https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2020-12119.htmlhttps://patchthecve.com/cve/CVE-2020-12119.htmlWed, 17 Jun 2026 02:51:26 +0000HIGH 8.1: Ledger Live before 2.7.0 does not handle Bitcoin's Replace-By-Fee (RBF). It increases the user's balance with the value of an unconfirmed transaction as soon as it is received (before the transaction is confirmed) and does not decrease the balance when it is canceled. As a result, users are exposed https://patchthecve.com/cve/CVE-2020-6861.htmlhttps://patchthecve.com/cve/CVE-2020-6861.htmlWed, 17 Jun 2026 03:23:56 +0000MEDIUM 5.5: A flawed protocol design in the Ledger Monero app before 1.5.1 for Ledger Nano and Ledger S devices allows a local attacker to extract the master spending key by sending crafted messages to this app selected on a PIN-entered Ledger connected to a host PC.https://patchthecve.com/cve/CVE-2019-14354.htmlhttps://patchthecve.com/cve/CVE-2019-14354.htmlWed, 17 Jun 2026 02:18:15 +0000LOW 2.4: On Ledger Nano S and Nano X devices, a side channel for the row-based OLED display was found. The power consumption of each row-based display cycle depends on the number of illuminated pixels, allowing a partial recovery of display contents. For example, a hardware implant in the USB cable might be