klever-io has 12 CVEs on record. Disclosure cadence is accelerating: 11 in the last 90 days against 1 in the 90 before. The busiest recent month was September 2026 with 6. The median CVSS is 8.5 (high), with 2 rated critical. None have a confirmed exploitation report. Most affected products: github.com/klever-io/klever-go (6), klever-go (6).
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 8.5
- Publish → KEV
- —
- Last 90 days
- 11 prev 1
Products
- github.com/klever-io/klever-go 6
- klever-go 6
Worst active — by depth score
CVE-2026-86064High· 8.6Klever-Go is the Go implementation of the Klever blockchain protocol59CVE-2026-82409High· 8.4Klever-Go is the Go implementation of the Klever blockchain protocol58CVE-2026-86065High· 7.5Klever-Go is the Go implementation of the Klever blockchain protocol53CVE-2026-54755Critical· 9.6Klever-Go is the Go implementation of the Klever blockchain protocol53CVE-2026-54754Critical· 9.6Klever-Go is the Go implementation of the Klever blockchain protocol53
klever-io vulnerabilities
CVEs affecting klever-io, newest first. Open any entry for full detail, references, and exploit status.
12 CVEsRSS
CVE-2026-82406High· 7.1PoCKlever-Go is the Go implementation of the Klever blockchain protocol
Klever-Go is the Go implementation of the Klever blockchain protocol. Prior to 1.7.20, the native marketplace function core/kapp/market/market.go Buy does not check IsClaimed before accepting a bid. A seller can use the Claim seller-acce…
CVE-2026-82407High· 7.0PoCKlever-Go is the Go implementation of the Klever blockchain protocol
Klever-Go is the Go implementation of the Klever blockchain protocol. Prior to 1.7.20, core/kapp/validators/validators.go Register and the runtime validator update path accept a submitted BLSPublicKey without curve, prime-order subgroup,…
CVE-2026-82409High· 8.4PoCKlever-Go is the Go implementation of the Klever blockchain protocol
Klever-Go is the Go implementation of the Klever blockchain protocol. Prior to 1.7.20, indexer/common.go serializedDataForUpdateAccounts places the attacker-controlled acc.Name value into an Elasticsearch _bulk JSON and NDJSON request wi…
CVE-2026-86065High· 7.5PoCKlever-Go is the Go implementation of the Klever blockchain protocol
Klever-Go is the Go implementation of the Klever blockchain protocol. Prior to 1.7.20, the default-open GET /subscribe endpoint in network/api/websocket/routes.go accepts unauthenticated WebSocket clients with permissive origin handling,…
CVE-2026-86064High· 8.6PoCKlever-Go is the Go implementation of the Klever blockchain protocol
Klever-Go is the Go implementation of the Klever blockchain protocol. Prior to 1.7.20, the default-open GET /log WebSocket route configured in config/node/api.yaml and registered by network/api/api.go does not require authentication. The…
CVE-2026-82405High· 8.7Klever-Go is the Go implementation of the Klever blockchain protocol
Klever-Go is the Go implementation of the Klever blockchain protocol. Prior to 1.7.20, the KleverUpdateAccountPermission built-in authorizes replacement of a target account's permissions by checking attacker-controlled vmInput.RecipientA…
CVE-2026-55764HighKlever-Go is the Go implementation of the Klever blockchain protocol
Klever-Go is the Go implementation of the Klever blockchain protocol. Prior to 1.7.19, Klever-Go allows a mint-role holder to bypass a finite per-nonce MaxSupply on the semi-fungible token add-quantity path. In core/kapp/systemAccount/sy…
CVE-2026-55763HighKlever-Go is the Go implementation of the Klever blockchain protocol
Klever-Go is the Go implementation of the Klever blockchain protocol. Prior to 1.7.19, processPercentageRoyaltiesTransfer in core/kapp/accounts/accounts.go calls SubFromBalance after the split loop and after the royaltiesToPay <= 0 early…
CVE-2026-54754Critical· 9.6Klever-Go is the Go implementation of the Klever blockchain protocol
Klever-Go is the Go implementation of the Klever blockchain protocol. Prior to 1.7.19, marketplace settlement in core/kapp/market/market.go reads MarketOrderData.ReferralPercentage from the listing while reading asset.Royalties.MarketPer…
CVE-2026-54755Critical· 9.6Klever-Go is the Go implementation of the Klever blockchain protocol
Klever-Go is the Go implementation of the Klever blockchain protocol. Prior to 1.7.19, split-royalty fields decoded in core/kapp/builtInFunctions/utils.go can contain values greater than core.HundredPercent, and core/kapp/kda/create.go a…
CVE-2026-49343Medium· 5.9PoCKlever-Go is the Go implementation of the Klever blockchain protocol
Klever-Go is the Go implementation of the Klever blockchain protocol. In versions prior to 1.7.18, the account-data trie syncers are vulnerable to a resource-exhaustion flaw that leaks bounded throttler slots on error paths. In syncDataT…
CVE-2026-44697High· 8.6Klever-Go MultiDataInterceptor has remote OOM via crafted compressed P2P payload
Klever-Go MultiDataInterceptor has remote OOM via crafted compressed P2P payload