Skip to content

Vendor

hashgraph vulnerabilities

3 published CVES affecting hashgraph, from public sources (CVE.org, NVD, CISA KEV, FIRST EPSS, OSV).

Total
3
Critical
0
High
1
Medium
2
Low
0
Unscored
0
CISA KEV
0
Atom feed of hashgraph alerts

Products

Latest hashgraph CVEs

Newest publication first

  1. CVE-2026-22674 Hashgraph Guardian Stored XSS via branding companyName field

    Published
    MediumCVSS 4.8

    Hashgraph Guardian through 3.6.0, fixed in commit ba8c566, contains a stored cross-site scripting vulnerability that allows authenticated users with the STANDARD_REGISTRY role to inject malicious scripts by submitting a crafted companyName value via the branding configuration API...

  2. CVE-2026-45248 Hedera Guardian Authentication Bypass Information Disclosure

    Published
    MediumCVSS 6.9

    Hedera Guardian through 3.5.1 contains an authentication bypass vulnerability in the GET /api/v1/demo/registered-users endpoint that allows unauthenticated attackers to retrieve sensitive user information. Attackers can access the endpoint without providing authentication credent...

  3. CVE-2026-39911 Hashgraph Guardian 3.5.1 Unsandboxed JavaScript Execution RCE

    Published
    HighCVSS 8.7

    Hashgraph Guardian through version 3.5.1, fixed in commit 45fbe2f, contains an unsandboxed JavaScript execution vulnerability in the Custom Logic policy block worker that allows authenticated Standard Registry users to execute arbitrary code by passing user-supplied JavaScript ex...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.