CVE-2026-11573

Uncontrolled recursion CWE-674 in the QDomDocument/QDomNode serialization path of the Qt XML module QtXml, qtbase. QDomElementPrivate::save and QDomNodePrivate::save recurse mutually, consuming one stack frame per level of element nesting with no depth limit, no configurable bound and no error...

BIT-JENKINS-2026-84655

Jenkins 2.579 and earlier, LTS 2.568.2 and earlier does not escape map keys when serializing objects as JSON and Python through its REST API, allowing attackers able to control map property names to inject arbitrary fields into JSON and Python API responses...

PT-2026-88172

Jenkins 2.579 and earlier, LTS 2.568.2 and earlier does not escape map keys when serializing objects as JSON and Python through its REST API, allowing attackers able to control map property names to inject arbitrary fields into JSON and Python API responses...

CVE-2022-51017

PocketMine-MP versions before 3.26.5 and 4.0.5 fail to validate the length of skin data fields submitted by players, allowing uncapped values to exceed the 32767 byte TAGString limit. Attackers can submit oversized skin data fields like skinID or geometryName to trigger exceptions during NBT data...

CVE-2022-51017 PocketMine-MP before 3.26.5 and 4.0.5 Denial of Service via Skin Data

PocketMine-MP versions before 3.26.5 and 4.0.5 fail to validate the length of skin data fields submitted by players, allowing uncapped values to exceed the 32767 byte TAGString limit. Attackers can submit oversized skin data fields like skinID or geometryName to trigger exceptions during NBT data...

CVE-2022-51017

PocketMine-MP versions prior to 3.26.5 and 4.0.5 fail to validate the length of skin data fields (e.g., skinID , geometryName ) submitted by players, allowing uncapped values to exceed the 32767-byte TAG_String limit. This triggers exceptions during NBT data serialization, causing a server crash ...

EUVD-2022-56046

PocketMine-MP versions before 3.26.5 and 4.0.5 fail to validate the length of skin data fields submitted by players, allowing uncapped values to exceed the 32767 byte TAGString limit. Attackers can submit oversized skin data fields like skinID or geometryName to trigger exceptions during NBT data...

CVE-2022-51017 PocketMine-MP before 3.26.5 and 4.0.5 Denial of Service via Skin Data

PocketMine-MP versions before 3.26.5 and 4.0.5 fail to validate the length of skin data fields submitted by players, allowing uncapped values to exceed the 32767 byte TAGString limit. Attackers can submit oversized skin data fields like skinID or geometryName to trigger exceptions during NBT data...

CVE-2022-51017 PocketMine-MP before 3.26.5 and 4.0.5 Denial of Service via Skin Data

PocketMine-MP versions before 3.26.5 and 4.0.5 fail to validate the length of skin data fields submitted by players, allowing uncapped values to exceed the 32767 byte TAGString limit. Attackers can submit oversized skin data fields like skinID or geometryName to trigger exceptions during NBT data...

CVE-2022-51017: Improper Input Validation

PocketMine-MP versions before 3.26.5 and 4.0.5 fail to validate the length of skin data fields submitted by players, allowing uncapped values to exceed the 32767 byte TAGString limit. Attackers can submit oversized skin data fields like skinID or geometryName to trigger exceptions during NBT data...

PT-2026-86779

PocketMine-MP versions before 3.26.5 and 4.0.5 fail to validate the length of skin data fields submitted by players, allowing uncapped values to exceed the 32767 byte TAG String limit. Attackers can submit oversized skin data fields like skinID or geometryName to trigger exceptions during NBT dat...

Linux Distros Unpatched Vulnerability : CVE-2026-57160

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - PJSIP is a free and open source multimedia communication library written in C. Prior to commit d6a0e7f, a buffer overflow can occur in pjsipgenericarrayhdrprint...

SUSE CVE-2026-55496

Cloudreve is a self-hosted file management and sharing system. Prior to 4.17.0, GET /api/v4/user/search calls SearchActive without adding a StatusActive predicate and serializes matches at RedactLevelUser, allowing any logged-in user to enumerate email addresses and profile metadata for inactive ...

SUSE CVE-2026-64859

New API is a large language mode LLM gateway and artificial intelligence AI asset management system. Prior to 1.0.0-rc.7, the admin user list and user lookup APIs, including GET /api/user/, return User.AccessToken as accesstoken because User model objects are serialized after queries use...

Improper Certificate Validation

Overview org.webjars.npm:undici is an An HTTP/1.1 client, written from scratch for Node.js Affected versions of this package are vulnerable to Improper Certificate Validation in the BalancedPool class, which deep-clones its connect and tls options with JSON.parseJSON.stringify... and thereby...

CVE-2026-57160

PJSIP is a free and open source multimedia communication library written in C. Prior to commit d6a0e7f, a buffer overflow can occur in pjsipgenericarrayhdrprint in pjsip/src/pjsip/sipmsg.c, the function that serializes generic array headers such as Allow, Require, Supported, and Unsupported. Unde...

CVE-2026-84961

undici's BalancedPool constructor passes its entire options object through an internal deep-clone that serializes and reparses the value as JSON. Because JSON cannot represent functions, any function-valued TLS option, such as a caller-supplied checkServerIdentity callback or a custom connector...

CVE-2026-57160 PJSIP: SIP message header buffer overflow

PJSIP is a free and open source multimedia communication library written in C. Prior to commit d6a0e7f, a buffer overflow can occur in pjsipgenericarrayhdrprint in pjsip/src/pjsip/sipmsg.c, the function that serializes generic array headers such as Allow, Require, Supported, and Unsupported. Unde...

CVE-2026-57160

PJSIP , an open-source multimedia communication library written in C, contains a buffer overflow in pjsip_generic_array_hdr_print() (in pjsip/src/pjsip/sip_msg.c), the function responsible for serializing generic array headers such as Allow, Require, Supported, and Unsupported. Under certain outp...

CVE-2026-57160 PJSIP: SIP message header buffer overflow

PJSIP is a free and open source multimedia communication library written in C. Prior to commit d6a0e7f, a buffer overflow can occur in pjsipgenericarrayhdrprint in pjsip/src/pjsip/sipmsg.c, the function that serializes generic array headers such as Allow, Require, Supported, and Unsupported. Unde...