{"advisories":[{"project":"Cake Wallet","title":"App PIN lock is not enforced after backgrounding while the in-app browser is open","severity":"low","published_at":"2026-11-04T10:15:55.000000Z","url":"https://github.com/cake-tech/cake_wallet/security/advisories/GHSA-329m-5v92-587r","summary":"## Summary The app lock fails open when the in-app browser is open. Backgrounding and reopening the app skips the PIN prompt entirely, exposing wallet transaction data to anyone holding an unlocked phone — even with \"Require PIN after\" set to Always. ### Details When the in-app browser is open, the app's PIN lock stops working across backgrounding. Normally, when you leave the app, it sets a flag meaning \"ask for the PIN next time.\" When you come back, the PIN screen appears. That works fine in normal use. But two things go wrong when the in-app browser is on top: The PIN screen only gets sche","source":"github"},{"project":"Cake Wallet","title":"Cake Wallet v6.5.2: release notes mention a security fix","severity":null,"published_at":"2026-10-31T01:08:11.000000Z","url":"https://github.com/cake-tech/cake_wallet/releases/tag/v6.5.2","summary":"The release notes for this version mention security. Read them and update if you run this software.","source":"release"},{"project":"RetoSwap (Haveno)","title":"RetoSwap (Haveno) v1.12.0-reto: release notes mention a security fix","severity":null,"published_at":"2026-10-29T15:58:32.000000Z","url":"https://github.com/retoaccess1/haveno-reto/releases/tag/v1.12.0-reto","summary":"The release notes for this version mention security. Read them and update if you run this software.","source":"release"},{"project":"BTCPay Server","title":"BTCPay Server v2.4.7: release notes mention a security fix","severity":null,"published_at":"2026-10-29T13:48:38.000000Z","url":"https://github.com/btcpayserver/btcpayserver/releases/tag/v2.4.7","summary":"The release notes for this version mention security. Read them and update if you run this software.","source":"release"},{"project":"Cake Wallet","title":"ERC-681 chain ID is dropped before send, allowing payment requests to execute on the wrong EVM network","severity":"medium","published_at":"2026-09-04T17:54:55.000000Z","url":"https://github.com/cake-tech/cake_wallet/security/advisories/GHSA-695v-fhpj-fv8x","summary":"Coordination note: I sent this same report to security@cakewallet.com on July 25, 2026. I am duplicating it here only through Cake Wallet's preferred private GitHub Security Advisory channel. Please treat the email and this advisory as one report from Swaplane, not as separate findings. Cake Wallet parses the @chain_id from an ERC-681 ethereum: payment request but drops it before the send flow. A user can therefore open a request explicitly targeting one EVM chain and, after normal confirmation, have the transaction prepared on the wallet's currently selected chain instead. This can cause a fa","source":"github"},{"project":"P2Pool","title":"Critical P2Pool security update","severity":"critical","published_at":"2026-06-13T15:00:41.000000Z","url":"https://github.com/SChernykh/p2pool/security/advisories/GHSA-fm6j-gf38-p925","summary":"## TL;DR A serious bug was found in P2Pool. **Please upgrade your P2Pool to the latest release and restart it as soon as possible.** - **Your Monero and your wallet keys are safe.** Nobody can steal your coins or your keys with this bug. - **Your future payouts can be affected in a negative way, down to nothing** if you keep running an old version while an attacker is active. - **Old and new versions can end up on two different side-chains** during an attack. Old versions can get \"stuck\" on the wrong one for a while. - **The fix is simple: upgrade.** Updated nodes are completely immune. --- ##","source":"github"}]}