Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2022-51011 | medium | 4.3 | No | PocketMine-MP before 4.2.10 fails to validate the total length of incoming chat message blobs before splitting them by newline characters, a... | 2026-10-08 |
| CVE-2022-51010 | medium | 6.5 | No | PocketMine-MP versions before 4.4.2 fail to properly validate item IDs received from clients in itemstack NBT data. Attackers can send craft... | 2026-10-08 |
| CVE-2022-51009 | high | 7.5 | No | PocketMine-MP before 4.7.2 fails to properly handle exceptions from the adhocore/json-comment library when parsing skin geometry data. Attac... | 2026-10-08 |
| CVE-2021-48007 | medium | 6.5 | No | PocketMine-MP versions before 3.18.1 fail to validate NaN or INF values in MovePlayerPacket position and rotation fields. Malicious clients... | 2026-10-08 |
| CVE-2021-48006 | low | 3.3 | No | PocketMine-MP before 4.0.3 does not perform case-insensitive matching when removing operator entries from ops.txt. The removeOp function low... | 2026-10-08 |
| CVE-2020-37277 | medium | 6.5 | No | PocketMine-MP versions before 3.15.4 contain a denial of service vulnerability in the InventoryTransaction component's findResultItem() meth... | 2026-10-08 |
| CVE-2019-25710 | critical | 9.1 | No | Dolibarr ERP-CRM 8.0.4 contains an SQL injection vulnerability in the rowid parameter of the admin dict.php endpoint that allows attackers t... | 2026-10-08 |
| CVE-2011-10019 | critical | 9.8 | No | Spreecommerce versions prior to 0.60.2 contains a remote command execution vulnerability in its search functionality. The application fails... | 2026-10-08 |
| CVE-2026-20521 | high | 8.4 | No | In Video HAL, there is a possible escalation of privilege due to a missing bounds check. This could lead to local escalation of privilege wi... | 2026-10-08 |
| CVE-2026-67410 | high | 7.1 | No | RabbitMQ is a messaging and streaming broker. From 4.2.0 until 4.3.3 and 4.2.9, OAuth2 Client Secret Exposed via Unauthenticated JavaScript... | 2026-10-08 |
| CVE-2026-20522 | high | 8.4 | No | In neuropilot, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with... | 2026-10-08 |
| CVE-2026-67409 | medium | 6.5 | No | RabbitMQ is a messaging and streaming broker. From 3.13.0 until 4.3.3, 4.2.9, 4.1.14, 4.0.23, and 3.13.18, JWKS Fetch Ignores HTTP Response... | 2026-10-08 |
| CVE-2026-20524 | high | 8.4 | No | In apu, there is a possible memory corruption due to improper input validation. This could lead to local escalation of privilege with no add... | 2026-10-08 |
| CVE-2026-67408 | medium | 6.5 | No | RabbitMQ is a messaging and streaming broker. From 4.1.0 until 4.3.3, 4.2.9, and 4.1.11, Stream Management Super-Stream Binding Keys Allocat... | 2026-10-08 |
| CVE-2026-66073 | medium | 6.5 | No | RabbitMQ is a messaging and streaming broker. From 3.13.0 until 3.13.15 and 4.0.20 and 4.1.11 and 4.2.6, Atom table exhaustion via managemen... | 2026-10-08 |
| CVE-2026-20525 | medium | 5.3 | No | In Modem, there is a possible system crash due to improper input validation. This could lead to remote denial of service, if a UE has connec... | 2026-10-08 |
| CVE-2026-20527 | medium | 5.3 | No | In Modem, there is a possible system crash due to a missing bounds check. This could lead to remote denial of service, if a UE has connected... | 2026-10-08 |
| CVE-2026-87158 | high | 7.1 | No | Vulnerability in the Oracle Order Management product of Oracle E-Business Suite (component: Enterprise Command Center). The supported versio... | 2026-10-08 |
| CVE-2026-87157 | high | 8.1 | No | Vulnerability in the Oracle Order Management product of Oracle E-Business Suite (component: Product Diagnostic Tools). Supported versions th... | 2026-10-08 |
| CVE-2026-18922 | critical | 9.8 | No | A flaw was found in 389 Directory Server. During SASL PLAIN authentication, a stale identity carried in a Cyrus SASL auxiliary property from... | 2026-10-08 |