8713 matches found
EUVD-2022-56036
PocketMine-MP before 4.7.2 fails to properly handle exceptions from the adhocore/json-comment library when parsing skin geometry data. Attackers can send login or skin packets with invalid geometry JSON to trigger an unhandled RuntimeException, causing server crash...
CVE-2022-51009 PocketMine-MP before 4.7.2 Denial of Service via Skin Geometry
PocketMine-MP before 4.7.2 fails to properly handle exceptions from the adhocore/json-comment library when parsing skin geometry data. Attackers can send login or skin packets with invalid geometry JSON to trigger an unhandled RuntimeException, causing server crash...
OSV-2026-1239 Security exception in org.apache.lucene.util.ArrayUtil.copyOfSubArray
OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=557292360 Crash type: Security exception Crash state: org.apache.lucene.util.ArrayUtil.copyOfSubArray org.apache.lucene.util.BytesRef.deepCopyOf org.apache.lucene.index.Term...
PT-2026-86517
PocketMine-MP before 4.7.2 fails to properly handle exceptions from the adhocore/json-comment library when parsing skin geometry data. Attackers can send login or skin packets with invalid geometry JSON to trigger an unhandled RuntimeException, causing server crash...
CVE-2026-86120
APITable through 1.13.0-beta.1 contains an incorrect authorization vulnerability in NodePermissionGuard that fails to enforce node-level access control when permission lookups throw exceptions. Attackers with valid Fusion API tokens can write attachments to private datasheets they have been...
CVE-2026-86120 APITable through 1.13.0-beta.1 Fail-Open Authorization in the Fusion API Node Permission Guard
APITable through 1.13.0-beta.1 contains an incorrect authorization vulnerability in NodePermissionGuard that fails to enforce node-level access control when permission lookups throw exceptions. Attackers with valid Fusion API tokens can write attachments to private datasheets they have been...
CVE-2026-86120 APITable through 1.13.0-beta.1 Fail-Open Authorization in the Fusion API Node Permission Guard
APITable through 1.13.0-beta.1 contains an incorrect authorization vulnerability in NodePermissionGuard that fails to enforce node-level access control when permission lookups throw exceptions. Attackers with valid Fusion API tokens can write attachments to private datasheets they have been...
EUVD-2026-71952
APITable through 1.13.0-beta.1 contains an incorrect authorization vulnerability in NodePermissionGuard that fails to enforce node-level access control when permission lookups throw exceptions. Attackers with valid Fusion API tokens can write attachments to private datasheets they have been...
CVE-2026-86120
APITable through 1.13.0-beta.1 is affected by a fail-open authorization flaw in the NodePermissionGuard middleware of its Fusion API. When permission lookups throw exceptions, the guard fails to enforce node-level access control, allowing an attacker holding a valid Fusion API token to write atta...
SUSE CVE-2026-80873
In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: nv: Write ESREL2 for injected nested SError exceptions kvminjectel2exception writes ESREL2 for synchronous exceptions but not for SError. enterexception64 does not write ESRELx for any exception type, so the construct...
PT-2026-86391
APITable through 1.13.0-beta.1 contains an incorrect authorization vulnerability in NodePermissionGuard that fails to enforce node-level access control when permission lookups throw exceptions. Attackers with valid Fusion API tokens can write attachments to private datasheets they have been...
lucene:QueryParserFuzzer: Security exception in org.apache.lucene.util.ArrayUtil.copyOfSubArray
Detailed Report: https://oss-fuzz.com/testcase?key=6593902333984768 Project: lucene Fuzzing Engine: libFuzzer Fuzz Target: QueryParserFuzzer Job Type: libfuzzerasanlucene Platform Id: linux Crash Type: Security exception Crash Address: Crash State: org.apache.lucene.util.ArrayUtil.copyOfSubArray...
Uncaught Exception
Overview undici is an An HTTP/1.1 client, written from scratch for Node.js Affected versions of this package are vulnerable to Uncaught Exception in lib/web/websocket/permessage-deflate.js, whose cleanup calls removeAllListeners on the zlib InflateRaw object, removing the error listener while the...
Uncaught Exception
Overview org.webjars.npm:undici is an An HTTP/1.1 client, written from scratch for Node.js Affected versions of this package are vulnerable to Uncaught Exception in the WebSocketStream API, whose socket-close handler calls abort on the writable stream while the application holds a writer lock and...
Uncaught Exception
Overview undici is an An HTTP/1.1 client, written from scratch for Node.js Affected versions of this package are vulnerable to Uncaught Exception in the WebSocketStream API, whose socket-close handler calls abort on the writable stream while the application holds a writer lock and then discards t...
Uncaught Exception
Overview undici is an An HTTP/1.1 client, written from scratch for Node.js Affected versions of this package are vulnerable to Uncaught Exception in its WebSocket client, in the form of a TypeError inside a queueMicrotask callback when a server's 101 response carries a Sec-WebSocket-Protocol head...
Uncaught Exception
Overview org.webjars.npm:undici is an An HTTP/1.1 client, written from scratch for Node.js Affected versions of this package are vulnerable to Uncaught Exception in its WebSocket client, in the form of a TypeError inside a queueMicrotask callback when a server's 101 response carries a...
EUVD-2026-71503
In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: nv: Write ESREL2 for injected nested SError exceptions kvminjectel2exception writes ESREL2 for synchronous exceptions but not for SError. enterexception64 does not write ESRELx for any exception type, so the construct...
CVE-2026-80873 KVM: arm64: nv: Write ESR_EL2 for injected nested SError exceptions
In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: nv: Write ESREL2 for injected nested SError exceptions kvminjectel2exception writes ESREL2 for synchronous exceptions but not for SError. enterexception64 does not write ESRELx for any exception type, so the construct...
CVE-2026-80873
In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: nv: Write ESREL2 for injected nested SError exceptions kvminjectel2exception writes ESREL2 for synchronous exceptions but not for SError. enterexception64 does not write ESRELx for any exception type, so the construct...