CVE-2021-48006: Improper Handling of Case Sensitivity

PocketMine-MP before 4.0.3 does not perform case-insensitive matching when removing operator entries from ops.txt. The removeOp function lowercases the supplied name but only removes an exactly matching entry, so an operator name stored with non-lowercase letters cannot be revoked using the deop...

CVE-2020-37277: Uncontrolled Resource Consumption

PocketMine-MP versions before 3.15.4 contain a denial of service vulnerability in the InventoryTransaction component's findResultItem method. Malicious clients can send specially crafted InventoryTransactionPackets with multiple conflicting pathways to cause exponential processing complexity,...

PT-2026-86517

PocketMine-MP before 4.7.2 fails to properly handle exceptions from the adhocore/json-comment library when parsing skin geometry data. Attackers can send login or skin packets with invalid geometry JSON to trigger an unhandled RuntimeException, causing server crash...

PT-2026-122193

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=555347939 Crash type: Heap-buffer-overflow WRITE 4 Crash state: mp load float mp decode float luamp decode with ctx...

PT-2026-81938

mp Enddisc used incorrect length calculations when formatting endpoint discriminator addresses for display, allowing a received endpoint option to overflow a global result buffer. A malicious PPP peer can crash ppp8 or potentially execute arbitrary code as root...

PT-2026-81940

mp SetEnddisc copied a user-supplied PSN endpoint value without length validation, allowing a buffer overflow via the ppp8 command interface. A local user with access to the ppp8 command interface can crash ppp8 or potentially execute arbitrary code as root...

Malicious code in @zalastax/nolb-mp- (npm)

The package @zalastax/nolb-mp- was found to contain malicious code. --- Credit: OpenSSF source...

Malware in @mp-op-ss-front-lib/tracks

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

LANIER MP 2555 FTP Service - Detect

LANIER MP 2555 FTP service was detected. !/usr/bin/env python3 -- coding: utf-8 -- """LANIER MP 2555 FTP service was detected.""" import socket from kittysploit import from lib.protocols.tcp.tcpscannerclient import Tcpscannerclient class ModuleScanner, Tcpscannerclient: info = 'name': 'LANIER MP...

EUVD-2026-49927

In schreibfaul1 ESP32-audioI2S 3.4.5, a heap-based buffer overflow in the ID3v2 SYLT synchronized lyrics parser in audiolib allows remote attackers to cause a denial of service application crash, information disclosure, or potential arbitrary code execution via a crafted MP3 file. The vulnerabili...

Malicious code in home-mp-commons (npm)

Source: amazon-inspector 885b9dad73e9eeb07a1fcb4a94493ec85573f656f7b9347a8682f56db359cfd6 [email protected] is an empty npm package declared main index.js is absent from the tarball whose sole effect on install is to resolve a single dependency 'ltidisafe' from a hardcoded off-registry URL ...

Out-of-bounds Write

Overview Magick.NET-Q16-HDRI-OpenMP-x64 is a Magick.NET allows you can use ImageMagick without having to install ImageMagick on your server or desktop. More information about specific builds see the official docs https://github.com/dlemstra/Magick.NET/tree/main/docs Affected versions of this...

Malicious code in home-mp-commons (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 885b9dad73e9eeb07a1fcb4a94493ec85573f656f7b9347a8682f56db359cfd6 [email protected] is an empty npm package declared main index.js is absent from the tarball whose sole effect on install is to resolve a single...

MAL-2026-10553 Malicious code in home-mp-commons (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 885b9dad73e9eeb07a1fcb4a94493ec85573f656f7b9347a8682f56db359cfd6 [email protected] is an empty npm package declared main index.js is absent from the tarball whose sole effect on install is to resolve a single...

CVE-2026-33802

A Missing Authorization vulnerability in the CLI of Juniper Networks Junos OS on EX Series allows a local, authenticated attacker to cause a Denial-of-Service DoS. On EX2300, EX4000, EX4100, EX4300-MP Multigigabit and EX4400 switches, an authenticated, local attacker with no specific permissions ...

CVE-2026-33802

Summary: CVE-2026-33802 is a Missing Authorization vulnerability in the CLI of Juniper Networks Junos OS on EX Series switches (EX2300, EX4000, EX4100, EX4300-MP, EX4400) that allows a locally authenticated attacker with no specific permissions to execute a privileged CLI command and trigger a Do...

CVE-2026-33802 Junos OS: EX Series: Unauthorized users can execute service-impacting CLI command

A Missing Authorization vulnerability in the CLI of Juniper Networks Junos OS on EX Series allows a local, authenticated attacker to cause a Denial-of-Service DoS. On EX2300, EX4000, EX4100, EX4300-MP Multigigabit and EX4400 switches, an authenticated, local attacker with no specific permissions ...

mp-api (0.40.1) potentially affected by CVE-2022-42964 via pymatgen (2024.2.8)

pymatgen PYPI version 2024.2.8 is affected by a known vulnerability. The following packages have a transitive dependency on pymatgen and may be impacted: - mp-api 0.40.1 Source cves: CVE-2022-42964 Source advisory: OSV:PYSEC-2026-909...

CVE-2026-36910

An access violation in the BaseSplitterFile::Read function of Aleksoid1978 MPC-BE before commit 4341cb3 allows attackers to cause a Denial of Service DoS via a crafted MP4 file...

Security update for frr

This update for frr fixes the following issues CVE-2026-28532: Denial of Service due to integer overflow in OSPF TLV parser functions bsc1263859. CVE-2026-37457: An off-by-one out-of-bounds write vulnerability in the bgpflowspecopdecode function bgpd/bgpflowspecutil.c of FRRouting FRR stable/10.0...