CVE-2026-102023 is a reachable assertion vulnerability in the fwstatsd component of Juniper Networks Junos OS Evolved. It allows an authenticated network attacker to cause a denial of service by sending a specific SNMP firewall-counter MIB query when at least one firewall counter is configured. The vulnerability has a high severity with a CVSS score of 7.5. Multiple versions of Junos OS Evolved are affected, spanning several release branches. No known exploits are reported in the wild, and the product is not a cloud service.
CVE-2026-102022 is a Reachable Assertion vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved. An attacker with access to a configured BGP-LS peer can cause the rpd process to crash by sending crafted BGP-LS Link NLRI advertisements. This results in a denial of service condition without impacting confidentiality or integrity. The vulnerability affects multiple versions of Junos OS and Junos OS Evolved as specified. The CVSS v3.1 base score is 7.5, indicating high severity.
CVE-2026-102021 is a NULL Pointer Dereference vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved. An adjacent network attacker can cause a denial of service by sending a crafted RSVP packet when MPLS-TE RSVP processing is enabled. This results in termination of the rpd process and disruption of routing protocol sessions. The vulnerability has a CVSS score of 6.5, indicating medium severity.
CVE-2026-102020 is a reachable assertion vulnerability in the rpd process of Juniper Networks Junos OS and Junos OS Evolved. An authenticated network-based attacker can exploit this flaw via BGP-LS routing updates to cause a denial of service. The vulnerability affects multiple versions of Junos OS and Junos OS Evolved as specified. The CVSS v3.1 score is 7.5, indicating high severity due to the potential for denial of service without confidentiality or integrity impact.
CVE-2026-102019 is a medium severity vulnerability in Juniper Networks Junos OS and Junos Evolved. It involves improper validation of specified quantity in input within the rpd process, allowing an unauthenticated adjacent attacker to cause a denial-of-service (DoS) condition via a malformed RIPv2 message. The vulnerability affects multiple versions of Junos OS and Junos Evolved as specified. There is no explicit vendor advisory or patch information provided in the input data. Exploits are not known to be in the wild at this time.
CVE-2026-102018 is a NULL Pointer Dereference vulnerability in the rpd process of Juniper Networks Junos OS and Junos OS Evolved. It allows an unauthenticated adjacent attacker to cause a denial-of-service (DoS) condition by sending a malformed PIM Bidir message. The vulnerability affects multiple versions of Junos OS and Junos OS Evolved prior to specific patched releases. The CVSS v3.1 base score is 6.5, indicating a medium severity impact focused on availability disruption without confidentiality or integrity impact.
CVE-2026-75085 is a medium severity vulnerability in the STM32WBA IEEE 802.15.4 driver of the Zephyr project. The driver incorrectly computes the packet length of received frames without validating that the length can accommodate the Frame Check Sequence (FCS). This leads to an underflow in the length calculation, causing an out-of-bounds read of adjacent memory when processing malformed frames. The flaw allows an attacker within radio range to influence the length value and potentially cause disclosure of adjacent RAM contents. The issue affects Zephyr versions 4.3.0 through 4.4.2. A fix involves rejecting frames with lengths smaller than the FCS and adding runtime length checks to prevent oversized frames.
CVE-2026-75084 is a vulnerability in the Zephyr project's CC1200 sub-GHz IEEE 802.15.4 driver. The driver improperly validates the PHY packet length, allowing an attacker within radio range to send a frame with an invalid length byte exceeding the IEEE 802.15.4 maximum. This leads to a buffer overflow in the network buffer pool, causing corruption and potential crashes. The flaw requires no authentication or user interaction and affects builds with CONFIG_IEEE802154_CC1200 enabled and an attached CC1200 radio.
CVE-2026-19673 is a vulnerability in the Zephyr project affecting Ethernet frame processing when VLAN is enabled on the interface. The issue arises because the ethernet_recv() function improperly validates buffer lengths when handling VLAN-tagged frames, leading to out-of-bounds reads and buffer underflows. This can cause a remote denial of service and potential information disclosure or memory corruption. Only configurations with VLAN enabled and without hardware VLAN tag stripping are affected. The vulnerability has a CVSS score of 7.1 (high severity).
CVE-2026-75083 is an integer overflow vulnerability in the NXP KW41Z IEEE 802.15.4 driver within the Zephyr project. It occurs in the kw41z_rx() function where the payload size is computed incorrectly, leading to an underflow and subsequent buffer overflow in the network buffer pool. This can cause memory corruption and likely crashes due to overwriting adjacent memory. The vulnerability is triggered by unauthenticated frames with a crafted length field sent over the air. The issue affects Zephyr versions from 1.8.0 up to but not including 4.5.0.
CVE-2026-102017 is an out-of-bounds write vulnerability in the rpd process of Juniper Networks Junos OS and Junos OS Evolved. It allows an unauthenticated attacker to cause a denial of service on the routing plane by sending crafted Auto-RP mapping announcements when Auto-RP mapping is enabled. The vulnerability affects multiple versions of Junos OS and Junos OS Evolved as specified. The CVSS v3.1 base score is 6.5, indicating a medium severity impact focused on availability disruption.
Lantronix XPress-DR and XPress-DR-I devices running firmware up to version 8.1.0.0 have a missing authentication vulnerability in their UDP configuration protocol on port 30718. This flaw allows remote attackers to read and overwrite device configuration without authentication by sending specially crafted UDP frames. The vulnerability enables attackers to change critical settings such as the device IP address and serial-channel forwarding records, with changes persisting across reboots. The product series reached end-of-life in February 2025.
CVE-2026-102016 is a high-severity vulnerability in Juniper Networks Junos OS and Junos OS Evolved affecting the rpd process. It involves improper validation of specified quantity in input related to BGP MVPN signaling updates, allowing a configured BGP MVPN peer to cause a denial of service. The vulnerability does not impact confidentiality or integrity but causes service disruption. Multiple affected version ranges are identified across Junos OS and Junos OS Evolved releases. No known exploits are reported in the wild. No patch links are provided, so patch status is not confirmed.
CVE-2026-102015 is a heap-based buffer overflow vulnerability in the secure-dot1xd process of Juniper Networks Junos OS and Junos OS Evolved. It allows an unauthenticated adjacent network attacker to execute code as root or cause a denial of service by sending a crafted EAPOL frame to an 802.1X-authenticated interface. The vulnerability affects multiple versions of Junos OS and Junos OS Evolved prior to specific patch releases. The CVSS 3.1 score is 8.8, indicating high severity.
CVE-2026-102014 is a stack-based buffer overflow vulnerability in the authd process of Juniper Networks Junos OS. An attacker who can influence a configured RADIUS server may cause the authd process to crash or execute code with root privileges by sending a malicious RADIUS response. The vulnerability affects multiple versions of Junos OS prior to specific patch releases. The CVSS score is 8.8, indicating high severity with impacts on confidentiality, integrity, and availability.
CVE-2026-102013 is a NULL Pointer Dereference vulnerability in the na-grpcd process of Juniper Networks Junos OS and Junos OS Evolved. It allows an unauthenticated attacker with access to the chassis-internal network to cause a denial of service via a crafted network message. The vulnerability affects multiple versions of Junos OS and Junos OS Evolved as specified. The CVSS score is 4.4, indicating a medium severity level. There is no indication of known exploits in the wild. The vulnerability does not impact confidentiality or integrity but causes availability disruption.
CVE-2026-102012 is a reachable assertion vulnerability in the na-grpcd process of Juniper Networks Junos OS Evolved. This flaw allows a remote unauthenticated attacker to cause a denial of service (DoS) by sending a crafted gRPC telemetry subscription request. The vulnerability affects multiple versions of Junos OS Evolved prior to specific patch releases. The CVSS 3.1 score is 7.5, indicating a high severity impact focused on availability disruption without confidentiality or integrity loss.
CVE-2026-102011 is a reachable assertion vulnerability in the rpd process of Juniper Networks Junos OS and Junos EVO. It allows an adjacent attacker to cause a denial of service by exploiting an established LDP session when two misconfigured neighbors or a duplicated neighbor advertise the same transport address on a link-protected interface. The vulnerability affects multiple versions of Junos OS and Junos EVO prior to specific patch releases. The CVSS score is 6.5, indicating a medium severity impact focused on availability disruption.
CVE-2026-102000 is a reachable assertion vulnerability in the rpd process of Juniper Networks Junos OS and Junos EVO. An adjacent unauthenticated attacker can exploit this vulnerability via LDP control traffic to cause a denial of service. The vulnerability affects multiple versions of Junos OS and Junos EVO as specified. The CVSS 3.1 base score is 6.5, indicating a medium severity impact focused on availability disruption without confidentiality or integrity impact.
CVE-2026-101999 is a reachable assertion vulnerability in the rpd process of Juniper Networks Junos OS and Junos EVO. It allows an adjacent attacker to cause a denial of service via an established LDP session carrying an IPv6 Prefix FEC in a specific Label message. The vulnerability has a medium severity with a CVSS score of 6.5 and does not impact confidentiality or integrity but affects availability.