CVE Database

CVE-2026-86768 Medium · 5.4 CWE-20 Sep 9, 2026

Snipe-IT before 8.7.0 Improper Input Validation via API Checkout

Snipe-IT before 8.7.0 fails to validate soft-deleted state in API checkout endpoints, allowing authenticated users with checkout permissions to bind live inventory to trashed targets. Attackers can submit POST requests to hardware, component, or consumable checkout endpoints with soft-deleted user, asset, or location IDs to create orphaned references that corrupt the asset ledger and audit trails.

CVE-2025-71417 Medium · 6.5 CWE-20 Sep 9, 2026

PocketMine-MP before 5.32.1 Denial of Service via ResourcePackClientResponsePacket

PocketMine-MP before 5.32.1 fails to validate uniqueness of pack UUIDs in ResourcePackClientResponsePacket STATUS_SEND_PACKS handling, allowing authenticated clients to trigger duplicate pack transmissions. Attackers can send multiple copies of valid pack UUIDs in a single packet to exhaust server memory and cause denial of service.

CVE-2024-58380 Medium · 6.5 CWE-20 Sep 9, 2026

PocketMine-MP before 5.11.2 Denial of Service via BookEditPacket

PocketMine-MP versions before 5.11.2 contain a denial of service vulnerability in BookEditPacket handling that crashes the server when an invalid inventory slot value is provided. Attackers can send a crafted BookEditPacket with an inventory slot greater than 35 to trigger an unhandled exception and crash the server.

CVE-2023-54393 High · 7.5 CWE-20 Sep 9, 2026

PocketMine-MP before 4.20.5 Denial of Service via LoginPacket

PocketMine-MP versions before 4.20.5 contain a denial of service vulnerability in LoginPacket JSON parsing due to improper validation in the JsonMapper dependency. Attackers can send malformed JSON structures in LoginPacket to crash the server.

CVE-2023-54392 Medium · 6.5 CWE-20 Sep 9, 2026

PocketMine-MP before 4.22.3 Denial of Service via BlockActorDataPacket

PocketMine-MP versions >= 4.20.0 before 4.22.3 (and before 5.2.1 in the 5.x branch) fail to validate NBT tag types in BlockActorDataPacket. A player can crash the server by sending a packet containing sign NBT data with an incorrect tag type, triggering an unhandled UnexpectedTagTypeException that terminates the server process.

CVE-2026-74761 High · 7.5 CWE-20 Sep 9, 2026

Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Spoofing of RemoveSubscription clientId

Improper input validation in TopicRegion in Apache ActiveMQ, Apache ActiveMQ Broker, and Apache ActiveMQ All on all platforms. An authenticated client can spoof clientId when removing a durable topic subscription. This issue affects Apache ActiveMQ Broker: before 5.19.11, from 6.0.0 before 6.3.2; Apache ActiveMQ All: before 5.19.11, from 6.0.0 before 6.3.2; Apache ActiveMQ: before 5.19.11, from 6.0.0 before 6.3.2. Users are recommended to upgrade to version 6.3.2 or 5.19.11 which fixes the issue.

CVE-2026-73334 High · 8.1 CWE-20 Sep 9, 2026

Apache Parquet Hadoop: File-controlled KMS URL is forwarded to pluggable KmsClient that skips host validation

Potential problem for users of the org.apache.parquet.crypto.keytools package in Apache Parquet, versions 1.12 to 1.18. This package enables users to encrypt Parquet files via an envelope encryption mechanism that wraps (encrypts) data keys via a Key Management Service (KMS). On the reader side, the KMS URL can be application-controlled or file-controlled. If the user does not leverage application control for this parameter, a file-controlled KMS URL is forwarded to a pluggable KmsClient implementation. If the pluggable implementation does not perform host validation, a KMS token can be sent to a malicious host set by an attacker in the file. Before the problem is fixed, users are recommended to leverage application control for KMS URL parameter in readers (versions 1.12-1.18). After the problem is fixed (presumably in version 1.19), the upgrade will disable file-controlled KMS URL by default. Users of the KMS URL parameter will have two options then: leverage application control for KMS URL parameter in readers, or enable file-controlled KMS URL (via a new app parameter). The latter option will explicitly require (in the new parameter documentation) to validate the KMS URL and use authentication in the custom implementation of the KMS client plug in.

CVE-2025-7062 Medium · 5.2 CWE-20 Sep 9, 2026

Stored Cross-Site Scripting via file upload in H5P module (h5p-nodejs-library) of Lumi Education

A stored cross-site scripting (XSS) vulnerability has been identified in the H5P module `h5p-nodejs-library` by Lumi Education UG in versions up to and including 10.0.4. The library allows users to upload H5P content that contains malicious JavaScript. This code is then executed in the browsers of other users who view the affected H5P content.

CVE-2026-21112 Medium · 5.5 CWE-20 Sep 9, 2026

Improper Input Validation in Samsung Android

Improper input validation in Samsung Tips prior to Android 17 allows local attackers to launch arbitrary activity with Samsung Tips privilege. User interaction is required for triggering this vulnerability.

CVE-2026-21101 Medium · 6.7 CWE-20 Sep 9, 2026

Improper Input Validation in Samsung Android

Improper input validation in DualDAR driver prior to SMR Sep-2026 Release 1 allows local privileged attackers to potentially execute arbitrary code with root privilege.

CVE-2026-21094 High · 8.8 CWE-20 Sep 9, 2026

Improper Input Validation in Samsung Android

Improper input validation in wpa_supplicant prior to SMR Sep-2026 Release 1 allows adjacent attackers to write out-of-bounds memory.

CVE-2026-21089 High · 7.8 CWE-20 Sep 9, 2026

Improper Input Validation in Samsung Android

Improper input validation in removing style tag in libsubextractor.so prior to SMR Sep-2026 Release 1 allows local attackers to write out-of-bounds memory.

CVE-2026-21088 High · 7.8 CWE-20 Sep 9, 2026

Improper Input Validation in Samsung Android

Improper input validation in loading a subtitle frame in libsubextractor.so prior to SMR Sep-2026 Release 1 allows local attackers to write out-of-bounds memory.

CVE-2026-21086 High · 7.8 CWE-20 Sep 9, 2026

Improper Input Validation in Samsung Android

Improper authorization in ProxyHandler prior to SMR Aug-2026 Release 1 allows local attackers to access proxy configuration.

CVE-2026-12855 High · 8.2 CWE-20 Sep 9, 2026

H19WMIHandlerSmm: unvalidated memory boundary could result in arbitrary code execution.

Unvalidated memory boundary could result in arbitrary code execution. The vulnerability exists in the code developed specifically for HP projects.

CVE-2026-87083 Medium · 5.5 CWE-20 Sep 8, 2026

tile-ai tilelang Kernel Cache kernel_cache.py KernelCache._load_kernel_from_disk deserialization

A weakness has been identified in tile-ai tilelang up to 0.1.14. This impacts the function KernelCache._load_kernel_from_disk of the file tilelang/cache/kernel_cache.py of the component Kernel Cache. Executing a manipulation can lead to deserialization. The attack may be performed from remote. This patch is called 11ec2397fe942e8b422d026af4a03d6e0a55ae6c. Applying a patch is advised to resolve this issue. Based on the release information, the fix has not been included in any official release yet.

CVE-2026-87600 Medium · 6.5 CWE-20 Sep 8, 2026