CVE-2026-101939

A NULL Pointer Dereference vulnerability exists in the routing protocol daemon (RPD) of Juniper Networks Junos OS and Junos OS Evolved . The issue occurs when a configured peer sends a BGP UPDATE message while an import policy—specifically using then source-based-forwarding next-hop next-table —r...

EUVD-2026-101482

A NULL Pointer Dereference vulnerability in the routing protocol daemon rpd of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated adjacent attacker to cause a denial of service via LDP messages received over an operational LDP session...

CVE-2026-101988 Junos OS and Junos OS Evolved: An unauthenticated adjacent attacker causes an rpd crash when LDP is enabled

A NULL Pointer Dereference vulnerability in the routing protocol daemon rpd of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated adjacent attacker to cause a denial of service via LDP messages received over an operational LDP session...

CVE-2026-101988

A NULL Pointer Dereference vulnerability exists in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved . An unauthenticated adjacent attacker can cause a denial of service by sending specific LDP messages over an active LDP session. No specific exploit details or r...

CVE-2026-102086 Junos OS: SRX Series: Multiple DNS queries processed by SecIntel and DGA in the same session cause a flowd crash

A NULL Pointer Dereference vulnerability in the DNS plugin of Juniper Networks Junos OS on SRX Series allows an unauthenticated, network-based attacker to cause a complete Denial-of-Service DoS. When multiple DNS queries are received in a single flow session, where one query matches a Security...

EUVD-2026-101455

A NULL Pointer Dereference vulnerability in the DNS plugin of Juniper Networks Junos OS on SRX Series allows an unauthenticated, network-based attacker to cause a complete Denial-of-Service DoS. When multiple DNS queries are received in a single flow session, where one query matches a Security...

CVE-2026-102086

A NULL Pointer Dereference vulnerability exists in the DNS plugin of Juniper Networks Junos OS on SRX Series devices. The flaw occurs when multiple DNS queries in a single flow session involve both Security Intelligence (SecIntel) feeds and DNS Domain Generation Algorithm (DGA) analysis; an error...

CVE-2026-101948

A NULL Pointer Dereference vulnerability exists in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved . A remote unauthenticated BGP peer can trigger a denial of service (DoS) by sending a specific BGP FlowSpec update received by an affected BGP session when a BGP...

CVE-2026-101948 Junos OS and Junos OS Evolved: A specific BGP FlowSpec update causes an rpd crash when BGP FlowSpec import policy is used

A NULL Pointer Dereference vulnerability in the routing protocol daemon rpd of Juniper Networks Junos OS and Junos OS Evolved allows a remote unauthenticated BGP peer to cause a denial of service via a specific BGP FlowSpec update received by an affected BGP session...

CVE-2026-101977 Junos OS and Junos OS Evolved: A specific BGP packet causes an rpd crash when ephemeral configuration is used

A NULL Pointer Dereference vulnerability in the routing protocol daemon rpd of Juniper Networks Junos OS and Junos OS Evolved allows a configured eBGP peer to cause a persistent routing-daemon denial of service via a specific BGP packet when ephemeral configuration is used...

CVE-2026-101977

A NULL Pointer Dereference vulnerability exists in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved . When ephemeral configuration is utilized, a configured eBGP peer can trigger a persistent routing-daemon denial of service by sending a specific BGP packet. Tec...

EUVD-2026-101442

A NULL Pointer Dereference vulnerability in the routing protocol daemon rpd of Juniper Networks Junos OS and Junos OS Evolved allows a configured eBGP peer to cause a persistent routing-daemon denial of service via a specific BGP packet when ephemeral configuration is used...

CVE-2026-110659

ELFIO through 3.12 contains a NULL pointer dereference vulnerability in relocationsectionaccessor getentry that allows attackers to crash applications via an unvalidated shlink index. Attackers can supply a crafted ELF file whose SHTREL or SHTRELA section has a dangling shlink, causing...

EUVD-2026-101436

A NULL Pointer Dereference vulnerability in the pkid component of Juniper Networks Junos OS allows an unauthenticated remote attacker to cause a denial of service via a malformed packet received during CMP enrollment or automatic certificate re-enrollment...

CVE-2026-109438 3proxy 0.9.7 - 1.0.1 Uninitialized Stack Memory Disclosure via SOCKS4

3proxy from 0.9.7 through 1.0.1, fixed in commit 206c923, contains an uninitialized stack memory disclosure vulnerability that allows unauthenticated attackers to leak stack bytes via the SOCKS4 reply path when the external-NAT option -Ne is configured. Attackers can send a client probe that fail...

CVE-2026-86847

A flaw was found in DPDK lib/vhost vhost-crypto. Write-back chain cleanup can follow an uninitialized next pointer when mapping a guest descriptor fails, causing the host vhost-crypto process to hang or crash. Mitigation Do not attach a virtio-crypto vhost-user backend to untrusted guests...

CVE-2026-100394

Nezha Monitoring versions 2.2.7 through 2.2.11 are vulnerable to a nil pointer dereference in service/singleton/servicesentinel.go. The issue occurs when ServiceSentinel.worker accesses serviceStatusToday and serviceCurrentStatusData without revalidating if they were removed by ServiceSentinel.De...

CVE-2026-100394 Nezha Monitoring: Whole-instance DoS in Nezha dashboard: a member can crash the process for every tenant

Nezha Monitoring is a self-hostable, lightweight, servers and websites monitoring and O&M tool. From 2.2.7 until 2.2.11, ServiceSentinel.worker in service/singleton/servicesentinel.go checked an owned service under servicesLock and later dereferenced pointer-valued serviceStatusToday and...

AZL-108330 CVE-2026-110602 affecting package clamav 1.5.4-2

libmspack through 0.11alpha contains an uninitialized pointer free vulnerability in kwajdopen in mspack/kwajd.c that frees unzeroed filename and extra pointers on header read errors. Attackers can supply a truncated, empty, or wrong-signature KWAJ file to crash the process or obtain an...

AZL-108393 CVE-2026-110602 affecting package libmspack 0.11alpha-1

libmspack through 0.11alpha contains an uninitialized pointer free vulnerability in kwajdopen in mspack/kwajd.c that frees unzeroed filename and extra pointers on header read errors. Attackers can supply a truncated, empty, or wrong-signature KWAJ file to crash the process or obtain an...