spesmilo has 3 CVEs on record. 3 were published in the last 90 days. The busiest recent month was October 2026 with 3. The median CVSS is 7.5 (high).
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 7.5
- Publish → KEV
- —
- Last 90 days
- 3 prev 0
Worst active — by depth score
CVE-2026-117602High· 8.4Electrum before 4.7.2 External Plugin Authorization Bypass Local Code Execution46CVE-2026-117601High· 7.5Electrum before 4.8.3 Missing Signature Verification of Mempool Transactions41CVE-2026-117603Medium· 4.3Electrum before 4.7.2 Nostr Wallet Connect Plugin Daily Spending Limit Bypass24
spesmilo vulnerabilities
CVEs affecting spesmilo, newest first. Open any entry for full detail, references, and exploit status.
3 CVEsRSS
CVE-2026-117602High· 8.4Electrum before 4.7.2 External Plugin Authorization Bypass Local Code Execution
Electrum 4.6.0 before 4.7.2 contains an authorization bypass in the external plugin loader, which executes a plugin's __init__.py module when the plugin is marked enabled in the config file, without verifying its plugin-password signatur…
CVE-2026-117603Medium· 4.3Electrum before 4.7.2 Nostr Wallet Connect Plugin Daily Spending Limit Bypass
Electrum before 4.7.2 contains a spending limit bypass vulnerability in the Nostr Wallet Connect plugin that allows malicious NWC clients to exceed daily_limit_sat by exploiting non-atomic budget checks and millisatoshi truncation. Attac…
CVE-2026-117601High· 7.5Electrum before 4.8.3 Missing Signature Verification of Mempool Transactions
Electrum before 4.8.3 fails to verify signatures of wallet-owned inputs in unconfirmed mempool transactions, allowing malicious servers to replace a just-broadcast transaction with a conflicting one. Attackers can swallow the user's tran…