CVE-2024-41565

JustEnoughItems JEI 19.5.0.33 and before contains an Improper Validation of Specified Index, Position, or Offset in Input vulnerability. The specific issue is a failure to validate slot index in JEI for Minecraft, which allows in-game item duplication...

EUVD-2021-21699

Malware in sbrugna...

EUVD-2025-6370

Malicious code in bioql PyPI...

CVE-2024-42698

Roughly Enough Items REI v.16.0.729 and before contains an Improper Validation of Specified Index, Position, or Offset in Input vulnerability. The specific issue is a failure to validate slot index and decrement stack count in the Roughly Enough Items REI mod for Minecraft, which allows in-game...

CVE-2023-33245

Minecraft through 1.19 and 1.20 pre-releases before 7 Java allow arbitrary file overwrite, and possibly code execution, via crafted world data that contains a symlink...

CVE-2021-35054

Minecraft before 1.17.1, when online-mode=false is configured, allows path traversal for deletion of arbitrary JSON files...

CVE-2025-27107

Integrated Scripting is a tool for creating scripts for handling complex operations in Integrated Dynamics. Minecraft users who use Integrated Scripting prior to versions 1.21.1-1.0.17, 1.21.4-1.0.9-254, 1.20.1-1.0.13, and 1.19.2-1.0.10 may be vulnerable to arbitrary code execution. By using Java...

CVE-2025-27107 Integrated Scripting vulnerable to arbitrary code execution via Java reflection

Integrated Scripting is a tool for creating scripts for handling complex operations in Integrated Dynamics. Minecraft users who use Integrated Scripting prior to versions 1.21.1-1.0.17, 1.21.4-1.0.9-254, 1.20.1-1.0.13, and 1.19.2-1.0.10 may be vulnerable to arbitrary code execution. By using Java...

CVE-2025-27107

CVE-2025-27107 affects Integrated Scripting in Integrated Dynamics for Minecraft servers. The vulnerability allows arbitrary code execution by abusing Java reflection on a thrown exception to escape the JavaScript sandbox in IntegratedScripting’s Variable Cards, enabling an attacker with card cre...

CVE-2023-33245

Minecraft through 1.19 and 1.20 pre-releases before 7 Java allow arbitrary file overwrite, and possibly code execution, via crafted world data that contains a symlink...

Minecraft 路径遍历漏洞

Minecraft My World is a Swedish sandbox game by Mojang. Minecraft had a path traversal vulnerability prior to 1.17.1 that originated when online-mode=false was configured to allow path traversal to delete arbitrary JSON files...