Search vulnerabilities

Expected end of text, found '–' (at char 11), (line:1, col:12)
Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 425,645

CVE-2026-102178

Junos OS and Junos OS Evolved: When BGP update-threading is enabled a specifically malformed flowspec NLRI causes routing-engine compromise

A Stack-based Buffer Overflow vulnerability in the BGP routing daemon of Juniper Networks Junos OS and Junos OS Evolved allows a configured BGP flowspec peer to cause routing-engine compromise or a routing-daemon denial of service via flowspec route re-advertisement when BGP update-threading is enabled.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed
Vendors
Juniper Networks
Products
Junos Os Junos Os Evolved
CVE-2026-102179

Junos OS and Junos OS Evolved: An attacker causes a routing daemon crash when BGP EVPN RIB telemetry is used

An Out-of-bounds Write vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an attacker with access to a configured BGP EVPN peer to cause a denial of service via BGP EVPN route processing when the l2vpn-evpn RIB telemetry sensor is subscribed. Successful exploitation can crash rpd and interrupt routing protocols until the daemon restarts and reconverges.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Juniper Networks
Products
Junos Os Junos Os Evolved
CVE-2026-102180

Junos OS and Junos OS Evolved: An attacker causes an rpd crash when BGP RIB streaming telemetry is in use

A Stack-based Buffer Overflow vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an attacker with access to a configured BGP peering session to cause a denial of service by sending a crafted BGP route attribute, which is processed while a BGP RIB streaming telemetry subscription is active. This issue does not affect Junos OS versions prior to 22.1R1. This issue does not affect Junos OS Evolved versions prior to 22.1R1-EVO.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Juniper Networks
Products
Junos Os Junos Os Evolved
CVE-2026-102077

Junos OS: MX Series with SPC3: In a source NAT scenario malformed packets will lead to resource leaks and eventually traffic stops

An Improper Check for Unusual or Exceptional Conditions vulnerability in the Packet Forwarding Engine (PFE) of Juniper Networks Junos OS on MX Series with SPC3 allows an unauthenticated, network-based attacker to cause a Denial-of-Service (DoS). On MX Series with SPC3 line-card and source NAT configuration, when a specific malformed IPv6 packet is received, it is not dropped but instead a session is created and NAT resources are allocated. Continued receipt of such packets will eventually lead to session or resource exhaustion, which will impact all traffic through the device. To recover the device needs to be rebooted. To monitor session usage, use the following: show services sessions summary To monitor source NAT resource usage, use the following:  show services nat pool This issue affects Junos OS on MX Series with SPC3: * All versions before 23.2R2-S4; * 23.4 versions before 23.4R2-S5; * 24.2 versions before 24.2R2.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Juniper Networks
Products
Junos Os
CVE-2026-96953

Windows Universal Disk Format File System Driver (UDFS) Remote Code Execution Vulnerability

Null pointer dereference in Windows Universal Disk Format File System Driver (UDFS) allows an authorized attacker to execute code locally.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Microsoft
Products
Windows 10 1607 Windows 10 1809 Windows 10 21h2 and 25 more
CVE-2026-101995

Junos OS and Junos OS Evolved: Malformed ICCP packets cause l2ald memory disclosure and disruption

An Improper Validation of Specified Quantity in Input vulnerability in the l2ald of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent attacker with access to an ICCP peer session to cause memory disclosure and disruption of the l2ald daemon via malformed ICCP packets.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Juniper Networks
Products
Junos Os Junos Os Evolved
CVE-2026-102039

Junos OS and Junos OS Evolved: An attacker causes routing-process denial of service when GMPLS EVPL dynamic transport is used

A NULL Pointer Dereference vulnerability in the rpd process of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent attacker to cause a denial of service via a malformed RSVP Path message received on an EVPL LMP control channel.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Juniper Networks
Products
Junos Os Junos Os Evolved
CVE-2026-102040

Junos OS and Junos OS Evolved: An attacker crashes the routing daemon when co-routed bidirectional RSVP LSPs are used

A NULL Pointer Dereference vulnerability in the rpd routing daemon of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent unauthenticated attacker to crash the routing daemon and cause a denial of service via an RSVP Path message.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Juniper Networks
Products
Junos Os Junos Os Evolved
CVE-2026-102041

Junos OS and Junos OS Evolved: An attacker causes a routing daemon crash when RSVP is enabled

A Reachable Assertion vulnerability in the rpd routing daemon of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent unauthenticated network attacker to cause a denial of service via malformed RSVP signaling when RSVP is enabled.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Juniper Networks
Products
Junos Os Junos Os Evolved
CVE-2026-102042

Junos OS and Junos OS Evolved: An attacker causes rpd to crash when RSVP associated-bidirectional LSP is enabled

A Reachable Assertion vulnerability in the rpd process of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent attacker to crash the routing process via RSVP-TE associated-bidirectional LSP signaling.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Juniper Networks
Products
Junos Os Junos Os Evolved
CVE-2026-102043

Junos OS and Junos OS Evolved: An attacker causes a routing-process crash when MPLS-TE fast reroute is enabled

A Numeric Truncation Error vulnerability in the rpd process of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent attacker to crash the routing process via MPLS-TE fast-reroute signaling.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Juniper Networks
Products
Junos Os Junos Os Evolved
CVE-2026-102044

Junos OS and Junos OS Evolved: An attacker causes a routing control-plane denial of service when BGP-LS traffic engineering is enabled

A Reachable Assertion vulnerability in the rpd process of Juniper Networks Junos OS and Junos OS Evolved allows a configured BGP-LS peer to cause a denial of service via a BGP-LS update.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Juniper Networks
Products
Junos Os Junos Os Evolved
CVE-2026-102183

Junos OS and Junos OS Evolved: If in a BGP EVPN scenario a malformed NLRI is received rpd crashes

An Improper Validation of Specified Quantity in Input vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows a configured BGP EVPN peer to cause an rpd crash via a specifically malformed NLRI.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Juniper Networks
Products
Junos Os Junos Os Evolved
CVE-2026-102184

Junos OS and Junos OS Evolved: A malformed EVPN SRv6 route causes an rpd crash

An Improper Validation of Specified Quantity in Input vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos Evolved platforms allows a configured EVPN signaling peer to cause an rpd crash via a malformed SRv6 structure carried in an EVPN route update. The result is a denial of service affecting routing adjacencies.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Juniper Networks
Products
Junos Os Junos Os Evolved
CVE-2026-102185

Junos OS and Junos OS Evolved: An attacker causes an rpd denial of service when EVPN multihoming preference-based DF election is used

A Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows a remote network attacker to cause a denial of service via EVPN multihoming with preference-based designated-forwarder election.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Juniper Networks
Products
Junos Os Junos Os Evolved
CVE-2026-110112

Dockhand before 1.0.50 OIDC Privilege Escalation via Missing Token Claim Validation

Dockhand before 1.0.50 contains a privilege escalation vulnerability that allows users from another tenant to gain admin access because OIDC iss, aud, nonce and exp claims are not validated. Attackers with admin rights in another tenant of a shared provider like Microsoft Entra ID can recreate the mapped admin group and log in as Dockhand administrators.

CVSS 4.0 · 9.2 Critical EPSS < 1% KEV · Not listed
Vendors
Finsys
Products
Dockhand
CVE-2026-110237

Vifm 0.8.1-beta through 0.14.4 Unverified IPC FIFO Ownership Allows Cross-User Command Execution

Vifm 0.8.1-beta through 0.14.4 reuses a pre-existing IPC FIFO in the shared temporary directory without checking ownership, allowing local users to execute commands as another user. Attackers can pre-create a world-writable vifm-ipc-vifm FIFO and write IPC packets with -c and ! shell commands that execute with the victim's privileges.

CVSS 4.0 · 7 High EPSS < 1% KEV · Not listed
Vendors
Vifm
Products
Vifm
CVE-2026-101948

Junos OS and Junos OS Evolved: A specific BGP FlowSpec update causes an rpd crash when BGP FlowSpec import policy is used

A NULL Pointer Dereference vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows a remote unauthenticated BGP peer to cause a denial of service via a specific BGP FlowSpec update received by an affected BGP session.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Juniper Networks
Products
Junos Os Junos Os Evolved
CVE-2026-101951

Junos OS and Junos OS Evolved: A BGP peer causes an rpd crash if a malformed MCAST-TREE NLRI is received and readvertised

An Improper Validation of Consistency within Input vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows a network-adjacent configured BGP peer to cause a denial of service by sending a specifically malformed BGP MCAST-TREE update and this NLRI is then attempted to be readvertised.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Juniper Networks
Products
Junos Os Junos Os Evolved
CVE-2026-102045

Junos OS Evolved: An crafted LACP frame causes lacpd to crash when LACP is enabled

An Out-of-bounds Write Out-of-bounds Write vulnerability in lacpd of Juniper Networks Junos OS Evolved allows a Layer-2-adjacent attacker to cause a denial of service via a crafted frame received on an LACP-enabled aggregated-Ethernet member port.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Juniper Networks
Products
Junos Os Evolved