# cve.now: Pmmp

The newest entries naming Pmmp as an affected vendor (up to 200), of 33 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-86204](https://cve.now/CVE-2026-86204.md): PocketMine-MP before 5.39.2 Denial of Service via ModalFormResponsePacket (CVSS 7.1)
- [CVE-2026-86203](https://cve.now/CVE-2026-86203.md): PocketMine-MP before 5.39.2 Item Duplication via Despawn State (CVSS 6.3)
- [CVE-2026-86202](https://cve.now/CVE-2026-86202.md): PocketMine-MP before 5.39.2 Network Amplification via ActorEventPacket (CVSS 5.3)
- [CVE-2026-86201](https://cve.now/CVE-2026-86201.md): PocketMine-MP before 5.41.1 LogDoS via LoginPacket clientData (CVSS 8.7)
- [CVE-2026-86200](https://cve.now/CVE-2026-86200.md): PocketMine-MP before 5.42.1 LogDoS via LoginPacket clientData JWT (CVSS 6.9)
- [CVE-2026-86199](https://cve.now/CVE-2026-86199.md): PocketMine-MP before 5.43.1 Denial of Service via unauthenticated login (CVSS 8.7)
- [CVE-2026-86198](https://cve.now/CVE-2026-86198.md): PocketMine-MP before 5.44.2 Denial of Service via ResourcePackClientResponsePacket (CVSS 2.3)
- [CVE-2025-71418](https://cve.now/CVE-2025-71418.md): PocketMine-MP before 5.25.2 Denial of Service via explode (CVSS 6.9)
- [CVE-2025-71417](https://cve.now/CVE-2025-71417.md): PocketMine-MP before 5.32.1 Denial of Service via ResourcePackClientResponsePacket (CVSS 7.1)
- [CVE-2024-58381](https://cve.now/CVE-2024-58381.md): PocketMine-MP before 5.11.1 Denial of Service via LoginPacket (CVSS 8.7)
- [CVE-2024-58380](https://cve.now/CVE-2024-58380.md): PocketMine-MP before 5.11.2 Denial of Service via BookEditPacket (CVSS 7.1)
- [CVE-2023-54396](https://cve.now/CVE-2023-54396.md): PocketMine-MP before 4.8.1 Server Crash via Banner NBT (CVSS 7.1)
- [CVE-2023-54395](https://cve.now/CVE-2023-54395.md): PocketMine-MP before 4.12.5 Denial of Service via ModalFormResponsePacket (CVSS 5.3)
- [CVE-2023-54394](https://cve.now/CVE-2023-54394.md): PocketMine-MP before 4.18.0-ALPHA2 Bandwidth Amplification via InventoryTransactionPacket (CVSS 5.3)
- [CVE-2023-54393](https://cve.now/CVE-2023-54393.md): PocketMine-MP before 4.20.5 Denial of Service via LoginPacket (CVSS 8.7)
- [CVE-2023-54392](https://cve.now/CVE-2023-54392.md): PocketMine-MP before 4.22.3 Denial of Service via BlockActorDataPacket (CVSS 7.1)
- [CVE-2023-54390](https://cve.now/CVE-2023-54390.md): PocketMine-MP before 5.3.1 Denial of Service via LoginPacket (CVSS 8.7)
- [CVE-2023-54355](https://cve.now/CVE-2023-54355.md): PocketMine-MP 5.2.0 Server Crash via Incorrect EC Curve (CVSS 8.7)
- [CVE-2022-51018](https://cve.now/CVE-2022-51018.md): PocketMine-MP before 3.26.5 and 4.0.5 Input Validation via Book Pages (CVSS 7.1)
- [CVE-2022-51017](https://cve.now/CVE-2022-51017.md): PocketMine-MP before 3.26.5 and 4.0.5 Denial of Service via Skin Data (CVSS 8.7)
- [CVE-2022-51016](https://cve.now/CVE-2022-51016.md): PocketMine-MP 3.x before 3.27.0 Authentication Bypass via Login Replay (CVSS 5.3)
- [CVE-2022-51015](https://cve.now/CVE-2022-51015.md): PocketMine-MP before 4.0.6 Denial of Service via PlayerActionPacket (CVSS 7.1)
- [CVE-2022-51014](https://cve.now/CVE-2022-51014.md): PocketMine-MP before 4.0.7 Denial of Service via JSON Decoding (CVSS 7.1)
- [CVE-2022-51013](https://cve.now/CVE-2022-51013.md): PocketMine-MP before 4.2.3 Denial of Service via NBT Metadata (CVSS 7.1)
- [CVE-2022-51012](https://cve.now/CVE-2022-51012.md): PocketMine-MP before 4.2.9 Denial of Service via NBT Deserialization (CVSS 7.1)
- [CVE-2022-51011](https://cve.now/CVE-2022-51011.md): PocketMine-MP before 4.2.10 Denial of Service via Chat Messages (CVSS 5.3)
- [CVE-2022-51010](https://cve.now/CVE-2022-51010.md): PocketMine-MP before 4.4.2 Server Crash via Item ID (CVSS 7.1)
- [CVE-2022-51009](https://cve.now/CVE-2022-51009.md): PocketMine-MP before 4.7.2 Denial of Service via Skin Geometry (CVSS 8.7)
- [CVE-2022-51008](https://cve.now/CVE-2022-51008.md): PocketMine-MP before 4.12.3 Denial of Service via Unauthenticated Sessions (CVSS 6.9)
- [CVE-2021-48007](https://cve.now/CVE-2021-48007.md): PocketMine-MP before 3.18.1 Denial of Service via MovePlayerPacket (CVSS 7.1)
- [CVE-2021-48006](https://cve.now/CVE-2021-48006.md): PocketMine-MP before 4.0.3 Operator Privilege Escalation via Case Sensitivity (CVSS 4.8)
- [CVE-2020-37277](https://cve.now/CVE-2020-37277.md): PocketMine-MP before 3.15.4 Denial of Service via InventoryTransaction (CVSS 7.1)
- [CVE-2023-7332](https://cve.now/CVE-2023-7332.md): PocketMine-MP \< 4.18.1 Improper Validation of Dropped Item Count Allows Remote Server Crash (CVSS 7.1)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/pmmp
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.