RPC service DOS Analysed #2338094 Valid Denial of Service Medium 2025-05-23 – 47 Monero GUI OpenAlias DNSSEC-invalid resolution still writes spoofable address into recipient field Analysed #3819475 Valid No weakness recorded Medium 2026-08-20 – 44 `check_reserve_proof` counts duplicate entries: one output can inflate `total` Analysed #3699522 Valid Input Validation and Logic Medium 2026-08-05 – 42 `check_reserve_proof` sums RingCT ECDH amounts without checking the output commitment Analysed #3698862 Valid Cryptography Medium 2026-08-05 – 37 View-only offline transaction creation bypasses the long-payment-ID privacy block Analysed #3686283 Valid Information Disclosure Medium 2026-08-20 – 32 HTML Injection in Transaction Confirmation Dialog via Address Book Description Enables UI Spoofing Before Fund Transfer Analysed #3679471 Valid Command and Code Injection Medium 2026-08-20 – 30 ZMQ RPC Log Injection and Untrusted Payload Persistence Analysed #3621606 Valid Injection and Smuggling Medium 2026-07-24 – 30 SpendProofV1 txid-substitution: get_spend_proof/check_spend_proof do not verify returned transaction hash Analysed #3700036 Valid Cryptography Medium 2026-08-05 – 28 Hardware Wallets Do Not Check Unlock TIme Analysed #817245 Valid Cryptography Medium 2021-09-12 – 27 Restricted ZMQ RPC bypasses HTTP restricted-mode resource checks Analysed #3683886 Valid No weakness recorded Medium 2026-09-17 – 26 Remote node DOS Analysed #876530 Valid Denial of Service Medium 2026-06-29 – 24 ZMQ get_output_distribution duplicate amount DoS Analysed #3681690 Valid No weakness recorded Medium 2026-09-17 – 22 `monero-wallet-rpc::rescan_spent` accepts daemon-supplied spent-status from an untrusted daemon, enabling ring-intersection attack on transactions Analysed #3719670 Valid Information Disclosure Medium 2026-11-02 – 21 monero:// deeplink parsing accepts tx_amount=(all) and can trigger send-all transaction mode Analysed #3648638 Valid Input Validation and Logic Medium 2026-08-20 – 21 wallet-rpc describe_transfer uses real_output_in_tx_index instead of real_output: cold-wallet pre-sign review shows wrong ring member Analysed #3723315 Valid Memory Corruption Medium 2026-08-05 – 19 Exploiting Network and Timing Side-Channels to Break Monero Receiver Anonymity Analysed #713321 Valid No weakness recorded Medium 2019-11-15 – 16 Corrupt RPC responses from remote daemon nodes can lead to transaction tracing Analysed #304770 Valid Information Disclosure Medium 2018-03-16 – 13 Loss of multisig funds through single malicious participant's deliberate deception Analysed #3515557 Valid Input Validation and Logic Medium 2026-08-20 – 12 RingCT malformed tx prevents target from being able to sweep balance #506496 Valid Input Validation and Logic Medium 2019-04-20 – 9 DoS for remote nodes using Slow Loris attack #416494 Valid Denial of Service Medium 2019-02-21 – 9 monerod JSON RPC server remote DoS #1511843 Valid Denial of Service Medium 2022-09-12 – 5 Monero can leak unitialized memory #481164 Valid Information Disclosure Medium 2019-07-02 – 5 Remote Daemon RPC Attack #592094 Valid No weakness recorded Medium 2019-07-03 – 4 monerod can be disabled by a well-timed TCP reset packet #363714 Valid Denial of Service Medium 2018-08-02 – 4 CVE-2019-13132 - libzmq 4.1 series is vulnerable #652911 Valid Misconfiguration and Insecure Design Medium 2019-11-18 – 2 DLL hijacking in Monero GUI for Windows 0.17.3.0 would allow an attacker to perform remote command execution #1437942 Informative Command and Code Injection Medium 2021-12-30 – –