Elevation of privilege in Microsoft SharePoint Server Subscription Edition lets an authenticated, low-privileged user perform actions reserved for higher-privileged accounts over the network, yielding high confidentiality, integrity, and availability impact across the affected server. The flaw is a missing authorization check (CWE-862) rated CVSS 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), so it is not usable by fully unauthenticated outsiders: the attacker must already hold a valid low-privilege SharePoint account and the site must be network-reachable, with no user interaction or non-default configuration required. No public exploit code has been identified at time of analysis and there is no CISA KEV listing, so exploitation requires a motivated authenticated insider or an attacker who has already obtained low-privilege credentials; Microsoft has published a vendor patch, making this a straightforward fix-and-prioritize item for exposed SharePoint deployments.
Authenticated file upload bypass in the FV Flowplayer Video Player plugin for WordPress (all versions up to and including 7.5.54.7212) allows a subscriber-level user to write attacker-supplied content to the server by slipping a crafted filename past the plugin's incomplete check_mimetype extension filter, which performs no MIME inspection and skips the standard WordPress upload helpers, potentially resulting in remote code execution. Exploitation is not unconditional: the plugin's non-default 'profile videos on bio' setting must be enabled so that the required nonce is emitted on the subscriber-accessible profile page, and the attacker must craft a filename that evades the partial extension enforcement; sites that keep registration closed or leave that option disabled are substantially less exposed. The published CVSS 3.1 vector is 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), while the assessed vector applies AC:H to reflect the non-default configuration prerequisite; no public exploit code identified at time of analysis, and the issue was reported by Wordfence.
Authenticated users holding the WordPress Contributor role or higher can delete arbitrary post meta on any post - including content owned by administrators and other higher-privileged users - on sites running the YITH WooCommerce Popup plugin before version 1.60.0, because the plugin fails to verify the requester's capability before performing the deletion. The impact is integrity-only (no confidentiality or availability loss, no code execution), and while publicly available exploit code exists, EPSS is low at 0.16% and there is no CISA KEV confirmation of active exploitation. The vendor has released a fixed version (1.60.0).
Authentication bypass in Progress MOVEit Transfer allows an attacker who already holds a low-privilege authenticated foothold to reach protected functionality by traversing an alternate path or channel that skips the intended authentication and authorization checks, yielding high confidentiality and integrity impact at CVSS 8.8. Only MOVEit Transfer releases prior to 2025.1.6 and 2026.0.0 builds before 2026.0.4 are affected, and because the assessed vector carries PR:L the attacker must already possess some credentialed access, which narrows the exposure compared with an anonymous pre-auth bypass. No public exploit code and no confirmed active exploitation were identified at time of analysis, but the vendor issued a Critical Security Bulletin for this issue, making prompt patching the priority.
Remote code execution in ONLYOFFICE Document Server affects every release before 10.0.0, allowing an attacker who holds a valid Inbox-compatible JWT to run arbitrary OS commands as the ds service account. The flaw lives in the Document Builder API: because the optional third argument of builder.SaveFile() accepts user-controlled converter XML, injecting a duplicate m_sFileTo element overrides the server-generated output path and lets the attacker write outside the designated job directory, overwrite runtime.json, and repoint the Document Builder executable so that commands execute during a subsequent job. No public exploit code has been identified at time of analysis and the issue is not in CISA KEV, but the CVSS 4.0 base score of 8.7 reflects high confidentiality, integrity, and availability impact, with exploitation gated on possession of a JWT signed with the deployment's secret (PR:L).
SQL injection in the Custom Reports module of Progress MOVEit Transfer allows an authenticated low-privilege user to inject arbitrary SQL into report queries, potentially exposing or altering data in the underlying database. Versions before 2025.1.6 and 2026.0.0 through 2026.0.3 are affected; exploitation requires a valid account with access to Custom Reports (CVSS PR:L), no user interaction, and low attack complexity. No public exploit code has been identified at time of analysis, the issue is not in CISA KEV, and EPSS is 0.49% (40th percentile), indicating limited observed exploitation likelihood despite the high CVSS 8.8 impact.
Authenticated SQL injection in WeGIA versions prior to 3.8.6 allows a user with access to the Material & Patrimônio module to inject arbitrary SQL through the id_produto parameter of web/html/matPat/restaurar_produto_desocultar.php, enabling extraction of sensitive database records and modification of institutional and inventory data. The flaw is rated CVSS 3.1 base 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) and requires a valid low-privileged account plus module-level authorization, so anonymous visitors cannot trigger it. No public exploit identified at time of analysis; the vulnerable code path ships by default in affected releases and a vendor fix (3.8.6) is available.
Command injection in the Markdown Preview Enhanced VS Code extension (which bundles the crossnote library) on Windows allows an attacker-controlled Markdown link to execute arbitrary commands with the privileges of the VS Code user. When a victim opens an untrusted Markdown file, previews it, and clicks a crafted external or unsupported-scheme link, the decoded link target is passed to a Windows file-opening helper that invokes child_process.exec with the start command, so embedded cmd.exe metacharacters are interpreted as command separators. The flaw affects versions prior to 0.8.28 (crossnote prior to 0.9.29), requires user interaction (opening the file and one link click), needs no workspace trust, no script execution, and no additional files, and earns a CVSS 3.1 base score of 8.8; no public exploit code was identified at time of analysis and the issue is not in CISA KEV.
Persistent telemetry dial-out denial of service in Juniper Networks Junos OS Evolved allows an attacker with management-plane access to the device's gNMI listener to crash or wedge the jti-dialoutd telemetry process by submitting a crafted analytics sensor resource that is consumed as a format string (CWE-134). Exploitation requires the gNMI listener to be reachable and enabled with telemetry/JTI dial-out configured, and Juniper's description characterizes the actor as authenticated; note that the published CVSS vector lists PR:N, which contradicts that authentication prerequisite and should be reconciled against Juniper advisory JSA112250. Impact is confined to loss of telemetry dial-out and analytics streaming rather than data-plane forwarding, and no public exploit code or confirmed active exploitation was identified at time of analysis.
Missing authorization in the handleLocalTerminal WebSocket handler of Skyhook Radar before 1.12.2 lets an attacker who can reach the /api/local-terminal endpoint spawn an interactive /bin/bash -l shell on the Radar host with Radar's own kubeconfig and process credentials injected into the environment, achieving remote code execution with Radar's privileges. The handler is governed only by a runtime-mode check instead of role-based access control, and per the advisory the exploit still works when the operator has set --disable-local-terminal, so that flag cannot be relied on as a mitigation in vulnerable builds. The vendor's CVSS 4.0 rating is 8.7 (VC:H/VI:H/VA:H, PR:L) while our independent reassessment scores it CVSS:3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, meaning authentication is not reliably enforced despite the PR:L marking; there is no CISA KEV entry and no public exploit code identified at time of analysis, and real-world exposure is chiefly limited by the fact that Radar is a local-first developer tool that is normally bound to localhost on an individual workstation.
LDAP injection in Progress MOVEit Transfer lets an attacker with low-privilege authenticated access manipulate directory queries when the LDAP module is configured, potentially exposing or altering sensitive data. Affected releases are MOVEit Transfer before 2025.1.6 and 2026.0.0 before 2026.0.4; deployments that do not use LDAP-backed authentication or directory lookups are not on the vulnerable code path. No public exploit identified at time of analysis, EPSS is low at 0.41% (34th percentile), and CISA SSVC rates exploitation as none, making this serious but not an emergency for most defenders.
Improper Unicode canonicalization in Progress MOVEit Transfer before 2025.1.6 and in 2026.0.0 through 2026.0.4 allows an authenticated remote attacker to submit crafted encoded input that bypasses input validation, producing high confidentiality, integrity, and availability impact. The CVSS vector requires a low-privileged account (PR:L) with no user interaction (UI:N); EPSS is low at 0.40%, and no public exploit was identified at time of analysis. Vendor patches are available in 2025.1.6 and 2026.0.4.
Cloud Commander (cloudcmd) versions 19.20.2 through 19.21.1 expose a path traversal flaw in the GET /api/v1/pack endpoint that lets unauthenticated remote attackers read arbitrary files outside the configured --root directory, with the stolen content returned as a downloadable tar.gz archive. The root cause is a handler that calls the unguarded root() helper at server/rest/index.js:130 instead of the root.resolve() validation wrapper used on other endpoints, so percent-encoded traversal sequences in the pack path escape the intended document root and reach files such as /etc/passwd or SSH private keys. Impact is confidentiality-only (no write or code-execution primitive), and no public exploit identified at time of analysis, though a vendor patch (v19.21.2) and a public technical write-up are available; exploitation requires network reachability to the cloudcmd HTTP service, which many deployments gate behind localhost binding, a reverse proxy, or optional authentication.
Incorrect authentication-algorithm handling in Progress MOVEit Transfer's SFTP module allows a remote, authenticated low-privilege SFTP user to subvert the module's authentication logic, with assessed high confidentiality, integrity, and availability impact. Affected deployments are MOVEit Transfer before 2025.1.6 and 2026.0.0 through 2026.0.3; vendor-fixed builds are available. No public exploit was identified at time of analysis, and EPSS is low at 0.39% (32nd percentile).
Authentication bypass in PgBouncer 1.17.0 through 1.26.0 allows an authenticated attacker who knows a valid password for at least one user in auth_file to impersonate another user that authenticates via SCRAM, including PgBouncer admin users and backend superusers, by sending a second StartupMessage during the SCRAM exchange against a non-existent database. The issue is rated CVSS 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) and stems from improper authentication (CWE-287). No public exploit identified at time of analysis, and the flaw does not grant access to users not authenticating via SCRAM.
Path traversal in the Khronos NNEF Python tooling allows a local, unauthenticated attacker to create or overwrite .dat weight files outside the intended model directory when a victim converts, saves, or generates weights from a crafted graph.nnef. The flaw affects nnef through 1.0.10 and nnef-tools through 1.0.11 and is triggered by '../' sequences or absolute paths embedded in variable labels, an operation the tool performs as part of its normal workflow. Impact is limited to low-severity file integrity loss within paths writable by the user running the tool, and exploitation requires the victim to open an attacker-supplied model; publicly available exploit code exists, but there is no evidence of confirmed active exploitation (the issue is not in CISA KEV).
Incorrect authorization in the Client Certificates module of Progress MOVEit Transfer lets an attacker who already holds a valid low-privilege account escalate to full control of managed file-transfer data and configuration (CVSS 8.8, PR:L/AV:N). Affected builds are all releases before 2025.1.6 and 2026.0.0 through 2026.0.3, and the Client Certificates feature must be in active use for the flawed authorization path to be reachable. There is no public exploit code identified at time of analysis and EPSS sits at roughly 0.21% (11th percentile), so risk is real but not urgent; a vendor patch is available per the Progress September 2026 security bulletin.
Improper access control in the export settings feature of SonicWall Network Security Manager (NSM) on-prem let a remote authenticated attacker with only low-privilege NSM credentials retrieve sensitive information that should be restricted to higher-privileged users, which the vendor states could be used to escalate to administrator or to intercept other NSM users' communications. Affected deployments are NSM on-prem 4.3.1 and earlier; the hosted/SaaS NSM is not indicated as in scope, and exploitation requires a valid account plus access to the export settings functionality (CVSS 8.8, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). There is no public exploit code identified at time of analysis, no confirmed active exploitation (SSVC Exploitation: none), and EPSS is low at 0.20% (10th percentile), so this is a genuine but not emergency-grade priority - its realistic impact presumes a multi-user NSM deployment in which other privileged accounts or traffic exist to leverage.
SQL injection in Redash (versions after 8.0.0 through 26.9.0) lets an authenticated user with view-only access to both the Query Results data source and a referenced data source inject arbitrary SQL that runs with the referenced data source's privileges. The flaw lives in redash/query_runner/query_results.py, where param_query_N_{key=value} parameters were substituted into the target query's SQL via replace_query_parameters() rather than through the ParameterizedQuery schema validator, and where the is_safe permission check was skipped; the vendor CVSS 4.0 base score is 8.7, and no public exploit code or CISA KEV entry was identified at time of analysis. Because exploitation requires valid credentials plus dual data-source access, this is realistically an insider or compromised-account risk, with the greatest exposure in deployments that grant low-privilege users view-only access to sensitive referenced data sources.
Parsing a crafted ADF node header in CGNS through 4.5.2 triggers a stack out-of-bounds read that can crash downstream tools such as cgnslist, giving an attacker a local denial-of-service against the parsing application. The flaw lives in ADFI_read_node_header (src/adf/ADF_internals.c), where an end tag that is not NUL-terminated causes ADFI_stridx_c to scan past the disk_node_data buffer. Publicly available exploit code exists (a HackMD proof-of-concept write-up referenced in the CVE record), but there is no confirmed active exploitation per CISA KEV, and there is no remote or network-triggered path: the victim must locally open an attacker-supplied .cgns or .adf file, and the worst outcome is a process crash with no code execution, data disclosure, or integrity loss.
Stack out-of-bounds read in vgmstream through r2117's G.722.1/Siren14 decoder can be triggered when a victim opens or lets a vgmstream-based application process a crafted .s14 or .sss file, causing an application crash. The issue is local-vector with passive user interaction and is availability-only, consistent with an assessed CVSS 3.1 score of 4.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L). Publicly available exploit code exists, but no CISA KEV confirmation is provided.
Privilege escalation in Red Hat OpenShift Container Platform 4's insights-runtime-extractor DaemonSet lets an authenticated low-privileged tenant who can schedule a pod on a node run attacker-controlled code as root in the host user namespace. The extractor scanner enters the workload's namespaces and executes the workload's argv[0] via exec.Command after only seteuid() has changed, leaving real/saved UID 0 and retaining capabilities; a malicious pod binary matching node, python, python3, MainThread, or any path containing java can call setuid(0) and reach the host CRI-O socket from the inherited cwd. CVSS 8.8 (AV:L/PR:L/S:C) reflects local, non-network exploitation requiring workload scheduling, and no public exploit was identified at time of analysis.
Progress MOVEit Transfer versions before 2025.1.6 and from 2026.0.0 before 2026.0.4 assign incorrect permissions to a critical resource, allowing an authenticated low-privileged user who already has local or session access to read and modify resources beyond their intended privilege boundary, yielding high confidentiality and integrity impact (CVSS 8.8, CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H). The prerequisite of a valid low-privileged account plus local/session access - rather than anonymous remote reach - keeps this a conditional, post-authentication escalation issue; no public exploit code has been identified at time of analysis and the CVE is not listed in CISA KEV. There is no EPSS score in the supplied data, so exploitation likelihood is judged from the assessed vector alone; because this is a file-transfer platform typically holding regulated data, the impact of success is high even though the entry bar is elevated.
A use-after-unmap in DPDK's vhost library gives a local attacker who controls a VDUSE (vDPA Device in USErspace) backend, or a guest able to drive IOTLB invalidations on the vhost device, a path to memory corruption inside the host vhost process. The flaw is that the VDUSE handler does not invalidate cached vring pointers when the IOTLB is invalidated, so the code keeps dereferencing vring addresses that have already been unmapped - a classic CWE-416 use-after-free. The assessed CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H, base 8.8) marks this as locally reachable, low-complexity and low-privilege, with a scope change (S:C) reflecting that a confined guest/userspace VDUSE device can compromise the host vhost trust boundary; impact is full confidentiality, integrity and availability loss. No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV, so risk is concentrated in multi-tenant virtualization and NFV hosts that specifically enable DPDK VDUSE. Affected packages are Red Hat's Fast Datapath DPDK channel for RHEL 8, 9 and 10, with downstream exposure noted for RHEL, OpenShift Container Platform 4 and OpenStack Platform 13 Queens.
An authenticated format-string vulnerability in the gRPC daemon that backs the gNMI service on Juniper Networks Junos OS Evolved lets a network attacker who holds valid low-privileged credentials feed crafted format specifiers into a telemetry code path, with potential outcomes ranging from telemetry-service disruption and information disclosure up to root-level code execution. The flaw is rated CVSS 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), so exploitation is remote but requires an authenticated session against an enabled, network-reachable gNMI interface - it is not reachable by a fully anonymous attacker. At the time of analysis there is no CISA KEV entry and no public exploit code identified, and the vendor has published advisory JSA112250; this is a credible priority for organizations running Evolved with gNMI exposure, but not a drop-everything emergency on the available signals.
Remote code execution with root privileges or denial of service in Juniper Networks Junos OS on SRX Series devices is possible through a stack-based buffer overflow in the iked IKE key-management daemon. An authenticated remote-access VPN client on an SRX running affected Junos OS releases can exploit the remote-access VPN authentication and JIMS identity-publishing path; deployments not using remote-access VPN or JIMS identity publishing are not exposed. No public exploit code has been identified at time of analysis, but a vendor patch is available and the vendor CVSS score is 8.7 with high confidentiality, integrity, and availability impact.
Remote, unauthenticated attackers can crash the na-grpcd daemon on Juniper Networks Junos OS Evolved by sending a crafted gRPC telemetry subscription request, causing a denial of service. This affects devices where the gRPC telemetry subscription service is enabled and reachable; no public exploit code is known, and the process restarts automatically, limiting outage duration. The CVSS 4.0 score is 8.7 (High), while the independent assessment rates availability impact as High (CVSS 3.1 vector: AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).
Denial of service in Juniper Networks Junos OS and Junos OS Evolved arises when the routing protocol daemon (rpd) dereferences a NULL pointer while processing multiple BGP UPDATE messages delivered over a single TCP session, but only with the non-default 'bgp family l2vpn auto-discovery-only' BGP family configured. A remote BGP peer can crash rpd and interrupt routing services on the affected device; the daemon recovers, and there is no confidentiality or integrity impact. Exploitation requires an already-established, configured BGP adjacency rather than arbitrary internet access, and no public exploit code or confirmed active exploitation was identified at time of analysis.
Denial of service in Juniper Networks Junos OS and Junos OS Evolved allows a remote attacker who already holds an established EVPN BGP peering relationship with a target device to disrupt the routing protocol daemon (rpd) by sending EVPN BGP routes that trigger an integer overflow or wraparound. The flaw affects EVPN-enabled routing instances and can tear down control-plane adjacencies and halt route processing, producing an availability-only impact with no confidentiality or integrity effect. EVPN is a deliberately configured, non-default feature and the peering trust relationship must pre-exist, so realistic exploitation is limited to EVPN deployments and adjacent or compromised BGP peers; no public exploit code was identified at time of analysis, and the vendor advisory is Juniper JSA112187.
A malformed or misdirected BGP route update can crash the routing protocol daemon (rpd) on Juniper Networks Junos OS and Junos OS Evolved, taking down the control plane that maintains routing state across the device. The trigger is narrow but fully remote: a Long-Lived Graceful Restart (LLGR) stale route that is readvertised into a peer group that has not negotiated LLGR causes rpd to hit an improper-initialization condition (CWE-665) and abort. Per the CVSS vector the issue is unauthenticated (PR:N) on the network (AV:N) with high availability impact only, but the attacker must control or be an established BGP peer able to inject the stale route, so an existing adjacency is a practical prerequisite. No public exploit code has been identified at time of analysis and the flaw is not confirmed as actively exploited (no CISA KEV listing); Juniper has released fixed software per advisory JSA112187, making this a patch-now availability risk for BGP-running fleets rather than an emergency.
Unauthenticated remote attackers can disable every installed plugin on JTL-Shop installations - including payment and shipping integrations - by toggling the plugin safe mode through the administration backend's logout route, which is processed before the request's authentication state is checked (CWE-306). The attack needs a single request, no credentials and no user interaction, and can be automated across many installations to produce a shop-wide denial of service; CVSS v4.0 rates it 8.7 with availability-only impact, and no public exploit code or CISA KEV listing was identified at time of analysis. Because the flaw lives in middleware ordering, exploitation works against default configurations wherever the admin backend is network-reachable, and impact is confined to availability - no data disclosure or code execution.
Uncontrolled HTTP/2 flow-control resource consumption in mtrudel/bandit 1.4.0 and later lets an unauthenticated remote peer hold server-side stream processes - together with their Plug conn state and any resource held mid-response - alive indefinitely by dripping small WINDOW_UPDATE frames just before each 15-second send deadline expires. Because both the connection-level (finish_data/5 re-queues the pending send with a fresh expires_at) and stream-level (send_data/3 recurses and re-arms read_timeout) deadline resets fire on partial progress, and the two paths are independent, an attacker can repeat the trickle across many streams and connections to exhaust processes and memory in a denial of service reachable with no authentication and no user interaction (CVSS 4.0 base 8.7; assessed CVSS 3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). No public exploit code or confirmed active exploitation was identified at time of analysis; an upstream fix commit is available and the issue is limited to bandit 1.4.0 and later.
Missing authorization in Swetrix's ProjectController.addProject allows any authenticated user - including a self-registered low-privilege account - to hijack an arbitrary project by moving it into an organisation they control, simply by submitting the victim's public tracking ID. Once ownership is transferred, the attacker can read the project's analytics, change its settings, or delete it, with no victim interaction required; the only prerequisites are an account on the same Swetrix instance and knowledge of the target's tracking ID, which is intentionally exposed in client-side tracking snippets. Exploitation is limited to individually targeted projects (one tracking ID per hijack) with no cross-system scope change, and no public exploit code has been identified at time of analysis, though the flaw is a genuine, actionable broken-access-control issue (CVSS 8.7 4.0 / 8.8 3.1, CWE-862) fixed in Swetrix 5.1.0.
Guest-to-host out-of-bounds access in DPDK's vhost-crypto backend lets a low-privileged guest VM that is already attached to a vhost-crypto device corrupt host-side memory by racing the host's two reads of an indirect-descriptor next index, a classic TOCTOU double-fetch (CWE-367). Only hosts running DPDK with lib/vhost's vhost-crypto library enabled and actually processing indirect descriptors are exposed, and the race makes reliable exploitation non-trivial - the assessed vector is AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H, reflecting host-local reach via the guest with cross-boundary (guest-to-host) scope change. Red Hat tracks this for Fast Datapath packages on Red Hat Enterprise Linux 8, 9 and 10; no public exploit code has been identified at time of analysis and there is no CISA KEV entry. Realistic exposure is limited to multi-tenant, untrusted-guest or confidential-computing style deployments where the vhost-crypto feature is deliberately enabled.
PHP object injection in the Brainstorm Force SureCart WordPress plugin (all versions through 4.9.3) lets a low-privilege authenticated attacker supply untrusted serialized data that the plugin deserializes, enabling arbitrary object instantiation and, where a usable gadget chain exists in the plugin or its dependencies, escalation to code execution or full site compromise. The CVSS 3.1 base score is 8.8 (High) with vector AV:N/AC:L/PR:L/UI:N and High confidentiality, integrity, and availability impact, and no user interaction is required; exploitation still depends on reaching the specific vulnerable deserialization endpoint and on the presence of a suitable gadget chain. No public exploit code was identified at time of analysis, and the CVE is not confirmed as actively exploited (CISA KEV).
Crafted SCTP network traffic can drive the netsctp.ko kernel module on Juniper MX Series routers running affected Junos OS releases into an infinite loop, stalling the SCTP processing path and producing a denial of service against the device. Exploitation is unauthenticated and requires no user interaction (PR:N/UI:N per the assessed vector) - the attacker only needs network reachability to a device that is actually processing SCTP traffic, which in practice means MX platforms used in telecom/mobile signaling roles; routers that do not handle SCTP are not exposed. The vendor has published an advisory and fixed releases, and no public exploit code or confirmed active exploitation was identified at time of analysis (this CVE is not associated with CISA KEV), so the primary risk driver is the size of the exposed, SCTP-handling MX population rather than demonstrated in-the-wild abuse.
Second-factor authentication bypass in TSplus Remote Access lets an attacker who already holds a valid username and password complete the login without ever supplying a valid MFA token, granting access to the protected applications and resources that MFA was meant to guard. The flaw is authenticated (PR:L) and remotely reachable over the network (AV:N) with no user interaction required, and it carries high confidentiality, integrity, and availability impact (CVSS 4.0 base 8.7; independent assessment CVSS 3.1 8.7). No public exploit code has been identified at time of analysis, and the issue is not confirmed actively exploited (CISA KEV); however, because the defect neutralises a control that many operators rely on as their primary protection for a remote-access gateway, it warrants priority remediation regardless of the absence of exploitation telemetry.
Denial of service in Juniper Networks Junos OS and Junos OS Evolved, where a specifically malformed BGP UPDATE sent by an eBGP peer that did not negotiate the four-octet-AS (RFC 6793) capability triggers an out-of-bounds write in the routing protocol daemon (rpd), disrupting or crashing the routing control plane on affected devices. The CVSS 4.0 vector (8.7, AV:N/AC:L/PR:N/UI:N/VA:H/SA:L) and the independent CVSS 3.1 assessment (AV:N/AC:L/PR:N/UI:N/C:N/I:N/A:H) both characterize this as a pure availability-only flaw with no confidentiality or integrity impact. Although PR:N, exploitation is not reachable by an arbitrary off-path internet host: the attacker must hold (or be able to spoof/inject into) an established eBGP session with the target device, and the device must be running BGP with at least one such eBGP neighbor. No public exploit code has been identified at time of analysis and there is no CISA KEV confirmation of active exploitation; Juniper has released fixed builds.
A malformed SRv6 structure within an EVPN route update can crash the routing protocol daemon (rpd) on Juniper Junos OS and Junos Evolved, causing a denial of service that disrupts routing adjacencies. The vulnerability affects specific versions of Junos OS and Junos Evolved, and exploitation requires the attacker to be a configured EVPN signaling peer with SRv6 enabled; it is not exploitable by arbitrary off-path hosts. While the CVSS 4.0 score is 8.7, the impact is availability-only; no public exploit code has been identified at time of analysis, and the vendor has released patches.
Malformed BGP EVPN NLRI sent to the routing protocol daemon (rpd) crashes rpd on Juniper Networks Junos OS and Junos OS Evolved, disrupting routing on the affected device until the daemon restarts automatically (CVSS 4.0 base 8.7; assessed CVSS 3.1 7.5 with availability-only impact). Only devices that have BGP EVPN configured with an established peering session are reachable: the attacker must act as a configured BGP EVPN peer - a controlled or compromised peer, or an on-path injection into that session - and needs no credentials or user interaction on the target (PR:N/UI:N). Affected releases span multiple Junos OS and Junos OS Evolved branches (23.2 through 26.2), and no public exploit code or confirmed active exploitation was identified at time of analysis; a vendor patch is available.
The Juniper Junos OS routing process (rpd) can be crashed by a configured BGP-LS peer sending a specially crafted BGP-LS update, resulting in a denial of service. This reachable assertion vulnerability (CWE-617) affects Junos OS and Junos OS Evolved only when BGP-LS is configured and a peering session is established, requiring the attacker to be an already-trusted, configured BGP-LS peer. No public exploit code or active exploitation has been identified at the time of analysis, but the CVSS score of 8.7 reflects the high availability impact.
Denial of service in Juniper Networks Junos OS and Junos OS Evolved: the Layer 2 address learning daemon (l2ald) contains an integer overflow/wraparound (CWE-190) that can be triggered by a crafted EVPN Type-2 (MAC/IP) route advertisement, causing the process to fail and disrupting EVPN-based Layer 2 forwarding. Affected are devices running EVPN with an established, configured BGP peering session; the attacker must control one of those configured EVPN BGP peers, so exposure is limited to environments where EVPN is deployed and peer trust is not strictly enforced. CVSS 8.7 (CVSS 4.0) and 3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H; no public exploit code was identified at time of analysis and the flaw is not confirmed actively exploited (CISA KEV). This is a credible operational priority for networks running EVPN, though not a mass-exploitation threat.
Denial of service in Juniper Networks Junos OS and Junos OS Evolved affects the rpd routing process, which can be disrupted when a configured MVPN neighbor sends a crafted BGP MVPN update to a device running a non-default inter-region segmented VRF configured with 'protocols mvpn inter-region-template'. Exposure is narrow but real: the target must have that specialized multicast-VPN configuration and an established BGP MVPN peering relationship with the sender, and the CVSS 4.0 vector is unauthenticated (PR:N) with network reachability. Impact is availability-only (rpd disruption with automatic recovery, no confidentiality or integrity loss), the base score is 8.7 High with a low subsequent-system availability effect (SA:L) indicating a scope-crossing impact on routing, and no public exploit code or confirmed active exploitation is identified at time of analysis.
A NULL pointer dereference in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved crashes the daemon and causes a denial of service when a routing policy that uses AS-path expansion is evaluated against MSDP or PIM data. Exploitation is constrained by non-default configuration: the device must have MSDP or PIM enabled together with an AS-path-expansion policy, and the attacker must either already be a configured MSDP peer or be an adjacent PIM sender able to inject PIM messages. Juniper rates the 4.0 base score at 8.7 with network reach, low complexity, and PR:N per the vector, but the real limiting factors are positional (established peering or adjacency) and configuration-specific rather than arbitrary-internet reachable; impact is availability only, with no data exposure, integrity loss, or code execution, and no public exploit identified at time of analysis.
Malformed BGP labeled-unicast UPDATE messages can crash the routing protocol daemon (rpd) in Juniper Networks Junos OS and Junos OS Evolved, producing a denial of service on affected routers (CVSS 8.7). Per the vendor CVSS vector the attack is unauthenticated (PR:N), but exploitation in practice requires two concrete preconditions: the sender must be a configured eBGP neighbor with an established BGP peering session to the target, and the affected BGP multipath features must be enabled on the router, with the trigger arriving as labeled-unicast UPDATEs. Impact is availability only - rpd crashes with no confidentiality or integrity effect - and no public exploit code has been identified at time of analysis, so this is primarily an operational-availability risk for Juniper networks that peer eBGP with external or less-trusted parties and run multipath.
A crafted BGP route update sent by an adjacent eBGP peer can crash the routing protocol daemon (rpd) on Juniper Networks Junos OS and Junos OS Evolved devices that have RIB sharding enabled, producing a denial-of-service condition affecting routing availability. Per the independent assessment, exploitation requires two non-trivial preconditions: RIB sharding must be explicitly configured (it is not a default setting), and the attacker must already hold an established eBGP peering session with the target; the assessed vector (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) is unauthenticated but adjacent, with availability-only impact and no confidentiality or integrity effect. There is no public exploit identified at time of analysis and no CISA KEV listing, so this is a high-severity but condition-gated DoS rather than a code-execution or data-exposure flaw; devices without RIB sharding or peering only with trusted neighbors are not realistically exposed.
Juniper Networks Junos OS and Junos OS Evolved can have their routing protocol daemon (rpd) crashed by a crafted BGP route update, producing a routing-layer denial of service on devices that combine extended next-hop tunneling with SRv6 service processing. Only deployments with both of these non-default, service-provider-oriented features active are exposed, and the traffic must arrive over an established BGP peering session, so real-world exposure is narrow; the impact is availability-only with no confidentiality or integrity loss. No public exploit code and no CISA KEV entry were identified at time of analysis, and the referenced Juniper advisory (JSA112187) is the authoritative source for affected versions.
Crafted BGP route updates sent by an established BGP peer can trigger an integer overflow in the rpd routing daemon of Juniper Networks Junos OS and Junos OS Evolved, crashing the process and causing a denial of service. The flaw is only reachable when the non-default extended-nexthop-tunnel feature is explicitly enabled on the target device, and the attacker must already hold a configured BGP peering relationship with the device, meaning a trusted routing position is a prerequisite rather than anonymous internet exposure. No public exploit code or confirmed active exploitation has been identified at time of analysis, and the vendor CVSS 4.0 score of 8.7 reflects high availability impact on the local system with no confidentiality or integrity exposure; note that the vendor vector lists PR:N while the vendor's own description and our assessment specify an authenticated BGP peer, a conflict that should be resolved using the description's authentication requirement.
Denial of service in Juniper Networks Junos OS Evolved can be triggered by a crafted SNMP query to the firewall-counter MIB, causing the fwstatsd daemon to hit a reachable assertion and terminate, which disrupts device availability when at least one firewall counter is configured. The advisory describes an authenticated network attacker and the independent assessment's CVSS 3.1 vector (PR:L) reflects an authenticated prerequisite, while the supplied CVSS 4.0 vector lists PR:N, an inconsistency that should be verified against Juniper's advisory. No public exploit code or active exploitation has been identified at time of analysis.
A crafted BGP-LS Link NLRI advertisement sent over an established BGP-LS peering session can trigger a reachable assertion inside the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved, causing rpd to crash and disrupting the device's routing control plane. Impact is limited to availability - no code execution, data disclosure, or integrity impact occurs - and only devices explicitly configured with BGP-LS and peered with the attacker's BGP-LS speaker are exposed, meaning the attacker must occupy or control one of the operator-provisioned BGP-LS peers. This is a credible operational-risk denial-of-service issue rather than a code-execution or data-breach threat; no public exploit code identified at time of analysis, and vendor patches are available per Juniper advisory JSA112187.