CVE-2022-51009 PocketMine-MP before 4.7.2 Denial of Service via Skin Geometry

PocketMine-MP before 4.7.2 fails to properly handle exceptions from the adhocore/json-comment library when parsing skin geometry data. Attackers can send login or skin packets with invalid geometry JSON to trigger an unhandled RuntimeException, causing server crash...

CVE-2026-86120

APITable through 1.13.0-beta.1 is affected by a fail-open authorization flaw in the NodePermissionGuard middleware of its Fusion API. When permission lookups throw exceptions, the guard fails to enforce node-level access control, allowing an attacker holding a valid Fusion API token to write atta...

EUVD-2026-70775

MOOS core-moos through 10.4.0 fails to validate that serialized string lengths are non-negative in CMOOSMsg::operator. Unauthenticated attackers can send a crafted message with a negative length value to the MOOSDB port, causing an unhandled exception that terminates the database process...

Astra Linux – Vulnerability in GIMP

A vulnerability in gimplayerinvalidateboundary of GNOME GIMP 2.10.30 allows attackers to trigger an unhandled exception through a crafted XCF file, resulting in a Denial of Service DoS attack...

Improper Check for Unusual or Exceptional Conditions

Overview Affected versions of this package are vulnerable to Improper Check for Unusual or Exceptional Conditions via the DeadLetterPublishingRecovererFactory. An attacker can cause repeated failures and stall partition consumption by attaching a malformed retrytopic-original-timestamp header suc...

CVE-2026-68901

In Wekan versions before 10.38, export endpoints in models/export.js and models/exportExcel.js called user._id.toString() without null-checking ReactiveCache.getUser(), throwing a TypeError on an invalid authToken and crashing the process via unhandled rejection. Fixed in 10.38 with a 401 guard a...

MINI-J86M-HVPX-HVW6

Bulletin has no description...

MINI-6R63-R9H7-9X5M

Bulletin has no description...

PT-2026-78324

Name of the Vulnerable Software and Affected Versions mod cluster affected versions not specified Description A flaw exists in the AdvertiseListenerImpl of the org.jboss.modcluster core module. An unauthenticated attacker can cause a denial of service by sending a single crafted UDP multicast...

MINI-XQ3C-MXR9-2HPF

Bulletin has no description...

MINI-44P3-8QVP-RGFQ

Bulletin has no description...

MINI-64FH-C6CW-R53W

Bulletin has no description...

MINI-73XC-4GFX-WQJ6

Bulletin has no description...

MINI-R9W4-76CQ-4VGF

Bulletin has no description...

MINI-F2RH-RPHP-35JH

Bulletin has no description...

EUVD-2026-59293

In the Linux kernel, the following vulnerability has been resolved: hwmon: aspeed-g6-pwm-tach Guard fan RPM calculation against divide-by-zero Sashiko reports: In the aspeed-g6-pwm-tacho driver, the aspeedtachvaltorpm function calculates the fan RPM using the tachometer value. However, it does no...

MINI-2HVJ-VX7F-Q8CQ

Bulletin has no description...

MINI-HVHG-5WJ7-93H6

Bulletin has no description...

CVE-2026-45819

baseline-browser-mapping 2.x before 2.11.0 calls process.exit instead of throwing on invalid or conflicting input parameters, and can trigger immediate process termination, causing denial of service...

CVE-2026-73418

NextAuth.js provides authentication for Next.js. Prior to @auth/core 0.41.3 and next-auth 4.24.15 and 5.0.0-beta.32, the exported getToken helper in the next-auth/jwt and @auth/core/jwt modules can throw an uncaught exception when it reads a malformed Authorization: Bearer header. When no session...