CVE-2026-101974

An Improper Validation of Specified Quantity in Input vulnerability exists in the rpd component of Juniper Networks Junos OS and Junos OS Evolved . When link-local TE processing is used, an adjacent OSPF peer can send malformed OSPF packets to cause a rpd crash (service disruption) or lead to rpd...

CVE-2026-101995

The l2ald daemon in Juniper Networks Junos OS and Junos OS Evolved is vulnerable to an Improper Validation of Specified Quantity in Input vulnerability (CWE-1284 ). An adjacent attacker with access to an ICCP peer session can exploit this by sending malformed ICCP packets , resulting in memory di...

CVE-2026-101995 Junos OS and Junos OS Evolved: Malformed ICCP packets cause l2ald memory disclosure and disruption

An Improper Validation of Specified Quantity in Input vulnerability in the l2ald of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent attacker with access to an ICCP peer session to cause memory disclosure and disruption of the l2ald daemon via malformed ICCP packets...

EUVD-2026-101444

An Improper Validation of Specified Quantity in Input vulnerability in the l2ald of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent attacker with access to an ICCP peer session to cause memory disclosure and disruption of the l2ald daemon via malformed ICCP packets...

EUVD-2026-101437

A Reachable Assertion vulnerability in the Two-Way Active Measurement Protocol TWAMP client of Juniper Networks Junos OS allows an unauthenticated network-based attacker to cause rmopd service disruption via a specific TCP packet...

CVE-2026-101965

A Use of Externally-Controlled Format String vulnerability exists in the gRPC daemon of Juniper Networks Junos OS Evolved . An authenticated network attacker can send a crafted message to the gNMI service to trigger this flaw when network analytics telemetry is enabled. Potential impacts include ...

CVE-2026-101965 Junos OS Evolved: An attacker causes telemetry disruption when network analytics telemetry is enabled

An Use of Externally-Controlled Format String vulnerability in the gRPC daemon of Juniper Networks Junos OS Evolved allows an authenticated network attacker to cause telemetry-service disruption, information disclosure, or potential root-level code execution via a crafted message to the gNMI...

EUVD-2026-101432

An Use of Externally-Controlled Format String vulnerability in the gRPC daemon of Juniper Networks Junos OS Evolved allows an authenticated network attacker to cause telemetry-service disruption, information disclosure, or potential root-level code execution via a crafted message to the gNMI...

CVE-2026-102985: Missing Authorization

Plane is an open-source project management tool. In 1.3.1 and earlier, ProjectMemberViewSet.partialupdate places its authorization checks inside the role update branch, so a guest or member can omit role and change another ProjectMember record's isactive field, including deactivating a project...

CVE-2026-101946: Out-of-bounds Read

An Out-of-bounds Read vulnerability in the rpd process of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent low-privilege attacker to disclose limited rpd process memory and disrupt an LDP adjacency via an IPv6 LDP message...

CVE-2026-92908

Adobe Commerce is affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and gain unauthorized read and write access, causing a limited disruption to availability...

EUVD-2026-99213

Adobe Commerce is affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and gain unauthorized read and write access, causing a limited disruption to availability...

CVE-2026-92908

Adobe Commerce is affected by an Incorrect Authorization vulnerability (CWE-863) that enables a Security feature bypass . A low-privileged attacker can exploit this issue without user interaction to gain unauthorized read and write access , which may result in a limited disruption to availability...

CVE-2026-93204

A flaw was found in the batman-adv component of the Linux kernel. When a Media Access Control MAC address is updated, the update is not performed atomically. This allows a parallel process to read a partially updated MAC address, which could then be used to poison the Address Resolution Protocol...

CVE-2026-53709

MCP Context Forge is an MCP gateway and administrative platform. Prior to 1.0.2, mcpgateway/config.py and .env.example ship a known JWTSECRETKEY, while verifyjwttoken accepts HS256 tokens signed with that key and getcurrentuser creates a platform administrator when the token subject matches...

CVE-2026-110125: Authorization Bypass Through User-Controlled Key

Waynboot-mall through 2.0.0 contains an insecure direct object reference vulnerability that allows authenticated members to access and modify other members' orders by supplying their order identifiers. Attackers can enumerate sequential order ids or serial numbers via detail, cancel, confirm,...

PT-2026-111872

🚨 CVE-2026-92908 Adobe Commerce is affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and gain unauthorized read and write access, causing a limited disruption...

PT-2026-111628

Name of the Vulnerable Software and Affected Versions MCP Context Forge versions prior to 1.0.2 Description An issue exists where the software ships with a known JWT SECRET KEY in mcpgateway/config.py and .env.example. The verify jwt token function accepts HS256 tokens signed with this key, and t...

Missing Release of Memory after Effective Lifetime

Overview Magick.NET-Q16-arm64 is a Magick.NET allows you can use ImageMagick without having to install ImageMagick on your server or desktop. More information about specific builds see the official docs https://github.com/dlemstra/Magick.NET/tree/main/docs Affected versions of this package are...

Missing Release of Memory after Effective Lifetime

Overview Magick.NET-Q16-HDRI-OpenMP-x64 is a Magick.NET allows you can use ImageMagick without having to install ImageMagick on your server or desktop. More information about specific builds see the official docs https://github.com/dlemstra/Magick.NET/tree/main/docs Affected versions of this...