EUVD-2026-75363

A heap-based buffer overflow vulnerability in the PC bridge protocol decoder of BoschSensortec COINESSDK versions 2.10 through 2.12.2 allows attackers to cause a denial of service process crash or potentially execute arbitrary code. The bridge decoder bridgedecoder.c trusts the packet length fiel...

PT-2026-89653

Name of the Vulnerable Software and Affected Versions Deco BE11000 affected versions not specified Deco M9 Plus affected versions not specified Description An OS command injection issue exists in the TDDP module. This allows an attacker on an adjacent network to execute arbitrary commands with ro...

CVE-2026-45762: Access of Resource Using Incompatible Type

Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to versions 7.0.16 and 8.0.5, Suricata's IP defragmentation tracker lookup did not verify that an existing tracker used the same IP address family as the packet being...

Palo Alto Networks PAN-OS 10.2.x / 11.0.x / 11.1.x Vulnerability

The version of Palo Alto Networks PAN-OS running on the remote host is a vulnerable version of 10.2.x, 11.0.x, or 11.1.x. It is, therefore, affected by a vulnerability. A memory corruption vulnerability in Palo Alto Networks PAN-OS software allows an unauthenticated attacker to crash PAN-OS due t...

CVE-2026-86198

PocketMine-MP versions before 5.44.2 fail to properly validate multiple ResourcePackClientResponsePacket packets with STATUSCOMPLETED status during resource pack handling. Malicious clients can send batches of these packets to repeatedly trigger pre-spawn progression, creating duplicate Player...

CVE-2025-71418

PocketMine-MP versions before 5.25.2 fail to limit the explode function in packet parsing, allowing malicious clients to waste server resources. Attackers can send crafted packets with excessive delimiters to consume CPU and memory through sign editing, JWT parsing, and command parsing endpoints...

CVE-2026-86203 PocketMine-MP before 5.39.2 Item Duplication via Despawn State

PocketMine-MP versions before 5.39.2 fail to validate entity despawn state when processing attack packets from clients. Attackers can exploit a race condition by attacking a disconnecting player to trigger multiple death handlers, causing inventory items and experience to drop multiple times for...

CVE-2026-86202 PocketMine-MP before 5.39.2 Network Amplification via ActorEventPacket

PocketMine-MP versions before 5.39.2 contain a network amplification vulnerability in ActorEventPacket handling that allows clients to trigger consuming animations for all visible players. Attackers can send crafted ActorEventPacket messages to spam animation events to other clients and waste...

EUVD-2025-210881

PocketMine-MP versions before 5.25.2 fail to limit the explode function in packet parsing, allowing malicious clients to waste server resources. Attackers can send crafted packets with excessive delimiters to consume CPU and memory through sign editing, JWT parsing, and command parsing endpoints...

CVE-2025-71418

PocketMine-MP versions before 5.25.2 are vulnerable to a denial of service caused by an unbounded explode() function during packet parsing. A remote, unauthenticated attacker can send crafted packets containing excessive delimiters to exhaust CPU and memory resources. The affected parsing endpoin...

CVE-2025-71418 PocketMine-MP before 5.25.2 Denial of Service via explode

PocketMine-MP versions before 5.25.2 fail to limit the explode function in packet parsing, allowing malicious clients to waste server resources. Attackers can send crafted packets with excessive delimiters to consume CPU and memory through sign editing, JWT parsing, and command parsing endpoints...

CVE-2025-71418 PocketMine-MP before 5.25.2 Denial of Service via explode

PocketMine-MP versions before 5.25.2 fail to limit the explode function in packet parsing, allowing malicious clients to waste server resources. Attackers can send crafted packets with excessive delimiters to consume CPU and memory through sign editing, JWT parsing, and command parsing endpoints...

CVE-2025-71418 PocketMine-MP before 5.25.2 Denial of Service via explode

PocketMine-MP versions before 5.25.2 fail to limit the explode function in packet parsing, allowing malicious clients to waste server resources. Attackers can send crafted packets with excessive delimiters to consume CPU and memory through sign editing, JWT parsing, and command parsing endpoints...

EUVD-2025-210880

PocketMine-MP before 5.32.1 fails to validate uniqueness of pack UUIDs in ResourcePackClientResponsePacket STATUSSENDPACKS handling, allowing authenticated clients to trigger duplicate pack transmissions. Attackers can send multiple copies of valid pack UUIDs in a single packet to exhaust server...

Security Advisory 0174

Security Advisory 0174 . CSAF PDF Date: September 9, 2026 Revision | Date | Changes ---|---|--- 1.0 | September 9, 2026 | Initial release 1.1 | September 22, 2026 | CSAF JSON file added The CVE-ID tracking this issue: CVE-2026-73453 CVSSv3.1 Base Score: 10.0...

Security Advisory 0173

Security Advisory 0173 . CSAF PDF Date: September 9, 2026 Revision | Date | Changes ---|---|--- 1.0 | September 9, 2026 | Initial release 1.1 | September 22, 2026 | CSAF JSON file added The CVE-ID tracking this issue: CVE-2026-73455 CVSSv3.1 Base Score: 7.5...

PT-2026-89001

PocketMine-MP versions before 5.44.2 fail to properly validate multiple ResourcePackClientResponsePacket packets with STATUS COMPLETED status during resource pack handling. Malicious clients can send batches of these packets to repeatedly trigger pre-spawn progression, creating duplicate Player...

CVE-2025-71418: Uncontrolled Resource Consumption

PocketMine-MP versions before 5.25.2 fail to limit the explode function in packet parsing, allowing malicious clients to waste server resources. Attackers can send crafted packets with excessive delimiters to consume CPU and memory through sign editing, JWT parsing, and command parsing endpoints...

Security Advisory 0154

Security Advisory 0154 . CSAF PDF Date: September 9, 2026 Revision | Date | Changes ---|---|--- 1.0 | September 9, 2026 | Initial release 1.1 | September 22, 2026 | CSAF JSON file added The CVE-ID tracking this issue: CVE-2026-73458 CVSSv3.1 Base Score: 8.2...

PT-2026-88992

PocketMine-MP versions before 5.25.2 fail to limit the explode function in packet parsing, allowing malicious clients to waste server resources. Attackers can send crafted packets with excessive delimiters to consume CPU and memory through sign editing, JWT parsing, and command parsing endpoints...