Background sync cache retains outgoing additional transaction secret keys #3749681 Valid Information Disclosure Low 2026-08-20 – 1 (remote) exabyte allocation via load_from_binary() (DoS) #506498 Valid Denial of Service High 2019-07-03 – 2 CVE-2019-13132 - libzmq 4.1 series is vulnerable #652911 Valid Misconfiguration and Insecure Design Medium 2019-11-18 – 2 Potential linkage of public/private (anonymous) node addresses #766963 Valid Information Disclosure Low 2020-03-11 – 3 epee will accept an arbitrary amount of leading line-breaks in an http request #344499 Valid Denial of Service Low 2018-08-02 – 4 monerod can be disabled by a well-timed TCP reset packet #363714 Valid Denial of Service Medium 2018-08-02 – 4 Misreporting of received amount by show_transfers #364904 Valid Input Validation and Logic High 2018-08-02 – 4 Remote Daemon RPC Attack #592094 Valid No weakness recorded Medium 2019-07-03 – 4 A bug in the Monero wallet balance can enable theft from exchanges #377592 Valid Input Validation and Logic Critical 2018-08-02 – 5 Locked_Transfer functional burning #417515 Valid No weakness recorded High 2019-07-09 – 5 Monero can leak unitialized memory #481164 Valid Information Disclosure Medium 2019-07-02 – 5 Misconfiguration in build environment allows DLL preloading attack #896338 Valid No weakness recorded Low 2022-01-29 – 5 monerod JSON RPC server remote DoS #1511843 Valid Denial of Service Medium 2022-09-12 – 5 Out-of-bounds read when importing corrupt blockchain with monero-blockchain-import #284951 Valid Memory Corruption Low 2018-04-25 – 6 Trusted daemon check fails when proxied through torsocks or proxychains #361269 Valid Information Disclosure Low 2018-08-02 – 6 Constant-time comparison is not always implemented; critical areas are vulnerable to key-timing attacks #363680 Valid Cryptography Critical 2018-08-06 – 6 Remote P2P DoS #592200 Valid No weakness recorded Critical 2019-07-03 – 6 `set_daemon` wallet-rpc silently ignores `ssl_allowed_fingerprints` → pinning bypassed, wallet↔daemon MITM #3686259 Valid Cryptography High 2026-08-05 – 6 Computing hash of crafted block leads to crash in tree_hash() #519120 Valid Denial of Service High 2019-07-03 – 7 Monero wallet password change is confirmed when not matching #803028 Valid Authentication Low 2020-03-11 – 7 remote access to localhost daemon, can issue jsonrpc commands #303390 Valid Cross-Site Request Forgery Low 2018-02-22 – 9 Monero GUI not linked with /DYNAMICBASE or hardening on windows, no ASLR #321213 Valid No weakness recorded – 2018-03-18 – 9 DoS for remote nodes using Slow Loris attack #416494 Valid Denial of Service Medium 2019-02-21 – 9 Zero-amount miner TX + RingCT allows monero wallet to receive arbitrary amount of monero #501585 Valid Injection and Smuggling Critical 2019-07-03 – 9 RingCT malformed tx prevents target from being able to sweep balance #506496 Valid Input Validation and Logic Medium 2019-04-20 – 9 Potential use-after-free due to struct array_entry_t lacking an explicit copy constructor #511317 Valid Memory Corruption Low 2019-05-10 – 9 Excessive Resource Usage #543782 Valid Denial of Service – 2019-07-03 – 9 Stack Overflow in JSON RPC Server #390499 Valid Memory Corruption – 2018-09-28 – 10 Unauthorized access of Monero wallet by an unprivileged process #462442 Valid Access Control High 2019-04-03 – 10 Monero Wallet Gui for Windows (Arbitrary Code Execution) #630903 Valid Command and Code Injection High 2019-11-18 – 10 TabNabbing issue (due to taget=_blank) #265160 Valid No weakness recorded – 2018-04-25 – 11 Malicious get_random_rct_outs.bin rpc can cause a near-infinite loop #391611 Valid Denial of Service High 2018-09-28 – 12 Loss of multisig funds through single malicious participant's deliberate deception #3515557 Valid Input Validation and Logic Medium 2026-08-20 – 12 Corrupt RPC responses from remote daemon nodes can lead to transaction tracing #304770 Valid Information Disclosure Medium 2018-03-16 – 13 Buffer out of bound read in miniupnpc xml parser #340012 Valid Memory Corruption Low 2018-04-25 – 13 Kovri: potential buffer over-read in garlic clove handling + I2NP message creation #291489 Valid Information Disclosure High 2017-12-05 – 14 Reentrancy attack in eth-monero atomic swap #1668258 Valid Access Control – 2023-04-20 – 15 Exploiting Network and Timing Side-Channels to Break Monero Receiver Anonymity #713321 Valid No weakness recorded Medium 2019-11-15 – 16 Array Index Underflow--http rpc #825091 Valid Memory Corruption High 2021-10-11 – 16 Attcker can trick monero wallet into reporting it recived twice as much with alternative tx_keypubs #379049 Valid Input Validation and Logic High 2018-07-27 – 17 Inverted ternary in peerlist_manager::filter() allows unlimited whitelist entries per host via different ports #3547349 Valid No weakness recorded – 2026-06-29 – 18 wallet-rpc describe_transfer uses real_output_in_tx_index instead of real_output: cold-wallet pre-sign review shows wrong ring member #3723315 Valid Memory Corruption Medium 2026-08-05 – 19 Unix time unlock_time values have dangerous validation rules enabling a number of exploits #854726 Valid Input Validation and Logic High 2021-09-12 – 20 `relay_tx` wallet-rpc skips `--restricted-rpc` guard and lets any caller corrupt wallet state via attacker-controlled `pending_tx` #3687543 Valid Access Control Low 2026-08-05 – 20 monero:// deeplink parsing accepts tx_amount=(all) and can trigger send-all transaction mode #3648638 Valid Input Validation and Logic Medium 2026-08-20 – 21 `monero-wallet-rpc::rescan_spent` accepts daemon-supplied spent-status from an untrusted daemon, enabling ring-intersection attack on transactions #3719670 Valid Information Disclosure Medium 2026-11-02 – 21 Spamming highly nested JSON RPC requests cause node to disconnect from p2p network #2677306 Valid Denial of Service – 2025-04-23 – 22 ZMQ get_output_distribution duplicate amount DoS #3681690 Valid No weakness recorded Medium 2026-09-17 – 22 Transactions in invalid blocks are kept in tx-pool without undergoing certain checks. #2315026 Valid No weakness recorded – 2025-04-23 – 23 A peer can remotely fill the pending block queue to an extremely high size, with blocks that will never leave the queue. #2693786 Valid No weakness recorded – 2025-04-23 – 23