Export limit exceeded: 408222 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (104684 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-102029 | 2026-10-14 | 7.5 High | ||
| A NULL Pointer Dereference vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated configured MSDP peer or adjacent PIM sender to cause a denial of service via an MSDP or PIM policy that uses AS-path expansion. | ||||
| CVE-2026-97008 | 1 Microsoft | 8 365 Apps, Microsoft 365, Office 2021 and 5 more | 2026-10-14 | 8.8 High |
| Buffer underwrite ('buffer underflow') in Microsoft Office Excel allows an unauthorized attacker to execute code over a network. | ||||
| CVE-2026-102028 | 2026-10-14 | 7.5 High | ||
| A NULL Pointer Dereference vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows a remote BGP peer to cause a denial of service when multiple UPDATEs occur over a single TCP session with 'bgp family l2vpn auto-discovery-only' configured. | ||||
| CVE-2026-97009 | 1 Microsoft | 3 365 Apps, Office 2021, Office 2024 | 2026-10-14 | 7.8 High |
| Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally. | ||||
| CVE-2026-102027 | 2026-10-14 | 7.5 High | ||
| An Incorrect Calculation of Buffer Size vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows a configured eBGP neighbor to cause an rpd crash via BGP labeled-unicast UPDATEs when the affected multipath features are enabled. | ||||
| CVE-2026-102026 | 2026-10-14 | 7.5 High | ||
| An Improper Control of a Resource Through its Lifetime vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent eBGP peer to cause a routing-daemon crash via a BGP route update when RIB sharding is enabled. | ||||
| CVE-2026-102025 | 2026-10-14 | 7.5 High | ||
| A Mismatched Memory Management Routines vulnerability in the routing protocol daemon (rpd) process of Juniper Networks Junos OS and Junos OS Evolved allows an authenticated network-based attacker to cause a denial of service via a BGP route update when extended next-hop tunneling and SRv6 service processing are used. | ||||
| CVE-2026-97010 | 1 Microsoft | 8 365 Apps, Microsoft 365, Office 2021 and 5 more | 2026-10-14 | 8.8 High |
| Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code over a network. | ||||
| CVE-2026-102024 | 2026-10-14 | 7.5 High | ||
| An Integer Overflow or Wraparound vulnerability in the routing daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an authenticated BGP peer to cause a denial of service via BGP route updates when extended-nexthop-tunnel is enabled. | ||||
| CVE-2026-102023 | 2026-10-14 | 7.5 High | ||
| A Reachable Assertion vulnerability in fwstatsd of Juniper Networks Junos OS Evolved allows an authenticated network attacker to cause a denial of service via an SNMP firewall-counter MIB query when at least one firewall counter is configured. | ||||
| CVE-2026-102022 | 2026-10-14 | 7.5 High | ||
| A Reachable Assertion vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an attacker with access to a configured BGP-LS peer to cause an rpd crash via a crafted BGP-LS Link NLRI advertisements. | ||||
| CVE-2026-97011 | 1 Microsoft | 7 365 Apps, Microsoft 365, Office 2021 and 4 more | 2026-10-14 | 8.8 High |
| Use of uninitialized resource in Microsoft Office Excel allows an unauthorized attacker to execute code over a network. | ||||
| CVE-2026-102020 | 2026-10-14 | 7.5 High | ||
| A Reachable Assertion vulnerability in the rpd process of Juniper Networks Junos OS and Junos OS Evolved allows an authenticated network-based attacker to cause a denial of service via BGP-LS routing updates. | ||||
| CVE-2026-19673 | 2026-10-14 | 7.1 High | ||
| ethernet_recv() in subsys/net/l2/ethernet/ethernet.c validates only that the first net_buf of a received frame holds a plain 14-byte struct net_eth_hdr. When the ethertype is 0x8100 and VLAN is enabled on the interface, the same buffer is reinterpreted as the 18-byte struct net_eth_vlan_hdr without re-checking the length: the VLAN TCI and the inner ethertype are read from offsets 14..17, past pkt->buffer->len, and hdr_len is raised to 18 so the subsequent net_buf_pull() removes more bytes than the buffer holds. A single unauthenticated frame of 14 to 17 bytes carrying the VLAN ethertype triggers this. No knowledge of the node's VLAN configuration is needed: net_eth_get_vlan_iface() returns the base interface for the priority tag 0, and a broadcast destination address satisfies the "frame is for me" test, so a 16-byte broadcast frame with ethertype 0x8100 and TCI 0x0000 reaches the pull. Nothing in the receive path enforces the 60-byte Ethernet minimum — the USB CDC ECM and CDC NCM gadget classes in particular hand host-supplied frames of any non-zero length straight to net_recv_data(). With assertions enabled, net_buf_simple_pull() asserts and the node panics. In a production build (assertions and CONFIG_NET_BUF_HARDENING off) the uint16_t buffer length underflows to 65534 and buf->data is advanced past the end of the fragment's storage, so every later parser reads far outside the buffer and any net_buf_add() on that fragment computes tailroom from the underflowed length. The result is a reliable remote denial of service and out-of-bounds access with information-disclosure and corruption potential. Only configurations built with CONFIG_NET_VLAN=y that have a VLAN enabled on the receiving Ethernet interface, and whose MAC does not strip VLAN tags in hardware (ETHERNET_HW_VLAN_TAG_STRIP), are affected. The fix rejects the frame before the tag is read, so hdr_len is thereafter either 14 or 18 with both sizes validated against pkt->buffer->len. | ||||
| CVE-2026-102016 | 2026-10-14 | 7.5 High | ||
| An Improper Validation of Specified Quantity in Input vulnerability in the rpd process of Juniper Networks Junos OS and Junos OS Evolved allows a configured BGP MVPN peer to cause a denial of service via a BGP MVPN signaling update. | ||||
| CVE-2026-102015 | 2026-10-14 | 8.8 High | ||
| A Heap-based Buffer Overflow vulnerability in the secure-dot1xd process of Juniper Networks on Junos OS and Junos OS Evolved allows an unauthenticated adjacent network attacker to execute code as root or cause a denial of service via an EAPOL frame sent to an 802.1X-authenticated interface. | ||||
| CVE-2026-102014 | 2026-10-14 | 8.8 High | ||
| A Stack-based Buffer Overflow vulnerability in the authd process of Juniper Networks Junos OS allows an attacker able to influence a configured RADIUS server to cause authd to crash or execute code with root privileges via a malicious RADIUS response. | ||||
| CVE-2026-110449 | 1 Nixos | 1 Nix | 2026-10-14 | 7.5 High |
| Nix before 2.35.3 and Lix before 2.95.4 have an integer overflow and resultant out-of-bounds write when evaluating untrusted expressions because list allocation is mishandled. | ||||
| CVE-2026-102012 | 2026-10-14 | 7.5 High | ||
| A Reachable Assertion vulnerability in the na-grpcd process of Juniper Networks Junos OS Evolved allows a remote unauthenticated attacker to cause a denial of service via a gRPC telemetry subscription request. | ||||
| CVE-2026-101945 | 2026-10-14 | 7.5 High | ||
| An Integer Overflow or Wraparound vulnerability in the rpd process of Juniper Networks Junos OS and Junos OS Evolved allows a remote attacker with an established EVPN BGP peering relationship to cause a denial of service via EVPN BGP route processing. The issue affects EVPN-enabled routing instances and can disrupt control-plane adjacencies. | ||||