InfoSecBulletin Cybersecurity for mankind
OWASP has released the Smart Contract Top 10: 2026, a guide to help Web3 developers, security auditors, and protocol owners identify critical vulnerabilities in smart contracts.
This edition, part of the OWASP Smart Contract Security initiative, uses security incidents and survey data from 2025 to identify the most impactful risks ahead.
CVE-2026-18574
Check Point Authentication Bypass Hits Management Server
By infosecbulletin
/ Tuesday , August 4 2026
Check Point fixed a flaw that allowed bypassing authentication on its Security Management and Multi-Domain Security Management servers. This issue...
Read More
TP-Link RCE and SonicWall Zero-Click Flaws Enable Complete Device Compromise
By infosecbulletin
/ Tuesday , August 4 2026
TP-Link has shared a security warning about a serious problem with its TL-WR940N V6 wireless router. This problem, known as...
Read More
ExfilSquad releases info of over 100,000 UK police officers, staff
By infosecbulletin
/ Monday , August 3 2026
A cyberattack on the U.K.'s Police National Legal Database (PNLD) has put the contact information of over 100,000 police officers...
Read More
CISA alerts to cyberattacks affecting U.S. water utilities
By infosecbulletin
/ Saturday , August 1 2026
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) warns of a big rise in attacks on internet-connected programmable logic controllers...
Read More
“CyberStrike” AI-Driven Security Platform for Automated Testing
By infosecbulletin
/ Friday , July 31 2026
A new open-source project named CyberStrike aims to be the first AI tool made for offensive security. It can turn...
Read More
AIDCQ Propose to invest $2 billion in AI data center in Bangladesh
By infosecbulletin
/ Friday , July 31 2026
Many countries are now showing interest to invest in the data center industry in Banglades especially in AI data centers....
Read More
NVIDIA BlueField Flaw Enables Code Execution Attacks
By infosecbulletin
/ Thursday , July 30 2026
NVIDIA has revealed a big flaw with its BlueField DPUs and ConnectX networking systems. This issue could let attackers run...
Read More
Massive customer data from India’s Bank of Baroda surfaced online
By infosecbulletin
/ Wednesday , July 29 2026
India's leading state-owned lender Bank of Baroda acknowledged Monday a security incident after reports that approximately 1 terabyte of customer...
Read More
Active Exploits Hit Fortinet, Arista: AI Discovered Linux Kernel Zero-Day
By infosecbulletin
/ Tuesday , July 28 2026
CISA has put the Fortinet FortiOS vulnerability CVE-2025-68686 in its list of known exploited flaws after ongoing attacks. The flaw...
Read More
Sam Altman Claims AI “singularity” has arrived, Where Systems Improve by Themselves
By infosecbulletin
/ Tuesday , July 28 2026
OpenAI's CEO Sam Altman says that AI has reached a big milestone. The technology can now make itself better, leading...
Read More
The 2026 ranking shows that attackers are evolving. They are now combining different vulnerabilities, such as linking flash loans with oracle manipulation and exploiting poor upgrade governance, to cause more financial harm.
2026 Ranking
| Rank | Vulnerability | Description |
|---|---|---|
| SC01:2026 | Access Control Vulnerabilities | Flaws that allow unauthorized users or roles to invoke privileged functions or modify critical state, often leading to full protocol compromise. |
| SC02:2026 | Business Logic Vulnerabilities | Design-level flaws in lending, AMM, reward, or governance logic that break economic or functional rules, enabling value extraction even when low-level checks appear correct. |
| SC03:2026 | Price Oracle Manipulation | Weak oracles and unsafe price integrations that let attackers skew reference prices, enabling under-collateralized borrowing and mispriced swaps. |
| SC04:2026 | Flash Loan–Facilitated Attacks | Attacks using large, uncollateralized flash loans to amplify small logic, pricing, or arithmetic bugs into large drains within a single transaction. |
| SC05:2026 | Lack of Input Validation | Missing or weak validation of user, admin, or cross-chain inputs that allows unsafe parameters to reach core logic, corrupting state or enabling fund loss. |
| SC06:2026 | Unchecked External Calls | Unsafe interactions with external contracts where failures, reverts, or callbacks are not safely handled, often enabling reentrancy or inconsistent state. |
| SC07:2026 | Arithmetic Errors | Subtle bugs in integer math, scaling, and rounding — especially in share, interest, and AMM calculations — that can siphon value when paired with flash loans. |
| SC08:2026 | Reentrancy Attacks | External calls that re-enter vulnerable functions before state is fully updated, allowing repeated withdrawals or state changes from outdated contract views. |
| SC09:2026 | Integer Overflow and Underflow | Dangerous arithmetic on code paths without robust overflow checks, leading to wrapped values, broken invariants, and potential liquidity drains. |
| SC10:2026 | Proxy & Upgradeability Vulnerabilities | Misconfigured or weakly governed proxy, initialization, and upgrade mechanisms that let attackers seize control of implementations or reinitialize critical state. |
Over $2.2 billion has been lost to crypto hacks recently, highlighting the need for a structured vulnerability framework in the blockchain ecosystem.
The OWASP Smart Contract Top 10: 2026 is designed to work with other OWASP resources like the SC Weakness Enumeration, Checklist, and Top 15 Web3 Attack Vectors to create a full framework for secure smart contract development, auditing, and compliance.
