# Vulnerabilities published in 2026


- [CVE-2026-101992](https://insights.sbomify.com/CVE-2026-101992/): Junos OS and Junos OS Evolved: A BGP peer causes an rpd crash when automatic VPLS site ID is used (high 7.1)
- [CVE-2026-101991](https://insights.sbomify.com/CVE-2026-101991/): Junos OS and Junos OS Evolved: A BGP-LS peer causes heap data disclosure when traffic-engineering routing is enabled (medium 5.3)
- [CVE-2026-101990](https://insights.sbomify.com/CVE-2026-101990/): Junos OS and Junos OS Evolved: A BGP peer causes an rpd crash when flow-spec routes are re-advertised (critical 9.3)
- [CVE-2026-10199](https://insights.sbomify.com/CVE-2026-10199/): Assimp glTF2Asset.h LazyDict null pointer dereference (medium 4.8)
- [CVE-2026-101989](https://insights.sbomify.com/CVE-2026-101989/): Junos OS and Junos OS Evolved: An crafted LDP message causes an rpd crash when LDP is enabled (high 7.1)
- [CVE-2026-101988](https://insights.sbomify.com/CVE-2026-101988/): Junos OS and Junos OS Evolved: An unauthenticated adjacent attacker causes an rpd crash when LDP is enabled (high 7.1)
- [CVE-2026-101987](https://insights.sbomify.com/CVE-2026-101987/): Junos OS and Junos OS Evolved: A specific IS-IS SRv6 packet causes an rpd crash when flexible algorithm is used (high 7.1)
- [CVE-2026-101986](https://insights.sbomify.com/CVE-2026-101986/): Junos OS and Junos OS Evolved: J-Web permits pre-authentication CGI execution (critical 9.3)
- [CVE-2026-101985](https://insights.sbomify.com/CVE-2026-101985/): Junos OS Evolved: PTX Series: An IS-IS peer causes an rpd crash when BIER over IS-IS is enabled (high 7.1)
- [CVE-2026-101984](https://insights.sbomify.com/CVE-2026-101984/): Junos OS and Junos OS Evolved: A BGP peer causes an rpd crash when labeled-unicast aggregate-label is configured (high 7.1)
- [CVE-2026-101983](https://insights.sbomify.com/CVE-2026-101983/): Junos OS and Junos OS Evolved: An attacker causes remote code execution when J-Web virtual-domain is configured (critical 9.3)
- [CVE-2026-101982](https://insights.sbomify.com/CVE-2026-101982/): Junos OS and Junos OS Evolved: A EVPN peer causes an rpd crash or root-level compromise when EVPN-VPWS is used (critical 9.3)
- [CVE-2026-101981](https://insights.sbomify.com/CVE-2026-101981/): Junos OS and Junos OS Evolved: An adjacent LDP peer causes routing-engine compromise when LDP is enabled (high 8.7)
- [CVE-2026-101980](https://insights.sbomify.com/CVE-2026-101980/): Junos OS: Malformed Extended Echo requests cause a Routing Engine reboot when Extended Echo is enabled (critical 9.3)
- [CVE-2026-10198](https://insights.sbomify.com/CVE-2026-10198/): Assimp glTFImporter glTFImporter.cpp ImportMeshes null pointer dereference (medium 4.8)
- [CVE-2026-101979](https://insights.sbomify.com/CVE-2026-101979/): Memory corruption in Junos OS (high 8.7)
- [CVE-2026-101978](https://insights.sbomify.com/CVE-2026-101978/): Command injection in Junos OS Evolved (high 8.7)
- [CVE-2026-101977](https://insights.sbomify.com/CVE-2026-101977/): Junos OS and Junos OS Evolved: A specific BGP packet causes an rpd crash when ephemeral configuration is used (high 8.7)
- [CVE-2026-101976](https://insights.sbomify.com/CVE-2026-101976/): Junos OS and Junos OS Evolved: In a non-4byte-AS scenario a specific BGP update causes an rpd crash (high 8.7)
- [CVE-2026-101975](https://insights.sbomify.com/CVE-2026-101975/): Denial of service in Junos OS (high 7.1)
- [CVE-2026-101974](https://insights.sbomify.com/CVE-2026-101974/): Information disclosure in Junos OS (high 7.1)
- [CVE-2026-101973](https://insights.sbomify.com/CVE-2026-101973/): Junos OS: Malformed packet causes pkid denial of service when certificate re-enrollment is used (high 8.7)
- [CVE-2026-101972](https://insights.sbomify.com/CVE-2026-101972/): Junos OS and Junos OS Evolved: Malformed OSPF packets causes routing disruption when OSPF is enabled (high 7.1)
- [CVE-2026-101971](https://insights.sbomify.com/CVE-2026-101971/): Junos OS and Junos OS Evolved: An attacker causes routing protocol daemon crash when OSPFv3 is enabled (high 7.1)
- [CVE-2026-101970](https://insights.sbomify.com/CVE-2026-101970/): Junos OS and Junos OS Evolved: Specific PIM messages causes rpd crash when multiple-triggered-joins is used (high 7.1)
- [CVE-2026-10197](https://insights.sbomify.com/CVE-2026-10197/): Assimp TF File glTF2Importer.cpp ImportEmbeddedTextures null pointer dereference (medium 4.8)
- [CVE-2026-101969](https://insights.sbomify.com/CVE-2026-101969/): Junos OS and Junos OS Evolved: An unauthenticated attacker causes rpd denial of service when IPv6 PIM is enabled (high 7.1)
- [CVE-2026-101968](https://insights.sbomify.com/CVE-2026-101968/): Integer overflow in Junos OS (medium 5.3)
- [CVE-2026-101967](https://insights.sbomify.com/CVE-2026-101967/): Command injection in Junos OS Evolved (critical 9.3)
- [CVE-2026-101966](https://insights.sbomify.com/CVE-2026-101966/): Junos OS Evolved: A crafted analytics sensor resource causes telemetry dial-out daemon denial of service (high 8.8)
- [CVE-2026-101965](https://insights.sbomify.com/CVE-2026-101965/): Junos OS Evolved: An attacker causes telemetry disruption when network analytics telemetry is enabled (high 8.7)
- [CVE-2026-101964](https://insights.sbomify.com/CVE-2026-101964/): Junos OS and Junos OS Evolved: An attacker can cause an rpd crash via a crafted LDP message (high 7.1)
- [CVE-2026-101963](https://insights.sbomify.com/CVE-2026-101963/): Junos OS and Junos OS Evolved: A BGP EVPN neighbor causes an rpd crash when SRv6 multihoming is used (high 8.7)
- [CVE-2026-101962](https://insights.sbomify.com/CVE-2026-101962/): Denial of service in Junos OS (high 8.7)
- [CVE-2026-101961](https://insights.sbomify.com/CVE-2026-101961/): Null dereference in Junos OS (high 8.7)
- [CVE-2026-101960](https://insights.sbomify.com/CVE-2026-101960/): Junos OS Evolved: QFX Series: A BGP peer causes an rpd crash when global load balancing is enabled (high 7.1)
- [CVE-2026-10196](https://insights.sbomify.com/CVE-2026-10196/): Mail Mint <= 1.31.0 - Unauthenticated PHP Object Injection in Arbitrary Form Fields (critical 9.8)
- [CVE-2026-101959](https://insights.sbomify.com/CVE-2026-101959/): Junos OS and Junos OS Evolved: A malformed LSP-ping causes an rpd crash (high 7.1)
- [CVE-2026-101957](https://insights.sbomify.com/CVE-2026-101957/): Junos OS and Junos OS Evolved: A remote BGP peer causes an rpd crash when long-lived graceful restart (LLGR) is used (high 8.7)
- [CVE-2026-101956](https://insights.sbomify.com/CVE-2026-101956/): Junos OS: Unauthorized root command execution when J-Web is enabled (critical 9.3)
- [CVE-2026-101955](https://insights.sbomify.com/CVE-2026-101955/): Junos OS: SRX Series: Malformed DNS packet causes service disruption when UTM Anti-Spam SBL is used (critical 9.2)
- [CVE-2026-101954](https://insights.sbomify.com/CVE-2026-101954/): Junos OS and Junos OS Evolved: Unauthenticated network access causes full device takeover when J-Web is enabled (critical 9.3)
- [CVE-2026-101952](https://insights.sbomify.com/CVE-2026-101952/): Junos OS and Junos OS Evolved: A specific BGP ISO-VPN update causes an rpd crash when BMP or NSR is enabled (high 8.7)
- [CVE-2026-101951](https://insights.sbomify.com/CVE-2026-101951/): Denial of service in Junos OS (high 8.7)
- [CVE-2026-101950](https://insights.sbomify.com/CVE-2026-101950/): Memory corruption in Junos OS (critical 9.3)
- [CVE-2026-10195](https://insights.sbomify.com/CVE-2026-10195/): FS Poster <= 8.0.1 - Authenticated (Subscriber+) Remote Code Execution via FFmpeg Path Setting (high 8.8)
- [CVE-2026-101949](https://insights.sbomify.com/CVE-2026-101949/): Null dereference in Junos OS (high 8.7)
- [CVE-2026-101948](https://insights.sbomify.com/CVE-2026-101948/): Null dereference in Junos OS (high 8.7)
- [CVE-2026-101947](https://insights.sbomify.com/CVE-2026-101947/): ExifTool for photo and video 5.0.1 - Local OS command injection through filenames during CSV export (high 8.4)
- [CVE-2026-101946](https://insights.sbomify.com/CVE-2026-101946/): Junos OS and Junos OS Evolved: An attacker causes rpd process memory disclosure when IPv6 LDP is used (medium 5.3)
- [CVE-2026-101945](https://insights.sbomify.com/CVE-2026-101945/): Junos OS and Junos OS Evolved: An attacker causes routing daemon denial of service when EVPN BGP is enabled (high 8.7)
- [CVE-2026-101944](https://insights.sbomify.com/CVE-2026-101944/): Junos OS and Junos OS Evolved: An attacker causes a routing protocol daemon denial of service when EVPN is used (high 8.7)
- [CVE-2026-101943](https://insights.sbomify.com/CVE-2026-101943/): Junos OS and Junos OS Evolved: An attacker causes rpd crash and denial of service when EVPN is configured (high 8.7)
- [CVE-2026-101942](https://insights.sbomify.com/CVE-2026-101942/): Junos OS and Junos OS Evolved: An attacker causes rpd denial of service when EVPN route signaling is used (high 8.7)
- [CVE-2026-101941](https://insights.sbomify.com/CVE-2026-101941/): Null dereference in Junos OS (high 8.7)
- [CVE-2026-101940](https://insights.sbomify.com/CVE-2026-101940/): Junos OS and Junos OS Evolved: An attacker causes a routing-daemon crash when BGP ISO-VPN egress protection is enabled (high 8.7)
- [CVE-2026-10194](https://insights.sbomify.com/CVE-2026-10194/): OFFIS DCMTK dcmqrscp dcmqrdbi.cc deleteOldestImages heap-based overflow (medium 5.3)
- [CVE-2026-101939](https://insights.sbomify.com/CVE-2026-101939/): Null dereference in Junos OS (high 8.7)
- [CVE-2026-101938](https://insights.sbomify.com/CVE-2026-101938/): Junos OS and Junos OS Evolved: SRX Series: An attacker causes a forwarding-plane outage when SVR vector routing is used (high 7.1)
- [CVE-2026-101937](https://insights.sbomify.com/CVE-2026-101937/): Junos OS: SRX Series: An attacker causes data-plane denial of service when chassis-cluster high availability is used (high 7.1)
- [CVE-2026-101936](https://insights.sbomify.com/CVE-2026-101936/): Junos OS: SRX Series: An attacker causes data-plane denial of service when chassis-cluster high availability is enabled (high 7.1)
- [CVE-2026-101935](https://insights.sbomify.com/CVE-2026-101935/): Echo Knowledge Base <= 17.214.0 - Reflected Cross-Site Scripting via 'new_kb_config' Parameter (medium 6.1)
- [CVE-2026-101934](https://insights.sbomify.com/CVE-2026-101934/): Junos OS and Junos OS Evolved: An attacker causes Denial of Service in eventd (medium 6.7)
- [CVE-2026-10193](https://insights.sbomify.com/CVE-2026-10193/): OFCMS ComnController ComnController.java query sql injection (medium 5.3)
- [CVE-2026-101928](https://insights.sbomify.com/CVE-2026-101928/): Cross-site scripting in Magic Tooltips For Contact Form 7 (high 7.2)
- [CVE-2026-101927](https://insights.sbomify.com/CVE-2026-101927/): Junos OS and Junos OS Evolved: An unprivileged local attacker causes denial of service or privilege escalation (high 8.6)
- [CVE-2026-101926](https://insights.sbomify.com/CVE-2026-101926/): SQL injection in Hyyan WooCommerce Polylang Integration (medium 6.5)
- [CVE-2026-101925](https://insights.sbomify.com/CVE-2026-101925/): bbp style pack <= 6.4.8 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Author Display Name (medium 6.4)
- [CVE-2026-101924](https://insights.sbomify.com/CVE-2026-101924/): NewStatPress <= 1.4.5 - Unauthenticated Stored Cross-Site Scripting via 'urlrequested' Attribute via Query String (high 7.2)
- [CVE-2026-101923](https://insights.sbomify.com/CVE-2026-101923/): Missing authorization in Photo Reviews for WooCommerce (high 8.1)
- [CVE-2026-101921](https://insights.sbomify.com/CVE-2026-101921/): WPForms <= 2.0.2.1 - Reflected Cross-Site Scripting via 'query_var' Smart Tag in iframe srcdoc Attribute (medium 4.7)
- [CVE-2026-101920](https://insights.sbomify.com/CVE-2026-101920/): Molongui Authorship <= 5.2.12 - Unauthenticated Stored DOM-Based Cross-Site Scripting via Comment href Attribute (high 7.2)
- [CVE-2026-10192](https://insights.sbomify.com/CVE-2026-10192/): Tenda W12 httpd set_local_time_0 stack-based overflow (high 8.7)
- [CVE-2026-101919](https://insights.sbomify.com/CVE-2026-101919/): Hypershift: hypershift: unsanitized kubeconfig passthrough from tenant namespace to control plane (high 8.8)
- [CVE-2026-101918](https://insights.sbomify.com/CVE-2026-101918/): PyJWT: Unauthenticated RecursionError DoS in pre-verification payload parse (PyJWKClient.get_signing_key_from_jwt / verify_signature=False) (medium 5.3)
- [CVE-2026-101917](https://insights.sbomify.com/CVE-2026-101917/): PyJWT: PyJWKClient still amplifies unauthenticated JWKS fetches on unknown kid values (incomplete fix of CVE-2026-48524) (medium 5.3)
- [CVE-2026-101916](https://insights.sbomify.com/CVE-2026-101916/): @grpc/grpc-js: In certain configurations, getAuthContext can return unauthorized certificates as though they were authorized (high 7.4)
- [CVE-2026-101915](https://insights.sbomify.com/CVE-2026-101915/): @grpc/grpc-js: The server transmits some error messages thrown by method handlers to the client in status messages (low 3.7)
- [CVE-2026-101914](https://insights.sbomify.com/CVE-2026-101914/): @grpc/grpc-js: The exact path match matcher incorrectly only applies a prefix match for case-insensitive matches (medium 6.5)
- [CVE-2026-101913](https://insights.sbomify.com/CVE-2026-101913/): ip-address: Address6.isLinkLocal() recognizes fe80::/64 rather than fe80::/10, allowing SSRF and trust-boundary bypass to on-link hosts (medium 6.3)
- [CVE-2026-101912](https://insights.sbomify.com/CVE-2026-101912/): ip-address: isInSubnet() and isHostInSubnet() compare addresses of different families as if they shared an address space, allowing an allowlist check to admit an address outside its range (medium 6.3)
- [CVE-2026-101911](https://insights.sbomify.com/CVE-2026-101911/): ip-address: Address6 builds a parse diagnostic proportional to the input with no length bound, allowing a single long string to stall or crash the process (medium 6.3)
- [CVE-2026-101910](https://insights.sbomify.com/CVE-2026-101910/): ip-address: no classifier recognizes the NAT64 local-use range 64:ff9b:1::/48, allowing SSRF and trust-boundary bypass (medium 6.9)
- [CVE-2026-10191](https://insights.sbomify.com/CVE-2026-10191/): Tenda W12 httpd cgiWifiMacFilterSet stack-based overflow (high 8.7)
- [CVE-2026-101909](https://insights.sbomify.com/CVE-2026-101909/): Axios: Prototype Pollution Gadget in axios toFormData Options (high 8.3)
- [CVE-2026-101908](https://insights.sbomify.com/CVE-2026-101908/): Axios: Prototype pollution gadget in fetch adapter can alter outbound requests (medium 6.9)
- [CVE-2026-101907](https://insights.sbomify.com/CVE-2026-101907/): Axios: maxRedirects: 0 is not enforced by the fetch adapter, allowing redirect-based SSRF (high 7.0)
- [CVE-2026-101906](https://insights.sbomify.com/CVE-2026-101906/): Axios: ReDoS (O(N²)) in shouldBypassProxy host normalization, reachable via untrusted redirect Location (high 8.2)
- [CVE-2026-101905](https://insights.sbomify.com/CVE-2026-101905/): Axios: Node HTTP adapter prototype-pollution gadget allows request socket hijack via inherited createConnection (high 7.6)
- [CVE-2026-101904](https://insights.sbomify.com/CVE-2026-101904/): Axios: Header Injection via Inherited headers After Minimal Interceptor (medium 6.9)
- [CVE-2026-101903](https://insights.sbomify.com/CVE-2026-101903/): Axios: ReDoS in fromDataURI data: URL parser freezes the Node event loop (DoS) (high 8.2)
- [CVE-2026-101902](https://insights.sbomify.com/CVE-2026-101902/): Axios: Prototype-Pollution Gadget in the Default Instance Allows Inherited Object.prototype.method to Override HTTP Method (medium 6.9)
- [CVE-2026-101901](https://insights.sbomify.com/CVE-2026-101901/): Axios: Denial of Service via Unhandled 'error' Event in HTTP/2 ClientHttp2Session Initialization (high 8.2)
- [CVE-2026-101900](https://insights.sbomify.com/CVE-2026-101900/): Axios: Fetch Adapter Header Injection via Inherited FormData getHeaders (medium 6.9)
- [CVE-2026-10190](https://insights.sbomify.com/CVE-2026-10190/): Tenda W12 Web Management httpd cgiSysWebTimeoutSet denial of service (high 7.1)
- [CVE-2026-101899](https://insights.sbomify.com/CVE-2026-101899/): Axios: CIDR-form NO_PROXY entries are ignored, causing proxy exclusion bypass for internal IP ranges (medium 6.9)
- [CVE-2026-101898](https://insights.sbomify.com/CVE-2026-101898/): Axios: HTTP/2 adapter bypasses configured DNS lookup and proxy controls (high 7.0)
- [CVE-2026-101897](https://insights.sbomify.com/CVE-2026-101897/): Angular DevTools (Local DoS) (medium 5.1)
- [CVE-2026-101896](https://insights.sbomify.com/CVE-2026-101896/): Angular: Denial of Service via Numeric URL Matrix Parameters in Server-Side Rendering (SSR) (high 8.2)
- [CVE-2026-101895](https://insights.sbomify.com/CVE-2026-101895/): Angular SSR: Denial of Service (DoS) via Infinite Loop on Malformed DOCTYPE (high 8.7)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/990/