rotki CVE debriefs

These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.

HIGH rotki CVE published 2026-10-25

CVE-2026-116071

CVE-2026-116071 is a high-severity vulnerability in rotki, a cryptocurrency portfolio tracking application, affecting versions before 1.44.2. The vulnerability stems from a weak key derivation mechanism used for encrypting premium cloud backups. Specifically, the premium sync key is generated as a single unsalted SHA-256 hash of the user's password. This weakness allows attackers who obtain an uploaded ba [truncated]