CVE-2026-76560

creationtimestamp| type| source ---|---|--- 2026-09-07 13:55:36+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/jcerdibv6ffze...

CVE-2022-51013

PocketMine-MP versions before 4.2.3 fail to validate damage metadata values in tool and armor item NBT data received from clients. Attackers can send negative or out-of-range damage values in itemstack NBT to trigger unhandled exceptions in the Durable class, causing server crashes...

CVE-2022-51013 PocketMine-MP before 4.2.3 Denial of Service via NBT Metadata

PocketMine-MP versions before 4.2.3 fail to validate damage metadata values in tool and armor item NBT data received from clients. Attackers can send negative or out-of-range damage values in itemstack NBT to trigger unhandled exceptions in the Durable class, causing server crashes...

CVE-2022-51013

PocketMine-MP versions before 4.2.3 fail to validate damage metadata values in tool and armor item NBT data received from clients. An authenticated remote attacker can send negative or out-of-range damage values in itemstack NBT data, triggering unhandled exceptions in the Durable class and causi...

CVE-2022-51013 PocketMine-MP before 4.2.3 Denial of Service via NBT Metadata

PocketMine-MP versions before 4.2.3 fail to validate damage metadata values in tool and armor item NBT data received from clients. Attackers can send negative or out-of-range damage values in itemstack NBT to trigger unhandled exceptions in the Durable class, causing server crashes...

CVE-2022-51013 PocketMine-MP before 4.2.3 Denial of Service via NBT Metadata

PocketMine-MP versions before 4.2.3 fail to validate damage metadata values in tool and armor item NBT data received from clients. Attackers can send negative or out-of-range damage values in itemstack NBT to trigger unhandled exceptions in the Durable class, causing server crashes...

CVE-2026-86418

MISP (≤2.5.45) exposes organisation metadata (ID, UUID, name) through the dashboard organisation picker endpoint without applying the same visibility restrictions enforced by the normal organisation index. When Security.hide_organisation_index_from_users was enabled, normal enumeration was restri...

EUVD-2026-72362

Affected versions of MISP expose organisation metadata through the dashboard organisation picker without applying the same visibility restrictions enforced by the normal organisation index and per-organisation view. The affected endpoint returned fields including: organisation ID; UUID; name. Whe...

CVE-2026-86418 MISP Dashboard Organisation Picker Exposes Hidden Organisation Metadata to Unauthorized Users

Affected versions of MISP expose organisation metadata through the dashboard organisation picker without applying the same visibility restrictions enforced by the normal organisation index and per-organisation view. The affected endpoint returned fields including: - organisation ID; - UUID;...

CVE-2026-86418 MISP Dashboard Organisation Picker Exposes Hidden Organisation Metadata to Unauthorized Users

Affected versions of MISP expose organisation metadata through the dashboard organisation picker without applying the same visibility restrictions enforced by the normal organisation index and per-organisation view. The affected endpoint returned fields including: - organisation ID; - UUID;...

EUVD-2026-72319

Affected versions of MISP contain improper authorization checks in the freetext feed preview functionality. The preview performed correlation lookups against attributes from events without applying the requesting user's ACL, allowing restricted event correlations and associated event information ...

CVE-2026-86342 MISP Freetext Feed Preview Improper Authorization Exposes Restricted Event and Feed Information

Affected versions of MISP contain improper authorization checks in the freetext feed preview functionality. The preview performed correlation lookups against attributes from events without applying the requesting user's ACL, allowing restricted event correlations and associated event information ...

WordPress JetFormBuilder — Dynamic Blocks Form Builder plugin < 3.6.5.2 - Unauthenticated Password Hash and Arbitrary Metadata Disclosure vulnerability

Unauthenticated Password Hash and Arbitrary Metadata Disclosure vulnerability discovered by Jakub Herman in WordPress Plugin JetFormBuilder versions 3.6.5.2...

CVE-2026-82755: Use of Cache Containing Sensitive Information

Use of Cache Containing Sensitive Information vulnerability in ash-project ashauthenticationoauth2server allows a shared HTTP cache to serve one tenant's OAuth discovery metadata to another tenant's clients. The RFC 8414 and RFC 9728 metadata endpoints in...

PT-2026-86877

In JetBrains IntelliJ IDEA before 2026.2.2 missing project-trust check leaked project metadata to JetBrains Marketplace...

CVE-2026-82757: Server-Side Request Forgery (SSRF)

Server-Side Request Forgery SSRF vulnerability in ash-project ashauthenticationoauth2server allows an attacker who controls a client metadata URL and its DNS to make the server connect to internal or loopback addresses. publicip?/1 in AshAuthentication.Oauth2Server.CIMD.ReqFetcher enforces the...

PT-2026-86925

Use of Cache Containing Sensitive Information vulnerability in ash-project ash authentication oauth2 server allows a shared HTTP cache to serve one tenant's OAuth discovery metadata to another tenant's clients. The RFC 8414 and RFC 9728 metadata endpoints in...

CVE-2026-82753: Allocation of Resources Without Limits or Throttling

Allocation of Resources Without Limits or Throttling vulnerability in ash-project ashauthenticationoauth2server allows an unauthenticated attacker to exhaust database storage and memory. The /authorize endpoint is unauthenticated by design. With Client ID Metadata Documents enabled, resolveclient...

VulnCheck KEV: CVE-2026-60105

Monsta FTP before 2.14.5 contains a server-side request forgery vulnerability in the fetchRemoteFile action caused by an incomplete IP blocklist check in the isBlockedIP function, which fails to detect embedded IPv4 addresses within IPv4-mapped IPv6 addresses. An unauthenticated attacker can obta...

Linux Distros Unpatched Vulnerability : CVE-2026-80881

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ocfs2: fix buffer head management in ocfs2readblocks In ocfs2readblocks, caller should't assume that buffer head returned by 'sbgetblk' is exclusively owned and...