InfoSecBulletin Cybersecurity for mankind
OWASP has released the Smart Contract Top 10: 2026, a guide to help Web3 developers, security auditors, and protocol owners identify critical vulnerabilities in smart contracts.
This edition, part of the OWASP Smart Contract Security initiative, uses security incidents and survey data from 2025 to identify the most impactful risks ahead.
After BDJobs, Directorate of Secondary and Higher Education 390k data surfaced online
By infosecbulletin
/ Monday , August 24 2026
A group of hackers named “Madarax” claims they have stolen and are offering to sell the personal information of about...
Read More
Researchers show new technique to bypass AI safety guardrails in Grok and Gemini
By infosecbulletin
/ Monday , August 24 2026
A new hacking technique has been demonstrated to steal data from Elon Musk's Grok AI. It uses a simple trick...
Read More
About thousands of leaked AWS keys Held Full Admin Rights
By infosecbulletin
/ Sunday , August 23 2026
More than 9,300 AWS access keys that were made public from August 2022 to August 2026 are still active, says...
Read More
US Bank investigates LockBit’s Data Breach Claims
By infosecbulletin
/ Sunday , August 23 2026
US Bank is looking into LockBit's claims about a breach and stolen data. The ransomware group says they will share...
Read More
Five new malware families actively targeting Asian Gov.t infra
By infosecbulletin
/ Friday , August 21 2026
Central Asian government agencies have been attacked in a cyber spy operation that used a small but different range of...
Read More
T-Mobile Cuts Cables to Remove Chiness Salt Typhoon Hackers from Network
By infosecbulletin
/ Friday , August 21 2026
T-Mobile’s cybersecurity team reportedly physically cut a network cable connecting compromised infrastructure to the outside world. According to Bloomberg, the move...
Read More
Splunk, Zyxel Patch Multiple Flaws Enabling RCE and Root Command Execution
By infosecbulletin
/ Friday , August 21 2026
Splunk has issued security fixes for 17 weaknesses in different apps and add-ons, such as Splunk MCP Server, Splunk AI...
Read More
“Zombie Card” attack revels expired Visa card may be used for contactless payments
By infosecbulletin
/ Friday , August 21 2026
Security experts have shown that expired credit cards can still be used. A study from the University of Massachusetts Amherst,...
Read More
Critical Zimbra RCE Flaw Actively Exploited in the Wild
By infosecbulletin
/ Thursday , August 20 2026
CERT Polska has alerted that bad actors are actively exploiting a security flaw in Zimbra Collaboration Suite to execute code...
Read More
Operation CameraSwarm
A single hacker compromise 1400+ Dahua camera worldwide
By infosecbulletin
/ Thursday , August 20 2026
Operation CameraSwarm compromised 14,500+ Dahua IP cameras mostly in Ukraine and Russia. The operation lasted for at least 35 days...
Read More
The 2026 ranking shows that attackers are evolving. They are now combining different vulnerabilities, such as linking flash loans with oracle manipulation and exploiting poor upgrade governance, to cause more financial harm.
2026 Ranking
| Rank | Vulnerability | Description |
|---|---|---|
| SC01:2026 | Access Control Vulnerabilities | Flaws that allow unauthorized users or roles to invoke privileged functions or modify critical state, often leading to full protocol compromise. |
| SC02:2026 | Business Logic Vulnerabilities | Design-level flaws in lending, AMM, reward, or governance logic that break economic or functional rules, enabling value extraction even when low-level checks appear correct. |
| SC03:2026 | Price Oracle Manipulation | Weak oracles and unsafe price integrations that let attackers skew reference prices, enabling under-collateralized borrowing and mispriced swaps. |
| SC04:2026 | Flash Loan–Facilitated Attacks | Attacks using large, uncollateralized flash loans to amplify small logic, pricing, or arithmetic bugs into large drains within a single transaction. |
| SC05:2026 | Lack of Input Validation | Missing or weak validation of user, admin, or cross-chain inputs that allows unsafe parameters to reach core logic, corrupting state or enabling fund loss. |
| SC06:2026 | Unchecked External Calls | Unsafe interactions with external contracts where failures, reverts, or callbacks are not safely handled, often enabling reentrancy or inconsistent state. |
| SC07:2026 | Arithmetic Errors | Subtle bugs in integer math, scaling, and rounding — especially in share, interest, and AMM calculations — that can siphon value when paired with flash loans. |
| SC08:2026 | Reentrancy Attacks | External calls that re-enter vulnerable functions before state is fully updated, allowing repeated withdrawals or state changes from outdated contract views. |
| SC09:2026 | Integer Overflow and Underflow | Dangerous arithmetic on code paths without robust overflow checks, leading to wrapped values, broken invariants, and potential liquidity drains. |
| SC10:2026 | Proxy & Upgradeability Vulnerabilities | Misconfigured or weakly governed proxy, initialization, and upgrade mechanisms that let attackers seize control of implementations or reinitialize critical state. |
Over $2.2 billion has been lost to crypto hacks recently, highlighting the need for a structured vulnerability framework in the blockchain ecosystem.
The OWASP Smart Contract Top 10: 2026 is designed to work with other OWASP resources like the SC Weakness Enumeration, Checklist, and Top 15 Web3 Attack Vectors to create a full framework for secure smart contract development, auditing, and compliance.
