CVE-2022-51015

PocketMine-MP before 4.0.6 does not validate facing values in PlayerActionPacket for STARTBREAK and CRACKBREAK actions or in UseItemTransactionData typically within InventoryTransactionPacket. A remote authenticated attacker can send crafted packets with invalid facing values e.g., negative or...

CVE-2021-48007

PocketMine-MP versions before 3.18.1 fail to validate NaN or INF values in MovePlayerPacket position and rotation fields. Malicious clients can send crafted movement packets with invalid floating-point values to crash servers through unhandled mathematical operations or prevent clients from...

CVE-2020-37277

PocketMine-MP versions before 3.15.4 contain a denial of service vulnerability in the InventoryTransaction component's findResultItem method. Malicious clients can send specially crafted InventoryTransactionPackets with multiple conflicting pathways to cause exponential processing complexity,...

CVE-2021-48007 PocketMine-MP before 3.18.1 Denial of Service via MovePlayerPacket

PocketMine-MP versions before 3.18.1 fail to validate NaN or INF values in MovePlayerPacket position and rotation fields. Malicious clients can send crafted movement packets with invalid floating-point values to crash servers through unhandled mathematical operations or prevent clients from...

CVE-2021-48007 PocketMine-MP before 3.18.1 Denial of Service via MovePlayerPacket

PocketMine-MP versions before 3.18.1 fail to validate NaN or INF values in MovePlayerPacket position and rotation fields. Malicious clients can send crafted movement packets with invalid floating-point values to crash servers through unhandled mathematical operations or prevent clients from...

EUVD-2020-31270

PocketMine-MP versions before 3.15.4 contain a denial of service vulnerability in the InventoryTransaction component's findResultItem method. Malicious clients can send specially crafted InventoryTransactionPackets with multiple conflicting pathways to cause exponential processing complexity,...

CVE-2020-37277 PocketMine-MP before 3.15.4 Denial of Service via InventoryTransaction

PocketMine-MP versions before 3.15.4 contain a denial of service vulnerability in the InventoryTransaction component's findResultItem method. Malicious clients can send specially crafted InventoryTransactionPackets with multiple conflicting pathways to cause exponential processing complexity,...

PT-2026-86515

PocketMine-MP versions before 3.18.1 fail to validate NaN or INF values in MovePlayerPacket position and rotation fields. Malicious clients can send crafted movement packets with invalid floating-point values to crash servers through unhandled mathematical operations or prevent clients from...

PT-2026-86513

PocketMine-MP versions before 3.15.4 contain a denial of service vulnerability in the InventoryTransaction component's findResultItem method. Malicious clients can send specially crafted InventoryTransactionPackets with multiple conflicting pathways to cause exponential processing complexity,...

AZL-99945 CVE-2026-86098 affecting package ntopng 5.2.1-6

ntop nDPI versions before 6.0 contain a heap buffer overflow vulnerability in the ndpijsonstringescape function that writes beyond caller-supplied buffer boundaries. Attackers can trigger the overflow by supplying crafted network packet data including TLS SNI, HTTP headers, or DNS names that reac...

CVE-2026-86098

ntop nDPI versions before 6.0 contain a heap buffer overflow in the ndpi_json_string_escape function, which writes beyond caller-supplied buffer boundaries. An attacker can trigger the overflow by supplying crafted network packet data — including TLS SNI , HTTP headers , or DNS names — that reach...

CVE-2026-86098 ntop nDPI before 6.0 Heap Buffer Overflow via ndpi_json_string_escape

ntop nDPI versions before 6.0 contain a heap buffer overflow vulnerability in the ndpijsonstringescape function that writes beyond caller-supplied buffer boundaries. Attackers can trigger the overflow by supplying crafted network packet data including TLS SNI, HTTP headers, or DNS names that reac...

PT-2026-86268

Name of the Vulnerable Software and Affected Versions ntop nDPI versions prior to 6.0 Description An out-of-bounds heap write exists in the ndpi json string escape function. This occurs because the function lacks an enforceable maximum length for the destination buffer when escaping characters fo...

CVE-2026-73774

A buffer overflow vulnerability exists in the underlying operating system of AOS-CX that could lead to unauthenticated disclosure of sensitive information by sending specially crafted packets to the affected system. Successful exploitation of this vulnerability could result in limited disclosure ...

CVE-2026-73772

Buffer overflow vulnerabilities exist in an underlying service of AOS-CX that could lead to an unauthenticated denial-of-service condition by sending specially crafted packets to the affected device. Successful exploitation of these vulnerabilities results in a disruption of normal operation of t...

CVE-2026-73759

Vulnerabilities in AOS-CX could allow an unauthenticated remote malicious actor to trigger a denial-of-service condition by sending specially crafted packets. Successful exploitation of these vulnerabilities results in disruption of normal operation on affected devices...

CVE-2026-73749

Multiple vulnerabilities exist in a daemon of AOS-CX that may allow for improper processing of malformed input. An unauthenticated remote attacker could exploit these vulnerabilities by sending specially crafted packets to the affected service. Successful exploitation could result in remote code...

CVE-2026-73774

A buffer overflow vulnerability in the underlying operating system of AOS-CX allows an unauthenticated attacker on an adjacent network to send specially crafted packets, resulting in limited disclosure or modification of sensitive information and potential disruption of the affected system. The v...

CVE-2026-73774 Unauthenticated Buffer Overflow Vulnerability leads to Sensitive Information Disclosure in AOS-CX

A buffer overflow vulnerability exists in the underlying operating system of AOS-CX that could lead to unauthenticated disclosure of sensitive information by sending specially crafted packets to the affected system. Successful exploitation of this vulnerability could result in limited disclosure ...

EUVD-2026-69637

A buffer overflow vulnerability exists in the underlying operating system of AOS-CX that could lead to unauthenticated disclosure of sensitive information by sending specially crafted packets to the affected system. Successful exploitation of this vulnerability could result in limited disclosure ...