{"id":"CVE-2026-35679","url":"https://www.cyber-defence.io/tools/cve/CVE-2026-35679","generatedAt":"2026-10-28T04:11:09.476Z","title":"Zcash zcashd before 6.12.0 allows invalid transactions to be accepted under certain conditions, which potentially could have resulted in the draining of user funds from the Sprout pool.","description":"Zcash zcashd before 6.12.0 allows invalid transactions to be accepted under certain conditions, which potentially could have resulted in the draining of user funds from the Sprout pool. It was sometimes not verifying Sprout proofs.","published":"2026-04-05T22:16:01.000Z","lastModified":"2026-07-24T21:10:00.000Z","status":"Deferred","sourceIdentifier":"cve@mitre.org","cvss":{"version":"3.1","score":3.5,"severity":"LOW","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:L/A:N"},"cwe":["CWE-358"],"affected":[],"epss":{"score":0.0022,"percentile":0.12488,"date":"2026-10-27","history":[]},"kev":{"listed":false},"exploits":{"count":0,"verified":false,"firstPublished":null,"source":"Exploit-DB (https://gitlab.com/exploit-database/exploitdb)","entries":[]},"verdict":{"level":"low","text":"Lower severity and a low EPSS score (0.22%). Track it; it rarely justifies an emergency change on its own."},"changes":[],"references":[{"url":"https://github.com/zcash/zcash/commit/db969c63f48f0f9fc518112ed0b7ace1af78b9d0","source":"cve@mitre.org"},{"url":"https://github.com/zcash/zcash/releases/tag/v6.12.0","source":"cve@mitre.org"}],"sources":{"nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-35679","epss":"https://www.first.org/epss/","kev":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","exploitdb":"https://www.exploit-db.com/"},"licence":"CC BY 4.0 — link back to the CVE Explorer if you publish the results; upstream data remains subject to its own terms."}