Vulnerability GO-2026-6584
Unknown
UNKNOWN RISK
Vulnerabilities without an assigned CVSS score. Severity is not determinable from available data.
6 hours ago
October 01, 2026 at 08:23 PM UTC
Klever-Go: Zombie-order theft: `Buy` missing `IsClaimed` guard in native marketplace in github.com/klever-io/klever-go
v1.7.14 - v1.7.19
v1.7.14 - v1.7.19
Summary
Klever-Go: Zombie-order theft: `Buy` missing `IsClaimed` guard in native marketplace in github.com/klever-io/klever-go
Details
Klever-Go: Zombie-order theft: Buy missing IsClaimed guard in native marketplace in github.com/klever-io/klever-go
Related Vulnerabilities
Other vulnerabilities affecting the same packages
Unknown
6 hours ago
Klever-Go: Unauthenticated WebSocket /subscribe: no read-size limit, no connection cap, permissive origin -> remote node memory/goroutine exhaustion (DoS) in github.com/klever-io/klever-go
v1.7.14 - v1.7.19 GO-2026-6581
v1.7.14 - v1.7.19 GO-2026-6581
Unknown
6 hours ago
Klever-Go Account takeover: `kleverUpdateAccountPermission` authorizes on attacker-controlled `RecipientAddr` instead of the authenticated caller in github.com/klever-io/klever-go
v1.7.14 - v1.7.19 GO-2026-6582
v1.7.14 - v1.7.19 GO-2026-6582
Unknown
6 hours ago
Klever-Go: /log controls global node logging in github.com/klever-io/klever-go
v1.7.14 - v1.7.19 GO-2026-6583
v1.7.14 - v1.7.19 GO-2026-6583
Unknown
6 hours ago
Klever-Go: Elasticsearch bulk / painless injection via on-chain account name -> explorer/indexer data forgery in github.com/klever-io/klever-go
v1.7.14 - v1.7.19 GO-2026-6585
v1.7.14 - v1.7.19 GO-2026-6585
Unknown
6 hours ago
Klever-Go: Validator registration accepts an unvalidated BLS public key → consensus liveness DoS in github.com/klever-io/klever-go
v1.7.14 - v1.7.19 GO-2026-6586
v1.7.14 - v1.7.19 GO-2026-6586
Impacted packages
Timeline
Published
6 hours ago
October 01, 2026 at 08:23 PM UTC
Last Modified
6 hours ago
October 01, 2026 at 08:45 PM UTC