https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2023-45130.htmlhttps://patchthecve.com/cve/CVE-2023-45130.htmlWed, 17 Jun 2026 06:28:16 +0000HIGH 7.5: Frontier is Substrate's Ethereum compatibility layer. Prior to commit aea528198b3b226e0d20cce878551fd4c0e3d5d0, at the end of a contract execution, when opcode SUICIDE marks a contract to be deleted, the software uses `storage::remove_prefix` (now renamed to `storage::clear_prefix`) to remove all sthttps://patchthecve.com/cve/CVE-2023-34449.htmlhttps://patchthecve.com/cve/CVE-2023-34449.htmlWed, 17 Jun 2026 06:03:40 +0000MEDIUM 5.3: ink! is an embedded domain specific language to write smart contracts in Rust for blockchains built on the Substrate framework. Starting in version 4.0.0 and prior to version 4.2.1, the return value when using delegate call mechanics, either through `CallBuilder::delegate` or `ink_env::invoke_contrahttps://patchthecve.com/cve/CVE-2023-28431.htmlhttps://patchthecve.com/cve/CVE-2023-28431.htmlWed, 17 Jun 2026 05:47:42 +0000HIGH 7.5: Frontier is an Ethereum compatibility layer for Substrate. Frontier's `modexp` precompile uses `num-bigint` crate under the hood. In the implementation prior to pull request 1017, the cases for modulus being even and modulus being odd are treated separately. Odd modulus uses the fast Montgomery multhttps://patchthecve.com/cve/CVE-2022-39242.htmlhttps://patchthecve.com/cve/CVE-2022-39242.htmlWed, 17 Jun 2026 04:57:58 +0000MEDIUM 5.3: Frontier is an Ethereum compatibility layer for Substrate. Prior to commit d3beddc6911a559a3ecc9b3f08e153dbe37a8658, the worst case weight was always accounted as the block weight for all cases. In case of large EVM gas refunds, this can lead to block spamming attacks -- the adversary can construct https://patchthecve.com/cve/CVE-2022-36008.htmlhttps://patchthecve.com/cve/CVE-2022-36008.htmlWed, 17 Jun 2026 04:52:43 +0000HIGH 7.1: Frontier is Substrate's Ethereum compatibility layer. A security issue was discovered affecting parsing of the RPC result of the exit reason in case of EVM reversion. In release build, this would cause the exit reason being incorrectly parsed and returned by RPC. In debug build, this would cause an https://patchthecve.com/cve/CVE-2022-31111.htmlhttps://patchthecve.com/cve/CVE-2022-31111.htmlWed, 17 Jun 2026 04:44:49 +0000MEDIUM 5.3: Frontier is Substrate's Ethereum compatibility layer. In affected versions the truncation done when converting between EVM balance type and Substrate balance type was incorrectly implemented. This leads to possible discrepancy between appeared EVM transfer value and actual Substrate value transferrehttps://patchthecve.com/cve/CVE-2022-21685.htmlhttps://patchthecve.com/cve/CVE-2022-21685.htmlWed, 17 Jun 2026 04:26:45 +0000MEDIUM 6.5: Frontier is Substrate's Ethereum compatibility layer. Prior to commit number `8a93fdc6c9f4eb1d2f2a11b7ff1d12d70bf5a664`, a bug in Frontier's MODEXP precompile implementation can cause an integer underflow in certain conditions. This will cause a node crash for debug builds. For release builds (and phttps://patchthecve.com/cve/CVE-2021-41138.htmlhttps://patchthecve.com/cve/CVE-2021-41138.htmlWed, 17 Jun 2026 04:07:57 +0000MEDIUM 5.3: Frontier is Substrate's Ethereum compatibility layer. In the newly introduced signed Frontier-specific extrinsic for `pallet-ethereum`, a large part of transaction validation logic was only called in transaction pool validation, but not in block execution. Malicious validators can take advantage of https://patchthecve.com/cve/CVE-2021-39193.htmlhttps://patchthecve.com/cve/CVE-2021-39193.htmlWed, 17 Jun 2026 04:03:17 +0000MEDIUM 5.3: Frontier is Substrate's Ethereum compatibility layer. Prior to commit number 0b962f218f0cdd796dadfe26c3f09e68f7861b26, a bug in `pallet-ethereum` can cause invalid transactions to be included in the Ethereum block state in `pallet-ethereum` due to not validating the input data size. Any invalid tranhttps://patchthecve.com/cve/CVE-2021-38195.htmlhttps://patchthecve.com/cve/CVE-2021-38195.htmlWed, 17 Jun 2026 04:01:44 +0000CRITICAL 9.8: An issue was discovered in the libsecp256k1 crate before 0.5.0 for Rust. It can verify an invalid signature because it allows the R or S parameter to be larger than the curve order, aka an overflow.https://patchthecve.com/cve/CVE-2019-25003.htmlhttps://patchthecve.com/cve/CVE-2019-25003.htmlWed, 17 Jun 2026 02:31:27 +0000HIGH 7.5: An issue was discovered in the libsecp256k1 crate before 0.3.1 for Rust. Scalar::check_overflow allows a timing side-channel attack; consequently, attackers can obtain sensitive information.https://patchthecve.com/cve/CVE-2019-20399.htmlhttps://patchthecve.com/cve/CVE-2019-20399.htmlWed, 17 Jun 2026 02:30:21 +0000MEDIUM 5.9: A timing vulnerability in the Scalar::check_overflow function in Parity libsecp256k1-rs before 0.3.1 potentially allows an attacker to leak information via a side-channel attack.https://patchthecve.com/cve/CVE-2017-14460.htmlhttps://patchthecve.com/cve/CVE-2017-14460.htmlWed, 17 Jun 2026 01:06:11 +0000HIGH 7.5: An exploitable overly permissive cross-domain (CORS) whitelist vulnerability exists in JSON-RPC of Parity Ethereum client version 1.7.8. An automatically sent JSON object to JSON-RPC endpoint can trigger this vulnerability. A victim needs to visit a malicious website to trigger this vulnerability.https://patchthecve.com/cve/CVE-2017-18016.htmlhttps://patchthecve.com/cve/CVE-2017-18016.htmlWed, 17 Jun 2026 01:12:02 +0000MEDIUM 5.3: Parity Browser 1.6.10 and earlier allows remote attackers to bypass the Same Origin Policy and obtain sensitive information by requesting other websites via the Parity web proxy engine (reusing the current website's token, which is not bound to an origin).