CWE-476: NULL Pointer Dereference vulnerabilities

CVE-2025-29896 is a NULL pointer dereference vulnerability in QNAP Systems Inc.'s Qsync Central. A remote attacker with a user account can exploit this flaw to cause a denial-of-service (DoS) condition. The vulnerability has been fixed in Qsync Central version 5.0.0.4 and later. The CVSS 4.0 base score is 2.3, indicating low severity.

CVE-2025-29895 is a NULL pointer dereference vulnerability in QNAP Systems Inc.'s Qsync Central. A remote attacker with a user account can exploit this flaw to cause a denial-of-service (DoS) condition. The vulnerability is fixed in Qsync Central version 5.0.0.4 and later. The CVSS 4.0 base score is 2.3, indicating low severity.

CVE-2026-101949 is a NULL Pointer Dereference vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved. An unauthenticated remote BGP neighbor can trigger a denial of service by sending a VPN-flowspec BGP update that is readvertised when BMP post-policy RIB-out monitoring is enabled. This vulnerability affects multiple versions of Junos OS and Junos OS Evolved as specified. The CVSS 3.1 base score is 7.5, indicating high severity due to the potential for denial of service without requiring authentication.

CVE-2026-101961 is a NULL Pointer Dereference vulnerability in the routing-policy nexthop-ECMP matcher of Juniper Networks Junos OS and Junos OS Evolved. It allows a configured eBGP peer to cause a denial of service of the routing daemon by sending a specific BGP packet when a nexthop-ecmp qualifier is attached to a BGP import policy. This vulnerability has a high severity score of 7.5 and impacts multiple versions of Junos OS and Junos OS Evolved.

CVE-2026-102060 is a NULL Pointer Dereference vulnerability in the rpd process of Juniper Networks Junos OS on MX Series and Junos OS Evolved on ACX Series. An unauthenticated adjacent attacker can cause a denial of service by sending an IGMPv3 membership report on a directly connected network. The vulnerability affects multiple versions of Junos OS and Junos OS Evolved as specified. The CVSS score is 6.5 (medium severity) with no confidentiality or integrity impact, only availability impact.

CVE-2026-102040 is a NULL Pointer Dereference vulnerability in the rpd routing daemon of Juniper Networks Junos OS and Junos OS Evolved. An adjacent unauthenticated attacker can exploit this flaw by sending a crafted RSVP Path message to crash the routing daemon, resulting in a denial of service condition. The vulnerability has a CVSS score of 6.5, indicating medium severity. It affects multiple versions of Junos OS and Junos OS Evolved prior to specific fixed releases. No known exploits are reported in the wild, and Juniper has not provided explicit patch links in the available data.

CVE-2026-102039 is a NULL Pointer Dereference vulnerability in the rpd process of Juniper Networks Junos OS and Junos OS Evolved. An adjacent attacker can cause a denial of service by sending a malformed RSVP Path message on an EVPL LMP control channel. The vulnerability affects multiple versions of Junos OS and Junos OS Evolved prior to specific patch releases. The CVSS score is 6.5 (medium severity) with no confidentiality or integrity impact, only availability impact.

CVE-2026-102029 is a NULL Pointer Dereference vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved. It allows an unauthenticated configured MSDP peer or adjacent PIM sender to cause a denial of service via an MSDP or PIM policy that uses AS-path expansion. The vulnerability has a high severity with a CVSS score of 7.5 and affects multiple versions of Junos OS and Junos OS Evolved prior to specific fixed releases.

CVE-2026-102028 is a NULL Pointer Dereference vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved. It allows a remote BGP peer to cause a denial of service when multiple UPDATE messages occur over a single TCP session with 'bgp family l2vpn auto-discovery-only' configured. The vulnerability has a high severity rating with a CVSS score of 7.5.

CVE-2026-102021 is a NULL Pointer Dereference vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved. An adjacent network attacker can cause a denial of service by sending a crafted RSVP packet when MPLS-TE RSVP processing is enabled. This results in termination of the rpd process and disruption of routing protocol sessions. The vulnerability has a CVSS score of 6.5, indicating medium severity.

CVE-2026-102018 is a NULL Pointer Dereference vulnerability in the rpd process of Juniper Networks Junos OS and Junos OS Evolved. It allows an unauthenticated adjacent attacker to cause a denial-of-service (DoS) condition by sending a malformed PIM Bidir message. The vulnerability affects multiple versions of Junos OS and Junos OS Evolved prior to specific patched releases. The CVSS v3.1 base score is 6.5, indicating a medium severity impact focused on availability disruption without confidentiality or integrity impact.

CVE-2026-102013 is a NULL Pointer Dereference vulnerability in the na-grpcd process of Juniper Networks Junos OS and Junos OS Evolved. It allows an unauthenticated attacker with access to the chassis-internal network to cause a denial of service via a crafted network message. The vulnerability affects multiple versions of Junos OS and Junos OS Evolved as specified. The CVSS score is 4.4, indicating a medium severity level. There is no indication of known exploits in the wild. The vulnerability does not impact confidentiality or integrity but causes availability disruption.

CVE-2026-101941 is a NULL Pointer Dereference vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved. It allows a configured BGP neighbor to cause a denial of service via a BGP route update when specific routing-policy resolution-map and policy event-tracing configuration is enabled. The vulnerability affects multiple versions of Junos OS and Junos OS Evolved as specified. The CVSS score is 7.5, indicating high severity due to the potential for denial of service without requiring privileges or user interaction.

CVE-2026-101940 is a NULL Pointer Dereference vulnerability in the rpd routing daemon of Juniper Networks Junos OS and Junos OS Evolved. It allows an unauthenticated configured BGP peer to cause a denial of service via a BGP UPDATE when ISO-VPN and egress-protection configuration is enabled. The vulnerability has a high severity score of 7.5 and affects multiple versions of Junos OS and Junos OS Evolved prior to specific patch releases. No known exploits are reported in the wild, and no official patch links are provided in the input data.

CVE-2026-101939 is a NULL Pointer Dereference vulnerability in the routing protocol daemon (RPD) of Juniper Networks Junos OS and Junos OS Evolved. It occurs when a configured BGP peer sends an UPDATE that triggers an import policy referencing a non-existent routing table via 'then source-based-forwarding next-hop next-table <X>'. This causes a denial of service by crashing the RPD process. The vulnerability has a high severity with a CVSS score of 7.5. Multiple versions of Junos OS and Junos OS Evolved are affected. There is no explicit patch link provided in the data, so patch status is not yet confirmed. No known exploits in the wild have been reported.

CVE-2026-101988 is a NULL Pointer Dereference vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved. An unauthenticated adjacent attacker can exploit this vulnerability by sending LDP messages over an operational LDP session, causing a denial of service. The vulnerability affects multiple specific versions of Junos OS and Junos OS Evolved. The CVSS v3.1 base score is 6.5, indicating medium severity. There is no indication of known exploits in the wild or vendor-provided patch links in the provided data.

CVE-2026-102086 is a NULL Pointer Dereference vulnerability in the DNS plugin of Juniper Networks Junos OS on SRX Series devices. It allows an unauthenticated, network-based attacker to cause a complete Denial-of-Service (DoS) by triggering an FPC crash. The issue occurs when multiple DNS queries in a single flow session involve both a Security Intelligence feed match and a DNS Domain Generation Algorithm analysis, leading to an error in asynchronous logging. This vulnerability affects multiple versions of Junos OS prior to specific fixed releases.

CVE-2026-101948 is a NULL Pointer Dereference vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved. It allows a remote unauthenticated BGP peer to cause a denial of service by sending a specific BGP FlowSpec update to an affected BGP session. The vulnerability affects multiple versions of Junos OS and Junos OS Evolved as specified. The CVSS score is 7.5, indicating a high severity denial of service impact without confidentiality or integrity loss.

CVE-2026-101977 is a NULL Pointer Dereference vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved. It allows a configured eBGP peer to cause a persistent denial of service of the routing daemon by sending a specific BGP packet when ephemeral configuration is used. This vulnerability results in a high severity denial of service condition without impacting confidentiality or integrity.

CVE-2026-101973 is a high-severity NULL Pointer Dereference vulnerability in the pkid component of Juniper Networks Junos OS. It allows an unauthenticated remote attacker to cause a denial of service by sending a malformed packet during CMP enrollment or automatic certificate re-enrollment. The vulnerability affects multiple versions of Junos OS prior to specific patch releases. No known exploits are reported in the wild at this time.