Latest vulnerabilities
Every new CVE with its exploitation status, public exploits and fixes — from nearly 30 public sources, updated hourly.
- Tracked
- 409,732
- Last 24h
- 381
- Critical, 7 days
- 343
- Known exploited
- 1,779
97,879 results · Clear filters · Feed
-
High 8.8
Dpdk: dpdk: time-of-check/time-of-use vulnerability allowing guest-triggered out-of-bounds write in vhost-crypto
A flaw was found in DPDK lib/vhost vhost-crypto. The indirect-descriptor snapshot double-fetches a guest descriptor next index, allowing a malicious guest to cause an out-of-bounds access in the host backend.
-
High 8.8
Microsoft Office SharePoint Elevation of Privilege Vulnerability
Missing authorization in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.
-
High 8.8
Dpdk: dpdk: vduse handler fails to invalidate vring pointers when iotlb is invalidated, leading to use-after-unmap
A flaw was found in DPDK lib/vhost. The VDUSE handler fails to invalidate vring pointers when the IOTLB is invalidated, leading to use-after-unmap.
-
High 7.5
Model Context Protocol Java SDK HTTP server transports allow memory exhaustion through unbounded request bodies
The Model Context Protocol Java SDK is the official Java SDK for Model Context Protocol servers and clients. From version 0.8.0 through 0.12.0 in the io.modelcontextprotocol.sdk:mcp artifact, from 0.13.0 through 0.18.3 and 1.0.0 through 1.1.3 in io.modelconte…
-
High 8.7
Out-of-bounds read via an empty signature BIT STRING in NetX Secure X.509 parsing
In Eclipse ThreadX NetX Duo versions up to and including 6.5.2.202603, the NetX Secure X.509 parser accepts a certificate whose signature is an empty BIT STRING and records a signature length of 0xFFFFFFFF. A remote peer can present such a certificate during …
-
High 8.8
Authentication bypass via second StartupMessage during SCRAM authentication in PgBouncer
Improper authentication in PgBouncer 1.17.0 through 1.26.0 allows a remote attacker who knows the password of a user listed in auth_file to log in as any other user that authenticates using SCRAM, including PgBouncer admin users and backend superusers. A seco…
-
High 7.5
Infinite loop on empty option name in startup options parameter in PgBouncer
An infinite loop in PgBouncer 1.20.0 through 1.26.0 allows an unauthenticated remote attacker to cause a denial of service. A StartupMessage whose options parameter contains an empty parameter name, such as "-c=", makes the ignore_startup_parameters list look…
-
High 8.4
The GUIX binary resource (theme) loader sizes its arena and populates it in two separate passes that traverse the resou…
-
High 8.8
FV Flowplayer Video Player <= 7.5.54.7212 - Authenticated (Subscriber+) Arbitrary File Upload via 'video_url' Parameter
The FV Flowplayer Video Player plugin for WordPress is vulnerable to Limited Arbitrary File Upload in all versions up to, and including, 7.5.54.7212 via the check_mimetype function. This is due to incomplete file type validation in the check_mimetype function…
-
High 8.5
PAN-OS: Authenticated Remote Code Execution (RCE) in the Management Interface
A remote code execution (RCE) vulnerability in the management interface of Palo Alto Networks PAN-OS® software enables an authenticated attacker with network access to execute arbitrary code with root privileges on the firewall. The security risk posed by thi…
KEV Oct 14, 2026 -
High 7.5
Junos OS and Junos OS Evolved: A specific BGP ISO-VPN update causes an rpd crash when BMP or NSR is enabled
An Improper Validation of Consistency within Input vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows a configured BGP ISO-VPN peer to cause an rpd crash by sending a specific ISO-VPN update which is th…
-
High 7.5
Junos OS and Junos OS Evolved: In a scenario with VPN-flowspec and BMP monitoring a specific BGP update causes an rpd crash
A NULL Pointer Dereference vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated remote BGP neighbor to cause a denial of service via a VPN-flowspec BGP update if it is readvertised and …
-
High 7.5
Junos OS and Junos OS Evolved: A BGP EVPN neighbor causes an rpd crash when SRv6 multihoming is used
An Incorrect Calculation vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos EVO allows a remote BGP EVPN neighbor to cause an rpd crash when SRv6 EVPN multihoming is configured.
-
High 7.5
Junos OS and Junos OS Evolved: An attacker sending a malformed update causes an rpd crash when BGP EVPN signaling is used
An Improper Handling of Length Parameter Inconsistency vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an attacker sending a specifically malformed BGP EVPN multicast update which is attempted to be …
-
High 7.5
F´: FileUplink Unknown Packet Type Assertion DoS
F´ (F Prime) is a framework that enables development and deployment of spaceflight and other embedded software applications. Prior to 4.2.0, Fw::FilePacket deserialization used by Svc::FileUplink is vulnerable because Header deserialization casts the byte to …
-
High 7.5
Junos OS and Junos OS Evolved: A specific BGP packet causes an rpd crash when an ECMP qualifier is used in an import policy
A NULL Pointer Dereference vulnerability in the routing-policy nexthop-ECMP matcher of Juniper Networks Junos OS and Junos OS Evolved allows a configured eBGP peer to cause a routing-daemon denial of service via a specific BGP packet received while a nexthop-…
-
High 7.5
F´: GenericHub Malformed Buffer Assertion DoS
F´ (F Prime) is a framework that enables development and deployment of spaceflight and other embedded software applications. Prior to 4.2.0, Svc::GenericHub fromBufferDriver_handler deserialization is vulnerable because the receive handler uses FW_ASSERT for …
-
High 8.1
F´: File size bounds bypass in Svc::FileUplink via unsigned integer overflow in DATA packet validation
F´ (F Prime) is a framework that enables development and deployment of spaceflight and other embedded software applications. Prior to 4.2.0, Svc::FileUplink handleDataPacket offset and size validation is vulnerable because the component checks byteOffset plus…
-
High 8.8
Junos OS and Junos OS Evolved: An adjacent LDP peer causes routing-engine compromise when LDP is enabled
A Stack-based Buffer Overflow vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated adjacent LDP peer to cause an rpd crash or execute arbitrary code via a malformed LDP Label Mapping me…
-
High 8.8
Junos OS and Junos OS Evolved: A network attacker causes root-level code execution or denial of service when SNMP and AAA are enabled
A Stack-based Buffer Overflow vulnerability in the authd Juniper Networks Junos OS and Junos OS Evolved allows a network attacker with SNMP read access to execute code with root privileges or cause a denial of service via a specific SNMP packet, when SNMP and…
-
High 7.5
Junos OS and Junos OS Evolved: In a non-4byte-AS scenario a specific BGP update causes an rpd crash
An Out-of-bounds Write vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an eBGP peer which has not negotiated four-octet-AS capability sending a specifically malformed BGP update to cause a Denial-of-…
-
High 7.2
F´: FpySequencer Integer Overflow in Stack Offset/Size Validation Leading to Out-of-Bounds Write
F´ (F Prime) is a framework that enables development and deployment of spaceflight and other embedded software applications. Prior to 4.2.0, Svc::FpySequencer STORE directive stack write validation the bounds check adds attacker-controlled offset and size bef…
-
High 7.5
Junos OS: MX Series with SPC3: In a source NAT scenario malformed packets will lead to resource leaks and eventually traffic stops
An Improper Check for Unusual or Exceptional Conditions vulnerability in the Packet Forwarding Engine (PFE) of Juniper Networks Junos OS on MX Series with SPC3 allows an unauthenticated, network-based attacker to cause a Denial-of-Service (DoS). On MX Series …
-
High 8.8
Junos OS and Junos OS Evolved: SRX Series: An attacker causes remote code execution when SRX chassis-cluster is enabled
A Stack-based Buffer Overflow vulnerability in the srxpfe of Juniper Networks Junos OS and Junos OS Evolved on the SRX Series allows an L2-adjacent attacker to execute arbitrary code as root via high-availability fabric traffic.
-
High 7.5
Junos OS and Junos OS Evolved: An attacker causes a routing-daemon crash when BGP Prefix-SID routes are re-advertised
A Numeric Truncation Error vulnerability in the rpd process of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated network-based attacker to cause a denial of service via a BGP Prefix-SID route advertisement that is subsequently re-advert…
-
High 7.5
Junos OS and Junos OS Evolved: An attacker causes an rpd denial of service when EVPN multihoming preference-based DF election is used
A Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows a remote network attacker to cause a denial of service via EVPN multihoming with preference-ba…
-
High 7.5
Junos OS and Junos OS Evolved: A malformed EVPN SRv6 route causes an rpd crash
An Improper Validation of Specified Quantity in Input vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos Evolved platforms allows a configured EVPN signaling peer to cause an rpd crash via a malformed SRv6 structure carr…
-
High 7.5
Junos OS and Junos OS Evolved: If in a BGP EVPN scenario a malformed NLRI is received rpd crashes
An Improper Validation of Specified Quantity in Input vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows a configured BGP EVPN peer to cause an rpd crash via a specifically malformed NLRI.
-
High 7.5
Junos OS and Junos OS Evolved: An attacker causes an rpd crash when BGP RIB streaming telemetry is in use
A Stack-based Buffer Overflow vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an attacker with access to a configured BGP peering session to cause a denial of service by sending a crafted BGP route a…
-
High 7.5
Junos OS and Junos OS Evolved: An attacker causes a routing daemon crash when BGP EVPN RIB telemetry is used
An Out-of-bounds Write vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an attacker with access to a configured BGP EVPN peer to cause a denial of service via BGP EVPN route processing when the l2vpn-…
-
High 7.6
Junos OS and Junos OS Evolved: An out-of-bounds write causes an rpd crash when IS-IS backup selection is used
An Out-of-bounds Write vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent unauthenticated attacker to cause a denial of service when IS-IS link protection and backup-selection are configured.
-
High 8.8
Junos OS: Specific packets cause SDK service crash or Routing Engine compromise when the SDK service and JDAF is enabled
A Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability in the SDK service process of Juniper Networks Junos OS allows an unauthenticated network attacker to cause a denial of service or compromise the Routing Engine by sending …
-
High 8.8
Junos OS: SRX Series: An authenticated remote-access VPN client causes iked denial of service or root-level code execution when JIMS identity publishing is enabled
A Stack-based Buffer Overflow vulnerability in the iked IKE key-management daemon of Juniper Networks Junos OS on the SRX Series allows an authenticated remote-access VPN client to execute code with root privileges or cause denial of service via the remote-ac…
-
High 8.8
Junos OS and Junos OS Evolved: An attacker causes root code execution when SZTP DHCP provisioning is used
A Stack-based Buffer Overflow vulnerability in the phone-home daemon (phcd) of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent unauthenticated attacker to execute arbitrary code as root via a crafted DHCP SZTP bootstrap message. This issue o…
-
High 8.8
Junos OS and Junos OS Evolved: EX Series, SRX Series, QFX Series: A rogue DHCP server causes root-level command execution when the phone-home client processes specific information
An Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in the phone-home daemon (phcd) of Juniper Networks Junos OS and Junos OS Evolved on EX Series, SRX Series, and QFX Series allows an adjacent unauthent…
-
High 8.2
TLS 1.3 client ticket store crashed by NewSessionTicket with empty early_data extension in ssl
Improper Validation of Consistency within Input vulnerability in Erlang OTP ssl (tls_handshake_1_3, ssl_handshake and tls_client_ticket_store modules) allows a malicious TLS 1.3 server to cause a denial of service of the ssl application on the client node. Th…
-
High 7.5
Junos OS: An attacker causes DHCP service disruption during DHCP client operation
A Stack-based Buffer Overflow vulnerability in the jdhcpd process of Juniper Networks Junos OS allows an unauthenticated adjacent attacker to cause a denial of service via a DHCP client response. The issue affects DHCP client operation and can interrupt relat…
-
High 7.1
Junos OS and Junos OS Evolved: An attacker causes denial of service and information disclosure when Ethernet CFM is enabled
An Out-of-bounds Read vulnerability in the cfmd process of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated adjacent-network attacker to crash the daemon and disclose limited process memory via a specific CFM Message sent to a configur…
-
High 8.7
HTTP/2 blocked-send deadlines reset on every WINDOW_UPDATE, letting a trickle pin stream processes indefinitely in Bandit
Uncontrolled Resource Consumption vulnerability in mtrudel bandit allows an unauthenticated remote attacker to pin HTTP/2 stream processes indefinitely via a trickle of small WINDOW_UPDATE frames. A stream whose response outruns the connection or stream send …
-
High 8.8
Junos OS and Junos OS Evolved: MX Series, PTX Series: An attacker causes remote code execution and denial of service when enhanced CFM is enabled
A Stack-based Buffer Overflow vulnerability in the cfmd process of Juniper Networks Junos OS on MX Series and Junos OS Evolved on PTX Series platforms allows an unauthenticated adjacent-network attacker to execute arbitrary code as root or cause denial of ser…