Vulnerabilities
All
My stack
Known exploited
Public exploit
Critical (9+)
Likely exploited (EPSS ≥ 50%)
Changed, 24 h
New, 24 h
Sort:
risk
modified
published
CVSS
EPSS
| CVE | CVSS | EPSS | Vendor, product | Description | Modified |
|---|---|---|---|---|---|
| CVE-2015-5477KEVexploit ×10 | 7.5 high | 100.0% | juniper, fedoraproject, junos, fedora, enterprise_linux | named in ISC BIND 9.x before 9.9.7-P2 and 9.10.x before 9.10.2-P3 allows remote attackers to cause a denial of service (REQUIRE assertion failure and daemon exit) via TKEY queries. | 9 Oct |
| CVE-2004-0230exploit ×7 | 5.0 medium | 80.0% | juniper, microsoft, junos, windows_2000, windows_98 | TCP, when using a large Window Size, makes it easier for remote attackers to guess sequence numbers and cause a denial of service (connection loss) to persistent TCP connections by repeatedly injecting a TCP RST packet, especially in protocols that use long-lived connections, such as BGP. | 9 Oct |
| CVE-2026-101967 | 9.3 critical | 4.0% | no CPE yet | An OS Command Injection vulnerability in the bootzd zero-touch provisioning daemon of Juniper Networks Junos OS Evolved allows an unauthenticated attacker on the management LAN to execute commands as root via crafted DHCP response. | 15 Oct |
| CVE-2026-102059 | 8.7 high | 4.0% | no CPE yet | An Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in the phone-home daemon (phcd) of Juniper Networks Junos OS and Junos OS Evolved on EX Series, SRX Series, and QFX Series allows an adjacent unauthenticated attacker to execute arbitrary commands with root privileges via a rogue DHCP server. | 16 Oct |
| CVE-2026-101978 | 8.7 high | 4.0% | no CPE yet | An OS Command Injection vulnerability in the bootzd zero-touch provisioning daemon of Juniper Networks Junos OS Evolved on PTX Series allows an unauthenticated attacker on the management LAN to execute commands as root via a crafted gRPC response. | 16 Oct |
| CVE-2026-102031 | 9.3 critical | 2.0% | no CPE yet | An OS Command Injection vulnerability in TACACS of Juniper Networks Junos OS Evolved allows a low-privileged TACACS+-authenticated user to execute commands with root privileges when periodic TACACS+ authorization-refresh is enabled. | 16 Oct |
| CVE-2026-21915 | 8.4 high | 2.0% | juniper, virtual_lightweight_collector | A Permissive List of Allowed Input vulnerability in the CLI of Juniper Networks Support Insights (JSI) Virtual Lightweight Collector (vLWC) allows a local, high privileged attacker to escalate their privileges to root. The CLI menu accepts input without carefully validating it, which allows for shell command injection. These shell commands are executed with root permissions and can be used to gain complete control of the system. This issue affects all JSI vLWC versions before 3.0.94. | Mon 26 Oct |
| CVE-2025-59978 | 9.4 critical | 1.0% | juniper, junos_space | An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Juniper Networks Junos Space allows an attacker to store script tags directly in web pages that, when viewed by another user, enable the attacker to execute commands with the target's administrative permissions. This issue affects all versions of Junos Space before 24.1R4. | 8 Oct |
| CVE-2026-102175 | 9.3 critical | 1.0% | no CPE yet | A Heap-based Buffer Overflow vulnerability in the sdxd service-deployment daemon of Juniper Networks Junos OS and Junos OS Evolved allows a remote unauthenticated attacker who can control or intercept the configured SDX/SRC server connection to execute code as root or cause denial of service via a crafted frame received over the service-deployment TCP connection. | 16 Oct |
| CVE-2026-101990 | 9.3 critical | 1.0% | no CPE yet | A Stack-based Buffer Overflow vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows a remote configured BGP peer to cause an rpd crash, or on Junos OS remote code-execution, via sending a flow-spec update which is selected for re-advertisement. | 16 Oct |
| CVE-2026-101982 | 9.3 critical | 1.0% | no CPE yet | A Stack-based Buffer Overflow vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows a configured BGP/EVPN peer to cause root code execution on Junos OS or an rpd crash on Junos OS Evolved via protocol-valid route advertisements for an EVPN-VPWS service. | 16 Oct |
| CVE-2026-101956 | 9.3 critical | 1.0% | no CPE yet | An Improper Authentication vulnerability in the J-Web web management component of Juniper Networks Junos OS allows an unauthenticated remote attacker to execute arbitrary Junos commands with root privileges via the exposed J-Web web interface. | 15 Oct |
| CVE-2026-101986 | 9.3 critical | 1.0% | no CPE yet | An Improper Authentication vulnerability in J-Web of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated network attacker to bypass J-Web authentication and execute CGI content with elevated privileges via a crafted HTTP request. | 15 Oct |
| CVE-2026-33792 | 9.3 critical | 1.0% | no CPE yet | A Stack-based Buffer Overflow vulnerability in the srxpfe process of Juniper Networks Junos OS on SRX Series allows an unauthenticated network attacker to execute code as root or cause a denial of service via a crafted packet received on a configured GRE tunnel. | 15 Oct |
| CVE-2026-33796 | 9.3 critical | 1.0% | no CPE yet | A Stack-based Buffer Overflow vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows a configured external BGP neighbor to execute arbitrary commands with root privileges via BMP route monitoring. | 15 Oct |
| CVE-2026-101983 | 9.3 critical | 1.0% | no CPE yet | A Stack-based Buffer Overflow vulnerability in the httpd process of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated network attacker to cause remote code execution and denial of service via a J-Web virtual-domain configured. | 15 Oct |
| CVE-2026-101955 | 9.2 critical | 1.0% | no CPE yet | A Stack-based Buffer Overflow vulnerability in the UTM Anti-Spam SBL of Juniper Networks Junos OS on SRX series allows an unauthenticated remote attacker to cause arbitrary code execution or a denial of service via a injected malformed DNS packet when Anti-Spam SBL inspection is enabled. | 16 Oct |
| CVE-2026-102068 | 9.2 critical | 1.0% | no CPE yet | A Stack-based Buffer Overflow vulnerability in the kernel of Juniper Networks Junos OS Evolved allows an unauthenticated remote attacker to trigger a kernel panic via a crafted TCP packet when key-chain authentication is used for BGP or LDP. | 15 Oct |
| CVE-2026-102084 | 9.2 critical | 1.0% | no CPE yet | An Improper Validation of Syntactic Correctness of Input vulnerability in the VPN daemon of Juniper Networks Junos OS on SRX Series allows an authenticated, network-based attacker to take complete control of the device. If an SRX device configured for AutoDiscovery VPN (ADVPN) receives a message from a peer that contains one or more specifically malformed attributes, this will cause a buffer overflow, which can allow remote code execution and therefore allow an attacker to take complete control of the device. To be able to carry out this attack an attacker must either have acquired the shared secret to impersonate a peer or have compromised an existing one, so this attack is considerably difficult. This issue affects Junos OS on SRX Series: * All versions before 23.2R2-S7.7; * from 23.4 before 23.4R2-S7; * from 24.2 before 24.2R2-S4; * from 24.4 before 24.4R2-S3; * from 25.2 before 25.2R2; * from 25.4 before 25.4R1-S3. | 15 Oct |
| CVE-2026-33789 | 9.2 critical | 1.0% | no CPE yet | A Stack-based Buffer Overflow vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated BGP peer to cause a denial of service and potential root-level command execution via crafted BGP route updates when the BGP Monitoring Protocol (BMP) is enabled. | 15 Oct |
| CVE-2026-102028 | 8.7 high | 1.0% | no CPE yet | A NULL Pointer Dereference vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows a remote BGP peer to cause a denial of service when multiple UPDATEs occur over a single TCP session with 'bgp family l2vpn auto-discovery-only' configured. | 16 Oct |
| CVE-2026-102012 | 8.7 high | 1.0% | no CPE yet | A Reachable Assertion vulnerability in the na-grpcd process of Juniper Networks Junos OS Evolved allows a remote unauthenticated attacker to cause a denial of service via a gRPC telemetry subscription request. | 16 Oct |
| CVE-2026-101945 | 8.7 high | 1.0% | no CPE yet | An Integer Overflow or Wraparound vulnerability in the rpd process of Juniper Networks Junos OS and Junos OS Evolved allows a remote attacker with an established EVPN BGP peering relationship to cause a denial of service via EVPN BGP route processing. The issue affects EVPN-enabled routing instances and can disrupt control-plane adjacencies. | 16 Oct |
| CVE-2026-102174 | 8.7 high | 1.0% | no CPE yet | A Stack-based Buffer Overflow vulnerability in the iked IKE key-management daemon of Juniper Networks Junos OS on the SRX Series allows an authenticated remote-access VPN client to execute code with root privileges or cause denial of service via the remote-access VPN authentication and JIMS identity-publishing path. | 16 Oct |
| CVE-2026-101965 | 8.7 high | 1.0% | no CPE yet | An Use of Externally-Controlled Format String vulnerability in the gRPC daemon of Juniper Networks Junos OS Evolved allows an authenticated network attacker to cause telemetry-service disruption, information disclosure, or potential root-level code execution via a crafted message to the gNMI service. | 15 Oct |
| CVE-2026-101957 | 8.7 high | 1.0% | no CPE yet | An Improper Initialization vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows a remote BGP peer to cause an rpd crash via an LLGR-stale route update readvertised to a configured non-LLGR peer group. | 15 Oct |
| CVE-2026-102079 | 8.5 high | 1.0% | no CPE yet | An OS command injection vulnerability in the CLI of Juniper Networks Junos OS allows a local, low privileged attacker to take complete control of the device. A specific 'request csds' command doesn't sanitize user provided input so that it can be interpreted as a command. This allows unintended command execution with root privileges, which can lead to unauthorized system access or modification. This issue affects Junos OS: * 24.4 versions before 24.4R2-S4; * 25.2 versions before 25.2R2-S1; * 25.4 versions before 25.4R1-S3; This issue does not affect Junos OS releases before 24.4R1. | 15 Oct |
| CVE-2026-33791 | 8.4 high | 1.0% | juniper, junos, junos_os_evolved | An OS Command Injection vulnerability in the CLI processing of Juniper Networks Junos OS and Junos OS Evolved allows a local, high-privileged attacker executing specific, crafted CLI commands to inject arbitrary shell commands as root, leading to a complete compromise of the system. Certain 'set system' commands, when executed with crafted arguments, are not properly sanitized, allowing for arbitrary shell injection. These shell commands are executed as root, potentially allowing for complete control of the vulnerable system. This issue affects: Junos OS: * all versions before 22.4R3-S8, * from 23.2 before 23.2R2-S5, * from 23.4 before 23.4R2-S7, * from 24.2 before 24.2R2-S2, * from 24.4 before 24.4R2, * from 25.2 before 25.2R2; Junos OS Evolved: * all versions before 22.4R3-S8-EVO, * from 23.2 before 23.2R2-S5-EVO, * from 23.4 before 23.4R2-S7-EVO, * from 24.2 before 24.2R2-S2-EVO, * from 24.4 before 24.4R2-EVO, * from 25.2 before 25.2R1-S1-EVO, 25.2R2-EVO. | Mon 26 Oct |
| CVE-2025-60006 | 4.8 medium | 1.0% | juniper, junos_os_evolved | Multiple instances of an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in the CLI of Juniper Networks Junos OS Evolved could be used to elevate privileges and/or execute unauthorized commands. When an attacker executes crafted CLI commands, the options are processed via a script in some cases. These scripts are not hardened so injected commands might be executed via the shell, which allows an attacker to perform operations, which they should not be able to do according to their assigned permissions. This issue affects Junos OS Evolved: * 24.2 versions before 24.2R2-S2-EVO, * 24.4 versions before 24.4R2-EVO. This issue does not affect Junos OS Evolved versions earlier than 24.2R1-EVO. | 8 Oct |
| CVE-2026-103409 | 9.8 critical | — | no CPE yet | A Missing authentication for critical function vulnerability in Juniper Networks Session Smart Router allows an unauthenticated network-based attacker to obtain administrative privileges by passing crafted URL parameters to an insecure endpoint running as root. Note that this vulnerability can only be exploited prior to the device being onboarded to Mist/Conductor. The issue can no longer be exploited once a device is onboarded to Mist/Conductor. | 5 h ago |
| CVE-2026-103406 | 9.8 critical | — | no CPE yet | An Improper Neutralization of Special Elements used in an OS Command vulnerability in the AutomatedProvisioner in Juniper Networks Session Smart Conductor allows a remote attacker to execute arbitrary commands as root via a specially crafted salt minion ID. | 5 h ago |
| CVE-2026-33784 | 9.3 critical | 0.00% | juniper, virtual_lightweight_collector | A Use of Default Password vulnerability in the Juniper Networks Support Insights (JSI) Virtual Lightweight Collector (vLWC) allows an unauthenticated, network-based attacker to take full control of the device. vLWC software images ship with an initial password for a high privileged account. A change of this password is not enforced during the provisioning of the software, which can make full access to the system by unauthorized actors possible.This issue affects all versions of vLWC before 3.0.94. | Mon 26 Oct |
| CVE-2026-102182 | 9.3 critical | 0.00% | no CPE yet | A Stack-based Buffer Overflow vulnerability in the kmd component of Juniper Networks Junos OS on MX Series allows an unauthenticated network attacker to execute code as root via specific IKE certificate-based packets. This issue requires IKE to be enabled with an RSA-signature IKE policy to be vulnerable. This issue affects Junos OS on MX Series: * All versions before 21.2R3-S11; * from 21.4 before 21.4R3-S12; * from 22.2 before 22.2R3-S8; * from 22.3 before 22.3R3-S5; * from 22.4 before 22.4R3-S9; | 20 Oct |
| CVE-2026-101950 | 9.3 critical | 0.00% | no CPE yet | A Heap-based Buffer Overflow vulnerability in the SVR component of Juniper Networks Junos OS on SRX Series allows an unauthenticated network attacker to cause a denial of service and potentially compromise confidentiality and integrity via malformed IPv4 packets reaching an interface configured for Secure Vector Routing. | 17 Oct |
| CVE-2026-102178 | 9.3 critical | 0.00% | no CPE yet | A Stack-based Buffer Overflow vulnerability in the BGP routing daemon of Juniper Networks Junos OS and Junos OS Evolved allows a configured BGP flowspec peer to cause routing-engine compromise or a routing-daemon denial of service via flowspec route re-advertisement when BGP update-threading is enabled. | 16 Oct |
| CVE-2026-101954 | 9.3 critical | 0.00% | no CPE yet | An Improper Authentication vulnerability in the J-Web management interface and its NETCONF session handling of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated network attacker to obtain root-level device configuration access and take over the device via a reachable J-Web HTTP or HTTPS service when web management is enabled. | 16 Oct |
| CVE-2026-101980 | 9.3 critical | 0.00% | no CPE yet | An Integer Underflow vulnerability in the kernel of Juniper Networks Junos OS with Extended Echo configured allows an unauthenticated, network-based attacker to cause a denial of service by a kernel crash. | 15 Oct |
| CVE-2025-59974 | 9.3 critical | 0.00% | juniper, space_security_director | An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Junos Space Security Director allows an attacker to inject malicious scripts into the application, which are then stored and executed in the context of other users' browsers when they access affected pages.This issue affects Juniper Security Director: * All versions before 24.1R4. | 8 Oct |
| CVE-2026-102037 | 9.2 critical | 0.00% | no CPE yet | An XML Injection vulnerability in the Unified Threat Management daemon (utmd) of Juniper Networks Junos OS on SRX Series devices allows an unauthenticated network attacker to commit arbitrary device configuration with root privileges via a malicious response from a configured custom URL-feed server. | 16 Oct |
| CVE-2026-101997 | 9.2 critical | 0.00% | no CPE yet | An Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in ipfd of Juniper Networks Junos OS on SRX Series allows an unauthenticated network-based attacker to execute code with root privileges via a configured Security Intelligence feed connection. | 16 Oct |
| CVE-2026-102062 | 9.2 critical | 0.00% | no CPE yet | An Use of Externally-Controlled Format String vulnerability in the ipfd daemon of Juniper Networks Junos OS on SRX Series allows an unauthenticated network-based attacker to execute code with root privileges via a compromised or impersonated configured HTTPS feed server. | 15 Oct |
| CVE-2026-102070 | 9.2 critical | 0.00% | no CPE yet | A Reachable Assertion vulnerability in the Two-Way Active Measurement Protocol (TWAMP) client of Juniper Networks Junos OS allows an unauthenticated network-based attacker to cause rmopd service disruption via a specific TCP packet. | 15 Oct |
| CVE-2026-33771 | 9.1 critical | 0.00% | juniper, ctp_operating_system | A Weak Password Requirements vulnerability in the password management function of Juniper Networks CTP OS might allow an unauthenticated, network-based attacker to exploit weak passwords of local accounts and potentially take full control of the device. The password management menu enables the administrator to set password complexity requirements, but these settings are not saved. The issue can be verified with the menu option "Show password requirements". Failure to enforce the intended requirements can lead to weak passwords being used, which significantly increases the likelihood that an attacker can guess these and subsequently attain unauthorized access. This issue affects CTP OS versions 9.2R1 and 9.2R2. | Mon 26 Oct |
| CVE-2026-106079 | 8.8 high | — | no CPE yet | An Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in AccessManager in Juniper Networks Session Smart Router and Session Smart Conductor allows an attacker with config-write privileges to achieve arbitrary command execution as root in the YANG configuration. | 5 h ago |
| CVE-2026-103408 | 8.8 high | — | no CPE yet | A Stack Buffer Overflow vulnerability in the DHCP client in Juniper Networks Session Smart Router allows an unauthenticated attacker on the local network to achieve remote code execution via a malicious DHCP reply. | 5 h ago |
| CVE-2026-103407 | 8.8 high | — | no CPE yet | An Improper Limitation of a Pathname to a Restricted Directory vulnerability in ConfigDirector in Juniper Networks Session Smart Router and Session Smart Conductor allows an authenticated REST user to read, overwrite, or delete arbitrary certificate and key files on the host filesystem via the certificate and private-key REST API. | 5 h ago |
| CVE-2026-103403 | 8.8 high | — | no CPE yet | An Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in AccessManager in Juniper Networks Session Smart Router and Session Smart Conductor allows an attacker to perform arbitrary file deletion and arbitrary command execution via the deletion of an audit rule. | 5 h ago |
| CVE-2026-103402 | 8.8 high | — | no CPE yet | An Insufficient Verification of Data Authenticity vulnerability in PCLI in Juniper Networks Session Smart Router and Session Smart Conductor allows an attacker with write access to the model cache directory to execute arbitrary code and escalate privileges via the processing of unverified cache files. | 5 h ago |
| CVE-2026-103401 | 8.8 high | — | no CPE yet | An Improper Link Resolution Before File Access ('Link Following') vulnerability in the unauthenticated web server handlers in Juniper Networks Session Smart Router and Session Smart Conductor allows a local unprivileged user to overwrite arbitrary files as root via unauthenticated API endpoints. This vulnerability can be exploited on Mist-managed routers and on unmanaged Routers that have not yet been onboarded to a Conductor. Routers already managed by Conductor are not affected. | 5 h ago |
| CVE-2026-101966 | 8.8 high | 0.00% | no CPE yet | A Use of Externally-Controlled Format String vulnerability in the jti-dialoutd of Juniper Networks Junos OS Evolved allows an authenticated network attacker to cause persistent telemetry dial-out denial of service via a crafted analytics sensor resource submitted through gNMI listener. | 15 Oct |
50 of 255 · Next
Download these 255 as CSV · subscribe to this list.
EPSS scores: 2026-10-27. NVD cursor: 2026-10-28 21:20. The News page shows only notable CVEs (KEV, your stack, new criticals, EPSS over 50%, or active exploitation per SSVC); this table has all of them.