CVE-2026-102049

A Stack-based Buffer Overflow vulnerability exists in the l2cpd process of Juniper Networks Junos OS and Junos OS Evolved . An adjacent unauthenticated attacker can exploit this by sending LLDP traffic to an interface where Unified Access Policy is enabled. Successful exploitation can lead to a d...

CVE-2026-102014 Junos OS: An attacker causes authd to crash when subscriber RADIUS authentication is used

A Stack-based Buffer Overflow vulnerability in the authd process of Juniper Networks Junos OS allows an attacker able to influence a configured RADIUS server to cause authd to crash or execute code with root privileges via a malicious RADIUS response...

EUVD-2026-101480

A Stack-based Buffer Overflow vulnerability in the routing protocol daemon rpd of Juniper Networks Junos OS and Junos OS Evolved allows a remote configured BGP peer to cause an rpd crash, or on Junos OS remote code-execution, via sending a flow-spec update which is selected for re-advertisement...

CVE-2026-101990

A Stack-based Buffer Overflow vulnerability exists in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved . A remote configured BGP peer can trigger an rpd crash or, on Junos OS, achieve remote code-execution by sending a flow-spec update that is selected for re-ad...

EUVD-2026-101470

A Stack-based Buffer Overflow vulnerability in the UTM Anti-Spam SBL of Juniper Networks Junos OS on SRX series allows an unauthenticated remote attacker to cause arbitrary code execution or a denial of service via a injected malformed DNS packet when Anti-Spam SBL inspection is enabled...

CVE-2026-101955

A Stack-based Buffer Overflow vulnerability exists in the UTM Anti-Spam SBL component of Juniper Networks Junos OS on SRX series devices. An unauthenticated remote attacker can exploit this by injecting a malformed DNS packet when Anti-Spam SBL inspection is enabled. This could result in arbitrar...

CVE-2026-101955 Junos OS: SRX Series: Malformed DNS packet causes service disruption when UTM Anti-Spam SBL is used

A Stack-based Buffer Overflow vulnerability in the UTM Anti-Spam SBL of Juniper Networks Junos OS on SRX series allows an unauthenticated remote attacker to cause arbitrary code execution or a denial of service via a injected malformed DNS packet when Anti-Spam SBL inspection is enabled...

CVE-2026-101955 Junos OS: SRX Series: Malformed DNS packet causes service disruption when UTM Anti-Spam SBL is used

A Stack-based Buffer Overflow vulnerability in the UTM Anti-Spam SBL of Juniper Networks Junos OS on SRX series allows an unauthenticated remote attacker to cause arbitrary code execution or a denial of service via a injected malformed DNS packet when Anti-Spam SBL inspection is enabled...

CVE-2026-102069 Junos OS: An ICCP peer causes dot1xd to crash when dot1x synchronization is enabled

A Stack-based Buffer Overflow vulnerability in the dot1x daemon of Juniper Networks Junos OS devices operating as Junos Fusion Aggregation Devices allows an adjacent attacker acting as the configured ICCP peer to cause a denial of service and potentially execute code as root via. The issue is...

CVE-2026-102068 Junos OS Evolved: Malformed TCP key-chain traffic causes a kernel panic when BGP or LDP key-chain authentication is used

A Stack-based Buffer Overflow vulnerability in the kernel of Juniper Networks Junos OS Evolved allows an unauthenticated remote attacker to trigger a kernel panic via a crafted TCP packet when key-chain authentication is used for BGP or LDP...

EUVD-2026-101429

A Stack-based Buffer Overflow vulnerability in the kernel of Juniper Networks Junos OS Evolved allows an unauthenticated remote attacker to trigger a kernel panic via a crafted TCP packet when key-chain authentication is used for BGP or LDP...

CVE-2026-110606

LibreCAD libdxfrw through LC2.2.0 LibreCAD through 2.2.1.5 contains a stack-based out-of-bounds read vulnerability in dwgReader18::readFileHeader caused by calling strlen on non-NUL-terminated buffers. Attackers can supply a crafted AC1018, AC1024 or AC1027 DWG file without NUL bytes in the...

CVE-2026-110606

LibreCAD libdxfrw through LC2.2.0 LibreCAD through 2.2.1.5 contains a stack-based out-of-bounds read vulnerability in dwgReader18::readFileHeader caused by calling strlen on non-NUL-terminated buffers. Attackers can supply a crafted AC1018, AC1024 or AC1027 DWG file without NUL bytes in the...

EUVD-2026-101234

LibreCAD libdxfrw through LC2.2.0 LibreCAD through 2.2.1.5 contains a stack-based out-of-bounds read vulnerability in dwgReader18::readFileHeader caused by calling strlen on non-NUL-terminated buffers. Attackers can supply a crafted AC1018, AC1024 or AC1027 DWG file without NUL bytes in the...

CVE-2026-101339

A flaw was found in NSD. When parsing directly supplied zone files, a specially crafted Host Identity Protocol HIP resource record can cause a stack-based buffer overflow. An attacker capable of provisioning or feeding zone files into the server can exploit this vulnerability to execute arbitrary...

CVE-2026-101337

A flaw was found in NSD Name Server Daemon. When parsing DNS zone files containing base64-encoded data formatted in segments of three characters or fewer, NSD incorrectly calculates token sizes, resulting in a stack-based buffer overflow. An attacker who can supply or manipulate a zone file loade...

CVE-2026-101341

A flaw was found in NSD. When parsing directly supplied Domain Name System DNS zone files, NSD fails to properly validate the length of text tokens within resource record data. An attacker able to provide a specially crafted zone file can trigger a stack-based buffer overflow, potentially leading...

CVE-2026-101338

A flaw was found in NSD. When processing zone files containing specially formatted Service Binding SVCB or HTTPS resource records, the base64 decoding routine can exceed memory limits and cause a stack-based buffer overflow. An attacker capable of provisioning or supplying crafted zone files...

SUSE CVE-2026-109940

FreeRDP 3.0.0-beta1 before 3.32.0 on Unix builds with PKCS11 support has a stack-based buffer overflow in wprintKeyName in WinPR's NCrypt PKCS11 provider. It hex-encodes a key's CKAID, which can be up to 64 bytes, into a fixed 128-byte stack buffer. An attacker supplying a malicious PKCS11 token ...

PT-2026-114198

🚨 CVE-2026-33798 A Stack-based Buffer Overflow vulnerability in the srxpfe of Juniper Networks Junos OS and Junos OS Evolved on the SRX Series allows an L2-adjacent attacker to execute arbitrary code as root via high-availability fabric traffic. 🎖@cveNotify...