electrum vulnerabilities
CVEs whose affected-version data names the electrum package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
3 CVEsRSS
CVE-2026-117602High· 8.4Electrum before 4.7.2 External Plugin Authorization Bypass Local Code Execution
Electrum 4.6.0 before 4.7.2 contains an authorization bypass in the external plugin loader, which executes a plugin's __init__.py module when the plugin is marked enabled in the config file, without verifying its plugin-password signatur…
CVE-2026-117603Medium· 4.3Electrum before 4.7.2 Nostr Wallet Connect Plugin Daily Spending Limit Bypass
Electrum before 4.7.2 contains a spending limit bypass vulnerability in the Nostr Wallet Connect plugin that allows malicious NWC clients to exceed daily_limit_sat by exploiting non-atomic budget checks and millisatoshi truncation. Attac…
CVE-2026-117601High· 7.5Electrum before 4.8.3 Missing Signature Verification of Mempool Transactions
Electrum before 4.8.3 fails to verify signatures of wallet-owned inputs in unconfirmed mempool transactions, allowing malicious servers to replace a just-broadcast transaction with a conflicting one. Attackers can swallow the user's tran…