https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 06 Oct 2026 23:36:56 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-309292 EUVD-2026-309292 https://cve.radiocsirt.org/vuln/euvd-2026-309292 https://cve.radiocsirt.org/vuln/fkie_cve-2026-42278 <p>UltraDAG is a minimal DAG-BFT blockchain in Rust. Prior to commit fb6ef59, the UltraDAG StateEngine implementation of SmartTransferTx contains a critical logic flaw in its policy enforcement pipeline. When a transaction originates from a &#34;Pocket&#34; (a derived sub-address documented in the protocol as a way to organize funds), the engine fails to resolve the pocket&#39;s parent account before checking the spending policy. Because pockets are &#34;virtual&#34; addresses that exist only as entries in the pocket_to_parent map and do not have their own SmartAccountConfig entries, the check_spending_policy method defaults to an &#34;authorized/no policy&#34; result. This allow any user (or attacker in possession of a parent key) to instantly drain every pocket on an account, even if the parent account has a strict 24-hour vault delay or a 1 UDAG daily limit. This issue has been patched via commit fb6ef59.</p> <p>UltraDAG is a minimal DAG-BFT blockchain in Rust. Prior to commit fb6ef59, the UltraDAG StateEngine implementation of SmartTransferTx contains a critical logic flaw in its policy enforcement pipeline. When a transaction originates from a &#34;Pocket&#34; (a derived sub-address documented in the protocol as a way to organize funds), the engine fails to resolve the pocket&#39;s parent account before checking the spending policy. Because pockets are &#34;virtual&#34; addresses that exist only as entries in the pocket_to_parent map and do not have their own SmartAccountConfig entries, the check_spending_policy method defaults to an &#34;authorized/no policy&#34; result. This allow any user (or attacker in possession of a parent key) to instantly drain every pocket on an account, even if the parent account has a strict 24-hour vault delay or a 1 UDAG daily limit. This issue has been patched via commit fb6ef59.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-42278