NI vulnerabilities and threats

CVE-2026-101960 is an out-of-bounds write vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS Evolved. It affects specific QFX series devices configured for BGP global-load-balancing with more than 128 ECMP next-hops. Exploitation can cause the rpd process to crash, resulting in denial of service. The vulnerability has a CVSS score of 6.5, indicating medium severity. No known exploits are reported in the wild. Affected versions span multiple releases prior to certain fixed builds as specified by Juniper.

CVE-2026-101978 is an OS Command Injection vulnerability in the bootzd zero-touch provisioning daemon of Juniper Networks Junos OS Evolved on PTX Series devices. It allows an unauthenticated attacker on the management LAN to execute arbitrary commands as root via a crafted gRPC response. The vulnerability affects multiple specific versions of Junos OS Evolved. The CVSS score is 8.8, indicating high severity with impacts on confidentiality, integrity, and availability.

CVE-2026-101985 is a medium severity vulnerability in Juniper Networks Junos OS Evolved on PTX Series devices. It involves improper validation of specified quantity in input within the routing protocol daemon (rpd). An unauthenticated IS-IS peer can exploit this flaw to cause a denial of service (DoS) condition. The vulnerability does not impact confidentiality or integrity but affects availability. Multiple specific versions of Junos OS Evolved are affected. No explicit patch or remediation details are provided in the available data.

CVE-2026-101966 is a Use of Externally-Controlled Format String vulnerability in the jti-dialoutd component of Juniper Networks Junos OS Evolved. It allows an authenticated network attacker to cause a persistent denial of service affecting telemetry dial-out by submitting a crafted analytics sensor resource through the gNMI listener. The vulnerability has a high severity with a CVSS score of 8.2. Multiple versions of Junos OS Evolved are affected, including specific ranges in 23.x, 25.x, and 26.x releases.

OmniFaces versions prior to 1.14.3, 2.7.33, 3.14.23, 4.7.12, and 5.4.2 contain a vulnerability in CombinedResourceHandler where it accepts a structurally valid deflated and base64 encoded combined resource ID without verifying its authenticity. This allows attackers to forge IDs that can cause unbounded decoded output, memory exhaustion, and limited disclosure of Facelets source files. Additionally, in certain configurations, a forged ID can trigger a blind server-side fetch influenced by the request Host header. The issue is fixed in the stated versions.

CVE-2026-110656 is a low-severity vulnerability in the miniupnpc library up to version 2.3.3. It is caused by a one-byte heap out-of-bounds read in the minixml parseelt function due to improper handling of namespace prefixes when encountering a colon character ':'. A malicious or spoofed UPnP gateway on the local network can exploit this by sending crafted device descriptions or SOAP replies with element names ending in ':', causing the client to crash.

CVE-2026-110655 is a low-severity vulnerability in miniupnpc versions up to 2.3.3 where a one-byte heap out-of-bounds read occurs in the minixml parseatt function. This flaw allows a malicious UPnP gateway on the local network to cause the client to read past buffer boundaries via crafted device description or SOAP response messages ending with '='. Exploitation can lead to client crashes but does not escalate to code execution or data corruption.

CVE-2026-110649 is a critical OS command injection vulnerability in shahkashani stills versions before 25.24.2. It allows attackers to execute arbitrary shell commands by crafting media file paths containing special shell elements such as $(...) or backticks. This occurs when the application invokes external tools like ffmpeg, ffprobe, gifsicle, or convert with these crafted paths, running commands with Node.js process privileges.

CVE-2026-107433 is a missing authorization vulnerability in the miniOrange WP OAuth Server plugin for WordPress. It affects versions from initial release up to 6.4.0. The flaw allows exploitation of incorrectly configured access control security levels, potentially leading to limited integrity and availability impacts. The vulnerability has a CVSS 3.1 base score of 6.5 (medium severity). No official patch or remediation information is provided in the available data.

Koha Community's Koha software is affected by a SQL injection vulnerability in the Most-circulated items report. The vulnerability arises from unsafe concatenation of user-controlled parameters into SQL queries without proper validation or sanitization. Authenticated staff users with reports module permission can exploit this to execute arbitrary SQL commands and access sensitive database information. The issue is fixed in Koha versions 24.11.19, 25.05.14, 25.11.08, and 26.05.03.

Koha Community's Koha software contains an OS command injection vulnerability in its Task Scheduler deletion functionality. Authenticated staff users with schedule task permissions can exploit this by injecting shell metacharacters in the jobid parameter, leading to arbitrary command execution as the application user. This vulnerability is fixed in Koha versions 24.11.20, 25.05.15, 25.11.09, 26.05.04, and the 26.11 development branch.

Nix versions before 2.35.3, when run unsandboxed on macOS or FreeBSD, have an incorrect authorization vulnerability that allows build users to make unauthorized connections from daemon clients. This issue is tracked as CVE-2026-110453 and is classified under CWE-863 (Incorrect Authorization). The vulnerability has a medium severity with a CVSS score of 4.3.

CVE-2026-110452 is a medium severity vulnerability in NixOS Nix affecting multiple versions before 2.35.3. The multi-user installer incorrectly assigns ownership of store contents to the invoking user instead of root, potentially leading to improper access control.

CVE-2026-110451 is a medium severity vulnerability in NixOS Nix affecting multiple versions before 2.35.3. It involves an incorrect authorization issue (CWE-863) that allows a Seatbelt sandbox escape on macOS when an unconfined build is used due to mishandling of a size threshold.

NixOS Nix versions before 2.35.3 contain a vulnerability that allows privilege escalation during a repair operation. This occurs because the repair process may destroy and then replace a store path before verifying its content, leading to incorrect behavior order. The issue affects multiple version ranges prior to 2.35.3.

CVE-2026-110449 is an integer overflow vulnerability in NixOS Nix affecting multiple versions prior to 2.35.3. The flaw occurs due to mishandling of list allocation when evaluating untrusted expressions, leading to an out-of-bounds write. This vulnerability can cause integrity impact and limited availability impact but does not affect confidentiality.

CVE-2026-63171 is a stored cross-site scripting (XSS) vulnerability in Omnispace Agora Project versions before 26.10.0. Authenticated attackers can inject malicious scripts by submitting a specially crafted forum category description containing a double-quote character. This input breaks out of an HTML input value attribute due to the HTMLPurifier configuration preserving double-quotes, allowing script execution in users' browsers who view the affected forum category.

CVE-2026-63169 is a stored cross-site scripting (XSS) vulnerability in Omnispace Agora Project versions before 26.10.0. Authenticated users can post messages containing attacker-controlled iframes via the messenger's HTMLPurifier SafeIframe branch. These malicious iframes are stored and rendered to other channel members, enabling zero-click drive-by downloads and execution of framed JavaScript in recipients' browsers.

CVE-2026-63168 is a stored cross-site scripting (XSS) vulnerability in Omnispace Agora Project versions before 26.10.0. Authenticated attackers can exploit this flaw by submitting malicious script code via two-dimensional POST arrays during the LDAP/person import process. The vulnerability arises because the paramsFilter() function does not properly recurse into nested arrays, allowing unneutralized markup to be persisted in user profiles. This malicious script can then execute in other users' browsers when the profile is viewed.

CVE-2026-63157 is a stored cross-site scripting (XSS) vulnerability in Omnispace Agora Project versions before 26.10.0. Authenticated users can inject malicious scripts via an unsanitized 'adress' field in the Links module, which is reflected in an onclick event-handler attribute without proper neutralization of quotes. This vulnerability allows execution of arbitrary scripts in the browsers of users viewing the links list, potentially leading to session hijacking or client-side compromise.