Search vulnerabilities

Expected end of text, found '/' (at char 34), (line:1, col:35)
Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 425,959

CVE-2026-102692

RIOT: Potential integer overflow in nanocoap Block2 handling leading to out-of-bounds memory access

RIOT is an open-source microcontroller operating system designed for Internet of Things devices and other embedded systems. Prior to 2026.07, nanocoap accepts oversized CoAP Block2 option values without enforcing the 20-bit maximum block number, allowing block offset multiplication to overflow on 32-bit targets. The affected master baseline is commit aeeae69e; the verified fix is later on master and remains unreleased. The oversized value passes from coap_get_blockopt() to coap_block_slicer_init(). A remote CoAP client can send a malformed Block2 option that produces an invalid slice range and can cause out-of-bounds memory access, denial of service, or memory corruption. This vulnerability is fixed in 2026.07.

CVSS 3.1 · 9.1 Critical EPSS < 1% KEV · Not listed
Vendors
Riot-os
Products
Riot
CVE-2026-102068

Junos OS Evolved: Malformed TCP key-chain traffic causes a kernel panic when BGP or LDP key-chain authentication is used

A Stack-based Buffer Overflow vulnerability in the kernel of Juniper Networks Junos OS Evolved allows an unauthenticated remote attacker to trigger a kernel panic via a crafted TCP packet when key-chain authentication is used for BGP or LDP.

CVSS 4.0 · 9.2 Critical EPSS < 1% KEV · Not listed
Vendors
Juniper Networks
Products
Junos Os Evolved
CVE-2026-102070

Junos OS: A remote TWAMP peer causes rmopd service disruption when TWAMP-Control is used

A Reachable Assertion vulnerability in the Two-Way Active Measurement Protocol (TWAMP) client of Juniper Networks Junos OS allows an unauthenticated network-based attacker to cause rmopd service disruption via a specific TCP packet.

CVSS 4.0 · 9.2 Critical EPSS < 1% KEV · Not listed
Vendors
Juniper Networks
Products
Junos Os
CVE-2026-102069

Junos OS: An ICCP peer causes dot1xd to crash when dot1x synchronization is enabled

A Stack-based Buffer Overflow vulnerability in the dot1x daemon of Juniper Networks Junos OS devices operating as Junos Fusion Aggregation Devices allows an adjacent attacker acting as the configured ICCP peer to cause a denial of service and potentially execute code as root via. The issue is triggered when dot1x synchronization is enabled for the required Fusion satellite topology.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Juniper Networks
Products
Junos Os
CVE-2026-102067

Junos OS and Junos OS Evolved: A specific RSVP packet causes an rpd crash when L2 LSP support is used

An Improper Validation of Specified Quantity in Input vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent unauthenticated attacker to cause a denial of service via a crafted RSVP packet when L2 LSP support is enabled.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Juniper Networks
Products
Junos Os Junos Os Evolved
CVE-2026-102000

Junos OS and Junos OS Evolved: An attacker causes rpd to crash when LDP is enabled

A Reachable Assertion vulnerability in the rpd process of Juniper Networks Junos OS and Junos EVO allows an adjacent unauthenticated attacker to cause a denial of service via LDP control traffic.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Juniper Networks
Products
Junos Os Junos Os Evolved
CVE-2026-102037

Junos OS: SRX Series: An attacker causes arbitrary configuration commit when the custom URL-feed feature is used

An XML Injection vulnerability in the Unified Threat Management daemon (utmd) of Juniper Networks Junos OS on SRX Series devices allows an unauthenticated network attacker to commit arbitrary device configuration with root privileges via a malicious response from a configured custom URL-feed server.

CVSS 4.0 · 9.2 Critical EPSS < 1% KEV · Not listed
Vendors
Juniper Networks
Products
Junos Os
CVE-2026-102065

Junos OS and Junos OS Evolved: A malformed SRv6 service route causes an rpd crash when dynamic tunnels are enabled

An Improper Validation of Specified Quantity in Input vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows a remote unauthenticated BGP peer to cause an rpd crash via a malformed BGP-signaled SRv6 service route when SRv6 dynamic tunnels are enabled.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Juniper Networks
Products
Junos Os Junos Os Evolved
CVE-2026-102014

Junos OS: An attacker causes authd to crash when subscriber RADIUS authentication is used

A Stack-based Buffer Overflow vulnerability in the authd process of Juniper Networks Junos OS allows an attacker able to influence a configured RADIUS server to cause authd to crash or execute code with root privileges via a malicious RADIUS response.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Juniper Networks
Products
Junos Os
CVE-2026-102030

Junos OS and Junos OS Evolved: An attacker causes routing-daemon denial of service when BGP MVPN inter-region tunneling is used

An Incomplete Cleanup vulnerability in the rpd process of Juniper Networks Junos OS and Junos OS Evolved allows a configured MVPN neighbor to cause a denial of service via a BGP MVPN update when an inter‑region segmented VRF with 'protocols mvpn inter-region-template' is configured.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Juniper Networks
Products
Junos Os Junos Os Evolved
CVE-2026-102072

Junos OS: An authenticated attacker causes a denial of service when the gRPC extension-service is enabled

An Improper Handling of Highly Compressed Data vulnerability in the gRPC library used by na-grpcd of Juniper Networks Junos OS allows an authenticated network-based attacker to cause a denial of service via a compressed gRPC request.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Juniper Networks
Products
Junos Os
CVE-2026-102071

Junos OS and Junos OS Evolved: Specific RSVP packet causes an rpd crash when associated bidirectional LSP is enabled

A Reachable Assertion vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated adjacent attacker to cause a denial of service via a specific RSVP packet.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Juniper Networks
Products
Junos Os Junos Os Evolved
CVE-2026-102086

Junos OS: SRX Series: Multiple DNS queries processed by SecIntel and DGA in the same session cause a flowd crash

A NULL Pointer Dereference vulnerability in the DNS plugin of Juniper Networks Junos OS on SRX Series allows an unauthenticated, network-based attacker to cause a complete Denial-of-Service (DoS). When multiple DNS queries are received in a single flow session, where one query matches a Security Intelligence (SecIntel) feed and another query is sent for DNS Domain Generation Algorithm (DGA) analysis, an error in processing logging of these asynchronous tasks can lead to an FPC crash. The exact timing conditions are outside an attacker's direct control. This issue affects Junos OS on SRX Series: * All versions before 23.2R2-S7.7; * from 23.4 before 23.4R2-S8.13; * from 24.2 before 24.2R2-S5.5; * from 24.4 before 24.4R2-S4; * from 25.2 before 25.2R2-S1; * from 25.4 before 25.4R1-S2.

CVSS 4.0 · 8.2 High EPSS < 1% KEV · Not listed
Vendors
Juniper Networks
Products
Junos Os
CVE-2026-102085

Junos OS Evolved: A port which has been inadvertently exposed can be reached by an attacker

An Improper Restriction of Communication Channel to Intended Endpoints vulnerability in Juniper Networks Junos OS Evolved allows an unauthenticated, network-based attacker to cause a limited information disclosure and availability impact to the device. Due to a wrong initialization, a process which should only be able to communicate internally within the device can be reached over the network via an open port. This leads to a device being inadvertently exposed and increased CPU cycles spent processing ingress packets. This issue affects Junos OS Evolved: * All versions before 23.2R2-S7.7-EVO; * 23.4 versions before 23.4R2-S8.11-EVO; * 24.2 versions before 24.2R2-S5.6-EVO; * 24.4 versions before 24.4R2-S4-EVO; * 25.2 version before 25.2R2-S1-EVO; * 25.4 versions before 25.4R1-S1-EVO. Please note that this issue is similar to but not identical CVE-2026-33803.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Juniper Networks
Products
Junos Os Evolved