Index
Search
Search the public record. Drafts and scheduled notes are not included.
defi
Unbacked mints: five 2026 incidents, one question the code forgot to ask
Liquid, NEAR Intents, Meter, Symbiosis and Payy failed in different ways this autumn. In each, the system created a claim on real money without checking that real money stood behind it. A look at the common pattern, drawn from the projects' own accounts, and the controls that would have limited it.
Published 3h ago
defi
Meter's Passport bridge minted about $2.3M of unbacked tokens, then the chain was paused
On 23 September 2026 an attacker minted unbacked wrapped MTRG through Meter Passport and sold part of it on PancakeSwap, crashing MTR and MTRG. Meter blamed a block validation flaw, paused its chain and bridge, and has not published a full post-mortem. It is the project's second bridge incident.
Published 3h ago
CVE-2026-104712
Disproportionate BigDecimal response expansion (DoS)
DoS
Published 5 Oct 2026
CVE-2026-12227
Visual Composer unauthenticated local file inclusion
Other
Published 24 Sept 2026
CVE-2026-96655
Plex Media Server transcoder path parameter allows requests to arbitrary addresses
SSRF
Published 23 Sept 2026