CVE-2026-101956

Junos OS: Unauthorized root command execution when J-Web is enabled

An Improper Authentication vulnerability in the J-Web web management component of Juniper Networks Junos OS allows an unauthenticated remote attacker to execute arbitrary Junos commands with root privileges via the exposed J-Web web interface.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed

Vendors

Juniper Networks

Products

Junos Os

CVE-2026-101955

Junos OS: SRX Series: Malformed DNS packet causes service disruption when UTM Anti-Spam SBL is used

A Stack-based Buffer Overflow vulnerability in the UTM Anti-Spam SBL of Juniper Networks Junos OS on SRX series allows an unauthenticated remote attacker to cause arbitrary code execution or a denial of service via a injected malformed DNS packet when Anti-Spam SBL inspection is enabled.

CVSS 4.0 · 9.2 Critical EPSS < 1% KEV · Not listed

Vendors

Juniper Networks

Products

Junos Os

CVE-2026-101945

Junos OS and Junos OS Evolved: An attacker causes routing daemon denial of service when EVPN BGP is enabled

An Integer Overflow or Wraparound vulnerability in the rpd process of Juniper Networks Junos OS and Junos OS Evolved allows a remote attacker with an established EVPN BGP peering relationship to cause a denial of service via EVPN BGP route processing. The issue affects EVPN-enabled routing instances and can disrupt control-plane adjacencies.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Juniper Networks

Products

Junos Os Junos Os Evolved

CVE-2026-101946

Junos OS and Junos OS Evolved: An attacker causes rpd process memory disclosure when IPv6 LDP is used

An Out-of-bounds Read vulnerability in the rpd process of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent low-privilege attacker to disclose limited rpd process memory and disrupt an LDP adjacency via an IPv6 LDP message.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Juniper Networks

Products

Junos Os Junos Os Evolved

CVE-2026-101954

Junos OS and Junos OS Evolved: Unauthenticated network access causes full device takeover when J-Web is enabled

An Improper Authentication vulnerability in the J-Web management interface and its NETCONF session handling of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated network attacker to obtain root-level device configuration access and take over the device via a reachable J-Web HTTP or HTTPS service when web management is enabled.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed

Vendors

Juniper Networks

Products

Junos Os Junos Os Evolved

CVE-2025-29896

NULL Pointer Dereference in qsyncsrv.cgi

A NULL pointer dereference vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to launch a denial-of-service (DoS) attack. We have already fixed the vulnerability in the following version: Qsync Central 5.0.0.4 and later

CVSS 4.0 · 2.3 Low EPSS < 1% KEV · Not listed

Vendors

Qnap Systems

Products

Qsync Central

CVE-2025-68404

vcs_pentest Race Condition Authentication Bypass Vulnerability in QuRouter management interface

A time-of-check time-of-use (toctou) race condition vulnerability has been reported to affect QuRouter. If exploited, the vulnerability could allow remote attackers to compromise the security of the system. We have already fixed the vulnerability in the following version: QuRouter 2.6.4.001 and later

CVSS 4.0 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Qnap Systems

Products

Qurouter

CVE-2026-95179

Denial of Service via Recursive Precomposition References in lottie-android

An issue in lottie-android 6.7.1 and earlier (and master) allows a remote attacker to cause a denial of service via a crafted Lottie animation JSON containing a cyclic precomposition reference graph that triggers uncontrolled recursion in BaseLayer.forModel and CompositionLayer.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-95180

Local Information Disclosure and Unauthorized Component Hijacking via Intent URI Handling in AgentWeb

An issue in Justson agentweb-core v5.1.6-androidx and earlier allows a local attacker to obtain sensitive information and launch non-exported host application components via incorrect access control in the handling of intent:// URLS in DefaultWebClient

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-96930

Windows Universal Disk Format File System Driver (UDFS) Information Disclosure Vulnerability

Out-of-bounds read in Windows Universal Disk Format File System Driver (UDFS) allows an authorized attacker to disclose information locally.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Windows 10 1607 Windows 10 1809 Windows 10 21h2 and 25 more

CVE-2026-96947

Windows Universal Disk Format File System Driver (UDFS) Elevation of Privilege Vulnerability

Use after free in Windows Universal Disk Format File System Driver (UDFS) allows an authorized attacker to elevate privileges locally.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Windows 10 1607 Windows 10 1809 Windows 10 21h2 and 25 more

CVE-2026-96948

Windows Client Side Caching driver (csc.sys) Information Disclosure Vulnerability

Exposure of sensitive information to an unauthorized actor in Windows Client Side Caching driver (csc.sys) allows an authorized attacker to disclose information locally.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Windows 10 1607 Windows 10 1809 Windows 10 21h2 and 25 more

CVE-2026-101025

NGINX ngx_http_js_module vulnerability

Description NGINX JavaScript (njs) has a vulnerability where the built-in njs engine leaks a libxml2 parser context when xml.parse() fails. The failure path did not register cleanup and the context was not released for the lifetime of the process. An unauthenticated attacker may send requests with malformed XML and can cause unbounded memory growth in long-lived NGINX worker processes. Impact This vulnerability may allow remote attackers to send requests that trigger repeated parsing of malformed XML and may lead to NGINX worker termination or denial of service. There is no control plane exposure; this is a data plane issue only.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

F5

Products

Nginx Javascript

CVE-2026-101019

NGINX ngx_http_js_module vulnerability

Description NGINX JavaScript (njs) has a vulnerability where the njs XML module exposes entity-backed XML attributes inconsistently with libxml2 canonicalization. In both the built-in njs and QuickJS backends during the canonicalization process, the $attr$Name getter may return undefined for an explicitly present attribute containing an internal entity reference. The $attrs getter may return a value derived only from the first attribute child. This may allow an unauthenticated attacker that invests significant effort in obtaining a genuinely signed document to skip validation while signature verification succeeds. An nginx-saml deployment is a confirmed affected consumer when run with the built-in njs backend. Impact In affected signed-XML consumers, an unauthenticated attacker can cause security-relevant attributes to appear absent or truncated while signature verification succeeds. In nginx-saml, this can bypass expiry, Destination, and request-correlation checks, enabling replay or acceptance of a response outside its intended context. It does not permit signature or identity forgery, or a direct availability impact. There is no control plane exposure; this is a data plane issue only.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

CVSS 4.0 · 8.3 High EPSS < 1% KEV · Not listed

Vendors

F5

Products

Nginx Javascript

CVE-2026-101960

Junos OS Evolved: QFX Series: A BGP peer causes an rpd crash when global load balancing is enabled

An Out-of-bounds Write vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS Evolved on QFX5240, QFX5241 and QFX5250 configured for BGP global-load-balancing and more than 128 ecmp next-hops allows an attacker to cause an rpd crash.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Juniper Networks

Products

Junos Os Evolved

CVE-2026-101965

Junos OS Evolved: An attacker causes telemetry disruption when network analytics telemetry is enabled

An Use of Externally-Controlled Format String vulnerability in the gRPC daemon of Juniper Networks Junos OS Evolved allows an authenticated network attacker to cause telemetry-service disruption, information disclosure, or potential root-level code execution via a crafted message to the gNMI service.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Juniper Networks

Products

Junos Os Evolved

CVE-2026-101957

Junos OS and Junos OS Evolved: A remote BGP peer causes an rpd crash when long-lived graceful restart (LLGR) is used

An Improper Initialization vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows a remote BGP peer to cause an rpd crash via an LLGR-stale route update readvertised to a configured non-LLGR peer group.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Juniper Networks

Products

Junos Os Junos Os Evolved

CVE-2026-101959

Junos OS and Junos OS Evolved: A malformed LSP-ping causes an rpd crash

A Function Call With Incorrect Variable or Reference as Argument vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated adjacent attacker to cause an rpd crash via specifically malformed LSP-ping.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Juniper Networks

Products

Junos Os Junos Os Evolved

CVE-2026-101961

Junos OS and Junos OS Evolved: A specific BGP packet causes an rpd crash when an ECMP qualifier is used in an import policy

A NULL Pointer Dereference vulnerability in the routing-policy nexthop-ECMP matcher of Juniper Networks Junos OS and Junos OS Evolved allows a configured eBGP peer to cause a routing-daemon denial of service via a specific BGP packet received while a nexthop-ecmp qualifier is attached to a BGP import policy.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Juniper Networks

Products

Junos Os Junos Os Evolved

CVE-2026-101962

Junos OS and Junos OS Evolved: An attacker sending a malformed update causes an rpd crash when BGP EVPN signaling is used

An Improper Handling of Length Parameter Inconsistency vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an attacker sending a specifically malformed BGP EVPN multicast update which is attempted to be readvertised to cause an rpd crash.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Juniper Networks

Products

Junos Os Junos Os Evolved