CVE-2026-86744

Snipe-IT 8.6.3 and earlier and develop pre-release commits prior to the fix contain a race condition in the asset checkout paths. Api\AssetsController::checkout and Assets\AssetCheckoutController::store call Asset::availableForCheckout outside the mutation path and then invoke Asset::checkOut...

CVE-2026-86198

PocketMine-MP versions before 5.44.2 fail to properly validate multiple ResourcePackClientResponsePacket packets with STATUSCOMPLETED status during resource pack handling. Malicious clients can send batches of these packets to repeatedly trigger pre-spawn progression, creating duplicate Player...

CVE-2026-86744 snipe-it before 8.7.0 Race Condition in Asset Checkout

Snipe-IT 8.6.3 and earlier and develop pre-release commits prior to the fix contain a race condition in the asset checkout paths. Api\AssetsController::checkout and Assets\AssetCheckoutController::store call Asset::availableForCheckout outside the mutation path and then invoke Asset::checkOut...

CVE-2026-86744 snipe-it before 8.7.0 Race Condition in Asset Checkout

Snipe-IT 8.6.3 and earlier and develop pre-release commits prior to the fix contain a race condition in the asset checkout paths. Api\AssetsController::checkout and Assets\AssetCheckoutController::store call Asset::availableForCheckout outside the mutation path and then invoke Asset::checkOut...

CVE-2026-86744 snipe-it before 8.7.0 Race Condition in Asset Checkout

Snipe-IT 8.6.3 and earlier and develop pre-release commits prior to the fix contain a race condition in the asset checkout paths. Api\AssetsController::checkout and Assets\AssetCheckoutController::store call Asset::availableForCheckout outside the mutation path and then invoke Asset::checkOut...

CVE-2026-86744

Snipe-IT (8.6.3 and earlier) is affected by a race condition in its asset checkout paths. The methods Api\AssetsController::checkout() and Assets\AssetCheckoutController::store() call Asset::availableForCheckout() outside the mutation path and then invoke Asset::checkOut() without a row lock or r...

CVE-2026-86198 PocketMine-MP before 5.44.2 Denial of Service via ResourcePackClientResponsePacket

PocketMine-MP versions before 5.44.2 fail to properly validate multiple ResourcePackClientResponsePacket packets with STATUSCOMPLETED status during resource pack handling. Malicious clients can send batches of these packets to repeatedly trigger pre-spawn progression, creating duplicate Player...

CVE-2026-86198 PocketMine-MP before 5.44.2 Denial of Service via ResourcePackClientResponsePacket

PocketMine-MP versions before 5.44.2 fail to properly validate multiple ResourcePackClientResponsePacket packets with STATUSCOMPLETED status during resource pack handling. Malicious clients can send batches of these packets to repeatedly trigger pre-spawn progression, creating duplicate Player...

EUVD-2026-74909

PocketMine-MP versions before 5.44.2 fail to properly validate multiple ResourcePackClientResponsePacket packets with STATUSCOMPLETED status during resource pack handling. Malicious clients can send batches of these packets to repeatedly trigger pre-spawn progression, creating duplicate Player...

CVE-2026-86198 PocketMine-MP before 5.44.2 Denial of Service via ResourcePackClientResponsePacket

PocketMine-MP versions before 5.44.2 fail to properly validate multiple ResourcePackClientResponsePacket packets with STATUSCOMPLETED status during resource pack handling. Malicious clients can send batches of these packets to repeatedly trigger pre-spawn progression, creating duplicate Player...

CVE-2026-86198

PocketMine-MP versions before 5.44.2 are vulnerable to a denial-of-service condition in the resource pack handling subsystem. The root cause is a failure to properly validate multiple ResourcePackClientResponsePacket packets carrying the STATUS_COMPLETED status, which allows malicious clients to ...

CVE-2025-71417

PocketMine-MP versions prior to 5.32.1 contain a denial-of-service vulnerability in the ResourcePackClientResponsePacket handling during the STATUS_SEND_PACKS phase. The server fails to validate uniqueness of pack UUIDs, allowing authenticated clients to send multiple copies of the same valid pac...

CVE-2025-71417 PocketMine-MP before 5.32.1 Denial of Service via ResourcePackClientResponsePacket

PocketMine-MP before 5.32.1 fails to validate uniqueness of pack UUIDs in ResourcePackClientResponsePacket STATUSSENDPACKS handling, allowing authenticated clients to trigger duplicate pack transmissions. Attackers can send multiple copies of valid pack UUIDs in a single packet to exhaust server...

CVE-2025-71417 PocketMine-MP before 5.32.1 Denial of Service via ResourcePackClientResponsePacket

PocketMine-MP before 5.32.1 fails to validate uniqueness of pack UUIDs in ResourcePackClientResponsePacket STATUSSENDPACKS handling, allowing authenticated clients to trigger duplicate pack transmissions. Attackers can send multiple copies of valid pack UUIDs in a single packet to exhaust server...

EUVD-2025-210880

PocketMine-MP before 5.32.1 fails to validate uniqueness of pack UUIDs in ResourcePackClientResponsePacket STATUSSENDPACKS handling, allowing authenticated clients to trigger duplicate pack transmissions. Attackers can send multiple copies of valid pack UUIDs in a single packet to exhaust server...

PT-2026-89001

PocketMine-MP versions before 5.44.2 fail to properly validate multiple ResourcePackClientResponsePacket packets with STATUS COMPLETED status during resource pack handling. Malicious clients can send batches of these packets to repeatedly trigger pre-spawn progression, creating duplicate Player...

PT-2026-88991

PocketMine-MP before 5.32.1 fails to validate uniqueness of pack UUIDs in ResourcePackClientResponsePacket STATUS SEND PACKS handling, allowing authenticated clients to trigger duplicate pack transmissions. Attackers can send multiple copies of valid pack UUIDs in a single packet to exhaust serve...

CVE-2026-86198: Improper Enforcement of a Single, Unique Action

PocketMine-MP versions before 5.44.2 fail to properly validate multiple ResourcePackClientResponsePacket packets with STATUSCOMPLETED status during resource pack handling. Malicious clients can send batches of these packets to repeatedly trigger pre-spawn progression, creating duplicate Player...

PT-2026-89013

Name of the Vulnerable Software and Affected Versions Snipe-IT versions prior to 8.7.0 Description A race condition exists in the asset checkout paths. The functions ApiAssetsController::checkout and AssetsAssetCheckoutController::store call Asset::availableForCheckout outside the mutation path a...

GHSA-8CW4-87C7-C6XX node-csv: Prototype replacement still reachable via columns path

Impact With columns: true and groupcolumnsbyname: true, a duplicated proto header causes the duplicate-column branch to assign an array to obj'proto', invoking the proto setter and replacing the parsed record object's prototype with attacker-controlled data. Fixed in 7.0.2 Object.hasOwn duplicate...