CPE
Electrum versions prior to 4.8.3 fail to verify signatures of wallet-owned inputs in unconfirmed transactions, allowing malicious servers to trick users into signing fraudulent fee-replacement transactions.