CVE-2026-56744High· 8.7▾ MidnightPoC available`@bsv/wallet-toolbox` provides BRC-100 wallet signing and storage components, while `@bsv/wallet-toolbox-client` and `@bsv/wallet-toolbox-mobile` provide client-focused distributions for standard and mobile applications using wallet stor…
▾ Midnight zone — Critical, or high with PoC / in-the-wild
impact 47.8 · likelihood 0.1 · exploitation 12
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the assigning CNA record, not NVD.
Exploit-prediction probability, daily snapshots since Sep 26.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
0.3%
Exploit / PoC code exists
Last analysed / modified upstream
0.3% → 0.4%
@bsv/wallet-toolbox provides BRC-100 wallet signing and storage components, while @bsv/wallet-toolbox-client and @bsv/wallet-toolbox-mobile provide client-focused distributions for standard and mobile applications using wallet storage services. A vulnerability in these packages causes transactions created through a remote StorageClient to trust output locking scripts returned by the storage provider without verifying that they match the outputs requested by the caller. A malicious or compromised storage provider can substitute a recipient script or inject an additional output, causing the wallet to sign and broadcast a transaction that redirects funds while the application and user interface continue to display the intended recipient. Source and npm publication history indicate that stable versions @bsv/wallet-toolbox and @bsv/wallet-toolbox-client from 1.1.47 through 2.3.3, and @bsv/wallet-toolbox-mobile from its initial 1.3.21 release through 2.3.3, are affected. All three packages are patched in version 2.4.0. Applications unable to upgrade should avoid remote StorageClient providers, use local storage, or independently verify every transaction output’s locking script and value against the original request before signing
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Affected packages:
@bsv/wallet-toolbox >= 1.1.47, < 2.4.0@bsv/wallet-toolbox-client >= 1.1.47, < 2.4.0@bsv/wallet-toolbox-mobile >= 1.3.21, < 2.4.0Patched in:
@bsv/wallet-toolbox 2.4.0@bsv/wallet-toolbox-client 2.4.0@bsv/wallet-toolbox-mobile 2.4.0Field changes observed since this record was first indexed.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-31431High· 7.8In the Linux kernel, the following vulnerability has been resolved: crypto: algif_aead - Revert to operating out-of-place This mostly reverts commit 72548b093ee3 except for the copying of the associated data. There is no benefit in op…
CVE-2026-116178High· 7.5vLLM from 0.20.0 before 0.30.0 contains a denial of service vulnerability that allows remote attackers to crash the engine by sending inc…
CVE-2026-89317Medium· 6.3JwtVerifierImpl.Verify does not enforce the JWS `crit` header (RFC 7515 §4.1.11)
CVE-2026-98745Medium· 5.5kernel: arm64/fpsimd: signal: Forbid non-streaming SVE payload on SME-only systems (CVE-2026-98745)
CVE-2026-98794Medium· 6.5kernel: ipvs: filter some flags received in the backup server (CVE-2026-98794)
CVE-2026-31709High· 8.8In the Linux kernel, the following vulnerability has been resolved: smb: client: validate the whole DACL before rewriting it in cifsacl build_sec_desc() and id_mode_to_cifs_acl() derive a DACL pointer from a server-supplied dacloffset …