# Vulnerabilities published in 2026


- [CVE-2026-102089](https://insights.sbomify.com/CVE-2026-102089/): Kiteworks Email Protection Gateway path traversal (high 7.2)
- [CVE-2026-102087](https://insights.sbomify.com/CVE-2026-102087/): Denial of service in Junos OS (high 7.1)
- [CVE-2026-102086](https://insights.sbomify.com/CVE-2026-102086/): Junos OS: SRX Series: Multiple DNS queries processed by SecIntel and DGA in the same session cause a flowd crash (high 8.2)
- [CVE-2026-102085](https://insights.sbomify.com/CVE-2026-102085/): Junos OS Evolved: A port which has been inadvertently exposed can be reached by an attacker (medium 6.9)
- [CVE-2026-102084](https://insights.sbomify.com/CVE-2026-102084/): Junos OS: SRX Series: In an ADVPN scenario a malformed message from a peer causes Remote Code Execution (critical 9.2)
- [CVE-2026-102083](https://insights.sbomify.com/CVE-2026-102083/): Junos OS: SRX Series: With WebFiltering enabled prolonged HTTP session load can cause a crash (high 8.2)
- [CVE-2026-102082](https://insights.sbomify.com/CVE-2026-102082/): Junos OS: SRX Series: If TLS session resumption is configured and a specific TLS message is received a PFE crash occurs (high 8.2)
- [CVE-2026-102081](https://insights.sbomify.com/CVE-2026-102081/): Denial of service in Junos OS (high 8.7)
- [CVE-2026-102080](https://insights.sbomify.com/CVE-2026-102080/): Junos OS: MX Series: Malformed SyncE or PTP clock input causes continuous RE switchover (medium 6.0)
- [CVE-2026-10208](https://insights.sbomify.com/CVE-2026-10208/): code-projects Online Hospital Management System login_1.php login_user sql injection (medium 6.9)
- [CVE-2026-102079](https://insights.sbomify.com/CVE-2026-102079/): Junos OS: MX Series: Missing Authorization for specific 'request' CLI commands allows command injection (high 8.5)
- [CVE-2026-102078](https://insights.sbomify.com/CVE-2026-102078/): Junos OS: SRX Series: A high volume of DNS traffic over TCP can lead to a flowd crash (high 8.2)
- [CVE-2026-102077](https://insights.sbomify.com/CVE-2026-102077/): Denial of service in Junos OS (high 8.7)
- [CVE-2026-102076](https://insights.sbomify.com/CVE-2026-102076/): Memory corruption in APOGEE MBC (PPC) (BACnet) (high 8.7)
- [CVE-2026-102075](https://insights.sbomify.com/CVE-2026-102075/): Memory corruption in APOGEE MBC (PPC) (BACnet) (high 8.7)
- [CVE-2026-102074](https://insights.sbomify.com/CVE-2026-102074/): Memory corruption in APOGEE MBC (PPC) (BACnet) (high 8.7)
- [CVE-2026-102073](https://insights.sbomify.com/CVE-2026-102073/): Memory corruption in APOGEE MBC (PPC) (BACnet) (high 8.8)
- [CVE-2026-102072](https://insights.sbomify.com/CVE-2026-102072/): Junos OS: An authenticated attacker causes a denial of service when the gRPC extension-service is enabled (high 7.1)
- [CVE-2026-102071](https://insights.sbomify.com/CVE-2026-102071/): Junos OS and Junos OS Evolved: Specific RSVP packet causes an rpd crash when associated bidirectional LSP is enabled (high 7.1)
- [CVE-2026-102070](https://insights.sbomify.com/CVE-2026-102070/): Junos OS: A remote TWAMP peer causes rmopd service disruption when TWAMP-Control is used (critical 9.2)
- [CVE-2026-10207](https://insights.sbomify.com/CVE-2026-10207/): PickPlugins Question Answer <= 1.2.73 - Unauthenticated SQL Injection via 'id' Parameter (high 7.5)
- [CVE-2026-102069](https://insights.sbomify.com/CVE-2026-102069/): Junos OS: An ICCP peer causes dot1xd to crash when dot1x synchronization is enabled (high 8.7)
- [CVE-2026-102068](https://insights.sbomify.com/CVE-2026-102068/): Memory corruption in Junos OS Evolved (critical 9.2)
- [CVE-2026-102067](https://insights.sbomify.com/CVE-2026-102067/): Junos OS and Junos OS Evolved: A specific RSVP packet causes an rpd crash when L2 LSP support is used (high 7.1)
- [CVE-2026-102066](https://insights.sbomify.com/CVE-2026-102066/): Junos OS and Junos OS Evolved: Malformed RSVP packet causes a rpd crash when RSVP is enabled (high 7.1)
- [CVE-2026-102065](https://insights.sbomify.com/CVE-2026-102065/): Junos OS and Junos OS Evolved: A malformed SRv6 service route causes an rpd crash when dynamic tunnels are enabled (high 8.7)
- [CVE-2026-102064](https://insights.sbomify.com/CVE-2026-102064/): Junos OS and Junos OS Evolved: An attacker causes an rpd crash when inter-AS MVPN ingress replication is used (high 8.7)
- [CVE-2026-102063](https://insights.sbomify.com/CVE-2026-102063/): Junos OS: MX Series: An unauthenticated network attacker causes an rpd crash when HFRR link protection is used (high 7.1)
- [CVE-2026-102062](https://insights.sbomify.com/CVE-2026-102062/): Memory corruption in Junos OS (critical 9.2)
- [CVE-2026-102061](https://insights.sbomify.com/CVE-2026-102061/): Junos OS and Junos OS Evolved: An attacker causes root code execution when SZTP DHCP provisioning is used (high 8.7)
- [CVE-2026-102060](https://insights.sbomify.com/CVE-2026-102060/): Null dereference in Junos OS (high 7.1)
- [CVE-2026-10206](https://insights.sbomify.com/CVE-2026-10206/): D-Link DI-8400 dbsrv.asp stack-based overflow (high 8.7)
- [CVE-2026-102059](https://insights.sbomify.com/CVE-2026-102059/): Command injection in Junos OS (high 8.7)
- [CVE-2026-102058](https://insights.sbomify.com/CVE-2026-102058/): Junos OS and Junos OS Evolved: An attacker causes a bfdd denial of service when BFD is enabled (high 7.1)
- [CVE-2026-102057](https://insights.sbomify.com/CVE-2026-102057/): Junos OS: An attacker causes DHCP service disruption during DHCP client operation (high 8.7)
- [CVE-2026-102056](https://insights.sbomify.com/CVE-2026-102056/): Memory corruption in Junos OS (high 7.1)
- [CVE-2026-102055](https://insights.sbomify.com/CVE-2026-102055/): Memory corruption in Junos OS (high 8.7)
- [CVE-2026-102054](https://insights.sbomify.com/CVE-2026-102054/): Information disclosure in Junos OS (medium 5.3)
- [CVE-2026-102053](https://insights.sbomify.com/CVE-2026-102053/): Denial of service in Junos OS (medium 6.9)
- [CVE-2026-102052](https://insights.sbomify.com/CVE-2026-102052/): Junos OS and Junos OS Evolved: An attacker causes jdhcpd to crash when the DHCPv4 local-client feature is used (high 8.7)
- [CVE-2026-102051](https://insights.sbomify.com/CVE-2026-102051/): Junos OS and Junos OS Evolved: An attacker causes l2cpd memory exhaustion when LLDP fast receive processing is enabled (high 7.1)
- [CVE-2026-102050](https://insights.sbomify.com/CVE-2026-102050/): Junos OS and Junos OS Evolved: An adjacent attacker causes Layer 2 control-plane denial of service when LLDP is enabled (high 8.7)
- [CVE-2026-10205](https://insights.sbomify.com/CVE-2026-10205/): Metasoft 美特软件 MetaCRM upload.jsp unrestricted upload (medium 5.3)
- [CVE-2026-102049](https://insights.sbomify.com/CVE-2026-102049/): Memory corruption in Junos OS (high 8.7)
- [CVE-2026-102048](https://insights.sbomify.com/CVE-2026-102048/): Junos OS: An attacker causes l2cpd crash when FNP is used with VLAN-VPLS encapsulation enabled (high 7.1)
- [CVE-2026-102047](https://insights.sbomify.com/CVE-2026-102047/): Junos OS and Junos OS Evolved: An attacker causes l2cpd denial of service when MVRP is used (high 7.1)
- [CVE-2026-102046](https://insights.sbomify.com/CVE-2026-102046/): Junos OS: MX Series: An attacker causes a Routing Engine denial of service when SCTP service is used (high 8.7)
- [CVE-2026-102045](https://insights.sbomify.com/CVE-2026-102045/): Junos OS Evolved: An crafted LACP frame causes lacpd to crash when LACP is enabled (high 7.1)
- [CVE-2026-102044](https://insights.sbomify.com/CVE-2026-102044/): Denial of service in Junos OS (high 8.7)
- [CVE-2026-102043](https://insights.sbomify.com/CVE-2026-102043/): Junos OS and Junos OS Evolved: An attacker causes a routing-process crash when MPLS-TE fast reroute is enabled (high 7.1)
- [CVE-2026-102042](https://insights.sbomify.com/CVE-2026-102042/): Junos OS and Junos OS Evolved: An attacker causes rpd to crash when RSVP associated-bidirectional LSP is enabled (high 7.1)
- [CVE-2026-102041](https://insights.sbomify.com/CVE-2026-102041/): Junos OS and Junos OS Evolved: An attacker causes a routing daemon crash when RSVP is enabled (high 7.1)
- [CVE-2026-102040](https://insights.sbomify.com/CVE-2026-102040/): Junos OS and Junos OS Evolved: An attacker crashes the routing daemon when co-routed bidirectional RSVP LSPs are used (high 7.1)
- [CVE-2026-10204](https://insights.sbomify.com/CVE-2026-10204/): OFCMS JSON Query SysUserController.java query sql injection (medium 5.3)
- [CVE-2026-102039](https://insights.sbomify.com/CVE-2026-102039/): Null dereference in Junos OS (high 7.1)
- [CVE-2026-102037](https://insights.sbomify.com/CVE-2026-102037/): Junos OS: SRX Series: An attacker causes arbitrary configuration commit when the custom URL-feed feature is used (critical 9.2)
- [CVE-2026-102036](https://insights.sbomify.com/CVE-2026-102036/): Junos OS and Junos OS Evolved: An EVPN default-gateway route burst causes l2ald denial of service (high 8.7)
- [CVE-2026-102035](https://insights.sbomify.com/CVE-2026-102035/): Junos OS and Junos OS Evolved: An attacker causes a denial of service when MC-LAG IRB MAC synchronization is enabled (high 7.1)
- [CVE-2026-102034](https://insights.sbomify.com/CVE-2026-102034/): Junos OS and Junos OS Evolved: An attacker causes l2ald to restart when MC-LAG ICCP MAC synchronization is enabled (high 7.1)
- [CVE-2026-102033](https://insights.sbomify.com/CVE-2026-102033/): Junos OS and Junos OS Evolved: An attacker causes denial of service when MC-LAG MAC synchronization is enabled (high 7.1)
- [CVE-2026-102032](https://insights.sbomify.com/CVE-2026-102032/): Denial of service in Junos OS (high 7.1)
- [CVE-2026-102031](https://insights.sbomify.com/CVE-2026-102031/): Junos OS Evolved: A low-privileged TACACS+ user causes root command execution when authorization refresh is enabled (critical 9.3)
- [CVE-2026-102030](https://insights.sbomify.com/CVE-2026-102030/): Denial of service in Junos OS (high 8.7)
- [CVE-2026-10203](https://insights.sbomify.com/CVE-2026-10203/): OFCMS JSON Query SystemParamController.java query sql injection (medium 5.3)
- [CVE-2026-102029](https://insights.sbomify.com/CVE-2026-102029/): Null dereference in Junos OS (high 8.7)
- [CVE-2026-102028](https://insights.sbomify.com/CVE-2026-102028/): Junos OS and Junos OS Evolved: An attacker causes an rpd crash when VPLS auto-discovery is used (high 8.7)
- [CVE-2026-102027](https://insights.sbomify.com/CVE-2026-102027/): Junos OS and Junos OS Evolved: A configured BGP neighbor causes rpd crash when multipath next-hops are processed (high 8.7)
- [CVE-2026-102026](https://insights.sbomify.com/CVE-2026-102026/): Junos OS and Junos OS Evolved: An attacker causes a routing-daemon crash when BGP RIB sharding is used (high 8.7)
- [CVE-2026-102025](https://insights.sbomify.com/CVE-2026-102025/): Memory corruption in Junos OS (high 8.7)
- [CVE-2026-102024](https://insights.sbomify.com/CVE-2026-102024/): Junos OS and Junos OS Evolved: An attacker causes a routing daemon crash when BGP extended-nexthop-tunnel is used (high 8.7)
- [CVE-2026-102023](https://insights.sbomify.com/CVE-2026-102023/): Junos OS Evolved: An attacker causes denial of service via SNMP when firewall counters are used (high 8.7)
- [CVE-2026-102022](https://insights.sbomify.com/CVE-2026-102022/): Junos OS and Junos OS Evolved: An attacker causes a routing-process crash when BGP-LS traffic-engineering is enabled (high 8.7)
- [CVE-2026-102021](https://insights.sbomify.com/CVE-2026-102021/): Junos OS and Junos OS Evolved: Malformed RSVP packet causes rpd crash when MPLS-TE error processing is enabled (high 7.1)
- [CVE-2026-102020](https://insights.sbomify.com/CVE-2026-102020/): Junos OS and Junos OS Evolved: An attacker causes an rpd denial of service when BGP-LS TED export is enabled (high 8.7)
- [CVE-2026-10202](https://insights.sbomify.com/CVE-2026-10202/): OFCMS JSON Query SystemDictController.java query sql injection (medium 5.3)
- [CVE-2026-102019](https://insights.sbomify.com/CVE-2026-102019/): Junos OS and Junos OS Evolved: Malformed RIPv2 messages cause routing service disruption when RIP is enabled (high 7.1)
- [CVE-2026-102018](https://insights.sbomify.com/CVE-2026-102018/): Null dereference in Junos OS (high 7.1)
- [CVE-2026-102017](https://insights.sbomify.com/CVE-2026-102017/): Junos OS and Junos OS Evolved: An attacker causes routing-plane denial of service when Auto-RP mapping is enabled (high 7.1)
- [CVE-2026-102016](https://insights.sbomify.com/CVE-2026-102016/): Junos OS and Junos OS Evolved: An attacker causes a routing outage when BGP MVPN signaling is enabled (high 8.7)
- [CVE-2026-102015](https://insights.sbomify.com/CVE-2026-102015/): Junos OS and Junos OS Evolved: An attacker causes root code execution when 802.1X authentication is used (high 8.7)
- [CVE-2026-102014](https://insights.sbomify.com/CVE-2026-102014/): Junos OS: An attacker causes authd to crash when subscriber RADIUS authentication is used (high 8.7)
- [CVE-2026-102013](https://insights.sbomify.com/CVE-2026-102013/): Junos OS and Junos OS Evolved: An attacker causes na-grpcd to crash when the InitialSync service is used (medium 6.7)
- [CVE-2026-102012](https://insights.sbomify.com/CVE-2026-102012/): Junos OS Evolved: An attacker causes na-grpcd to crash when gRPC telemetry is enabled (high 8.7)
- [CVE-2026-102011](https://insights.sbomify.com/CVE-2026-102011/): Junos OS and Junos OS Evolved: An attacker causes rpd to crash when LDP link protection is enabled (high 7.1)
- [CVE-2026-102010](https://insights.sbomify.com/CVE-2026-102010/): Gcc-toolset-15-gcc: gcc: gcc-toolset-16: gcc: denial of service via use-after-free in binary heap erase_if (high 7.0)
- [CVE-2026-10201](https://insights.sbomify.com/CVE-2026-10201/): Assimp UV Channel FBXExporter.cpp WriteObjects divide by zero (medium 4.8)
- [CVE-2026-102007](https://insights.sbomify.com/CVE-2026-102007/): Cross-site scripting in Bit integrations – Form Integration, Webhook, Spreadsheets, CRM, LMS & Email Automation (high 7.2)
- [CVE-2026-102006](https://insights.sbomify.com/CVE-2026-102006/): VxWorks 7 Memory allocation (medium 5.5)
- [CVE-2026-102005](https://insights.sbomify.com/CVE-2026-102005/): VxWorks Memory Allocation (medium 5.5)
- [CVE-2026-102004](https://insights.sbomify.com/CVE-2026-102004/): VxWorks 7 (high 7.8)
- [CVE-2026-102002](https://insights.sbomify.com/CVE-2026-102002/): Otter Blocks <= 3.2.6 - Authenticated (Subscriber+) Sensitive Information Exposure in Form Submissions Dashboard Widget (low 3.1)
- [CVE-2026-102000](https://insights.sbomify.com/CVE-2026-102000/): Junos OS and Junos OS Evolved: An attacker causes rpd to crash when LDP is enabled (high 7.1)
- [CVE-2026-10200](https://insights.sbomify.com/CVE-2026-10200/): Assimp 4x4 Matrix glTFCommon.h CopyValue heap-based overflow (medium 4.8)
- [CVE-2026-101999](https://insights.sbomify.com/CVE-2026-101999/): Junos OS and Junos OS Evolved: An attacker causes rpd to crash when LDP is enabled (high 7.1)
- [CVE-2026-101998](https://insights.sbomify.com/CVE-2026-101998/): Fail-open response masking in Docker Sandboxes can expose proxy-managed credentials (medium 5.9)
- [CVE-2026-101997](https://insights.sbomify.com/CVE-2026-101997/): SQL injection in Junos OS (critical 9.2)
- [CVE-2026-101996](https://insights.sbomify.com/CVE-2026-101996/): Junos OS and Junos OS Evolved: An inconsistent ICCP peer message causes an l2ald crash when MC-LAG is configured (high 7.1)
- [CVE-2026-101995](https://insights.sbomify.com/CVE-2026-101995/): Junos OS and Junos OS Evolved: Malformed ICCP packets cause l2ald memory disclosure and disruption (medium 5.3)
- [CVE-2026-101994](https://insights.sbomify.com/CVE-2026-101994/): Junos OS and Junos OS Evolved: Malformed MC-LAG ICCP message causes l2ald heap disclosure or crash (high 7.1)
- [CVE-2026-101993](https://insights.sbomify.com/CVE-2026-101993/): Denial of service in Junos OS (high 7.1)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/989/