinbase and P2SH Sigops | Exploitation statusNot exploited | FixYes | Affected productzebra | Published05/08/2026 | SeverityCritical |
|---|
CVE-2026-44497ZEBRA: Consensus Divergence in Transparent Sighash Hash-Type Handling due to Stale Buffer | Exploitation statusNot exploited | FixYes | Affected productzebra | Published05/08/2026 | SeverityCritical |
|---|
CVE-2026-41585ZEBRA: Denial of Service via Interrupted JSON-RPC Requests from Authenticated Clients | Exploitation statusNot exploited | FixYes | Affected productzebra | Published05/08/2026 | SeverityMedium |
|---|
CVE-2026-41584ZEBRA: rk Identity Point Panic in Transaction Verification | Exploitation statusNot exploited | FixYes | Affected productzebra | Published05/08/2026 | SeverityCritical |
|---|
CVE-2026-41583ZEBRA: Consensus Divergence in Transparent Sighash Hash-Type Handling | Exploitation statusNot exploited | FixYes | Affected productzebra | Published05/08/2026 | SeverityCritical |
|---|
CVE-2026-40881Zebra: addr/addrv2 Deserialization Resource Exhaustion | Exploitation statusActively exploited | FixYes | Affected productzebra-network | Published04/21/2026 | SeverityMedium |
|---|
CVE-2026-40880Zebra: Cached Mempool Verification Bypasses Consensus Rules for Ahead-of-Tip Blocks | Exploitation statusNot exploited | FixYes | Affected productzebra-consensus | Published04/21/2026 | SeverityHigh |
|---|
CVE-2026-34377Zebra has a Consensus Failure due to Improper Verification of V5 Transactions | Exploitation statusNot exploited | FixYes | Affected productzebra | Published03/31/2026 | SeverityHigh |
|---|
52 Results | Page 1 of 2