SQL injection in the Koha integrated library system's Most-circulated items report (reports/cat_issues_top.pl) allows an authenticated staff account holding the reports module permission - explicitly not requiring superlibrarian - to inject arbitrary SQL through the Criteria, Filter, and Limit request parameters and read any table reachable by the Koha database user, including borrower userids, bcrypt password hashes, two-factor secrets, api_keys, and sessions. The flaw is rated CVSS 7.2 (CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:L) and our independent assessment concurs it is a genuine, well-characterized CWE-89 injection that merits prompt patching but is not a drop-everything emergency, principally because the PR:L staff-authentication-plus-reports-permission gate blocks any unauthenticated path. No public exploit code has been identified at time of analysis: this CVE is not in CISA KEV and there is no confirmed active exploitation. Patched releases are available in Koha 24.11.19, 25.05.14, 25.11.08, and 26.05.03.
A denial of service in Juniper Networks Junos OS and Junos OS Evolved can be triggered by an adjacent, unauthenticated attacker who sends crafted IS-IS traffic to a device where both IS-IS link protection and backup-selection are configured, causing an out-of-bounds write in the routing protocol daemon (rpd) that crashes or destabilizes the device. Only routers running these non-default IS-IS feature combinations are exposed, and the attacker must already hold a Layer 2 segment or IS-IS adjacency position (adjacent network, AV:A) rather than reaching the device over the internet. No public exploit code or confirmed active exploitation has been identified at time of analysis, and Juniper has released fixed Junos OS and Junos OS Evolved builds.
Stored cross-site scripting in n8n allows an authenticated member-level user to execute arbitrary script in the n8n origin of any higher-privileged user - typically the instance owner - who opens the attacker's crafted upload in the file-preview modal. The modal re-publishes uploaded binary data as an unsandboxed, same-origin blob URL, so the injected payload runs with the victim's session context, enabling theft of session material or privileged actions within the workspace. Exploitation requires a valid member account with upload rights (PR:L) and the victim to actively open the file (UI:A); no public exploit code has been identified at time of analysis, and the flaw is patched in n8n 1.123.83, 2.41.4, and 2.42.1.
Credential exfiltration in n8n versions before 2.41.4 and 2.42.0 before 2.42.1 allows an authenticated editor on a multi-user instance to abuse a shared workflow's 'Message an Agent' node in inline mode, causing the owner's stored credentials to be resolved and sent to an attacker-chosen destination. The flaw is an access-gated authorization bypass (CWE-863) requiring editor rights and a shared workflow that references higher-trust credentials; single-operator self-hosted deployments have limited practical exposure. No public exploit was identified at time of analysis.
Missing authorization checks in VentureDrake Laravel CRM before 2.4.0 allow any authenticated user holding a low-privilege Spatie role - including read-only accounts - to modify deals, quotes, orders and invoices by invoking Livewire action methods such as delete, won, lost or reopen on components like DealIndex, or by reaching the unguarded Activities and Products routes. The flaw is rated CVSS 4.0 7.1 (High) and requires only a valid non-privileged login (PR:L), with no user interaction and no administrative rights; the integrity impact is high while confidentiality and availability are unaffected. No public exploit code or confirmed active exploitation was identified at time of analysis, and a vendor patch is available in version 2.4.0.
PHP object injection in the Polylang WordPress translation plugin through version 3.8.9 lets an authenticated high-privileged user (CVSS PR:H, typically a WordPress administrator) feed untrusted serialized data into a PHP unserialize() call, which can corrupt application state and, if a usable POP gadget chain exists in WordPress core, Polylang, or another installed component, escalate to code execution or file manipulation. There is no public exploit code identified at time of analysis and no indication of active exploitation (not CISA KEV), so practical risk is currently gated by the administrator-equivalent access requirement rather than by exploitability of the deserialization primitive alone.
Authenticated SQL injection in the Yiuman Citrus Java framework (versions through 0.15.0) allows any user with a valid low-privilege account to inject arbitrary SQL into the ORDER BY clause by tampering with the sortBy request parameter. The flaw lives in the citrus-support generic query helper and is reachable through any generic list route on controllers extending BaseQueryController or BaseQueryRestful, which means every application built on the framework that exposes such a route inherits the exposure. Impact is read-only database disclosure achieved through boolean- or time-based blind inference rather than direct record retrieval, and exploitation requires both valid credentials and a deployed, reachable generic query endpoint; no public exploit code was identified at time of analysis and the CVE is not in CISA KEV, so this should be treated as a moderate-severity, externally exploitable information-disclosure risk rather than an active campaign.
Authenticated SQL injection in Dromara Skyeye (all builds through commit 65d3ddcede70) lets any low-privileged user read arbitrary data from the backend database, including records belonging to other tenants, by sending crafted 'keyword' values to the queryWarehousingDetails and queryOutgoingDetails ERP statistics endpoints. The flaw is reachable over the network with only a valid low-privilege account (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N; vendor score 7.1 under CVSS 4.0), needs no user interaction, and impacts confidentiality only - there is no evidence of data modification or code execution. No public exploit code has been identified at time of analysis and the CVE is not listed in CISA KEV; a detailed public technical writeup exists, and the issue is a genuine but moderate-priority finding whose main limiting factor is the authentication requirement.
Path traversal in F´ (F Prime) prior to 4.3.0 lets an authenticated peer on the file-uplink channel write or overwrite files at attacker-chosen writable filesystem locations by supplying a crafted destination path in a Fw::FilePacket::StartPacket. The flaw yields high integrity impact and limited availability impact (overwriting or damaging critical files), with no confidentiality impact, and CVSS reflects PR:L because the attacker must already be able to send file-uplink packets to Svc::FileUplink. The issue requires no non-default feature toggle once uplink access is obtained, and no public exploit code has been identified at time of analysis; vendor-released patch: 4.3.0.
Missing authorization in jshERP through 3.6 lets any authenticated low-privilege user hit POST /user/batchSetStatus and mass-change account status for other users in the same tenant, disabling every non-owner account - including administrator accounts - or re-enabling previously disabled ones. Exploitation requires only a valid low-privilege account and network reachability to the endpoint (CVSS PR:L, no user interaction), which confines realistic risk to insiders or anyone who can obtain low-privilege credentials. No public exploit code or confirmed active exploitation was identified at time of analysis; the CVSS 4.0 score of 7.1 (HIGH) and the independent 3.1 assessment (7.1, AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H) are driven almost entirely by availability impact, with confidentiality untouched and integrity only partially affected.
youlai-mall through commit 9f62de8 fails to enforce member-level ownership on its app order-list endpoint, allowing any authenticated member to enumerate and read every customer's order records-including order IDs, order serial numbers, member IDs, payment amounts, and order statuses. The flaw is a missing authorization check (CWE-639) exploitable with a self-registered low-privilege account; no public exploit code or active exploitation is confirmed at time of analysis. The independent assessment rates this as a high-confidentiality, read-only disclosure with no integrity or availability impact, and exploitation requires the affected instance to expose the app order endpoint to authenticated users.
Denial of service in Juniper Networks Junos OS arises from improper handling of highly compressed data (CWE-409) in the gRPC library used by the na-grpcd daemon, letting an attacker who can reach that interface crash or exhaust it with a crafted compressed gRPC request. Exploitation requires network reachability to na-grpcd plus valid low-level credentials (CVSS 4.0 scores this 7.1; independent assessment maps it to CVSS 3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H), so it is not reachable by fully unauthenticated attackers under default posture. Affected are Junos OS trains below the vendor's fixed maintenance releases (for example 23.2R2-S7.7, 24.2R2-S5.5, 24.4R2-S5, 25.2R2-S2, 25.4R1-S3, 26.2R1-S2); no public exploit identified at time of analysis, and impact is confined to availability of the targeted service with no confidentiality or integrity loss.
Authenticated SQL injection in InvoiceShelf before 2.4.0 allows any logged-in user to inject arbitrary SQL expressions into the ORDER BY clause of invoice and other list endpoints, enabling boolean-based blind extraction of database contents. The flaw stems from the orderByField query parameter being passed unfiltered into Laravel Eloquent orderBy() calls across multiple model scopes, including Invoice::scopeApplyFilters; an attacker with a valid low-privilege account - potentially an untrusted outsider on deployments that permit self-registration or multi-tenancy - can therefore read data beyond their authorization. Exploitation is confirmed to require authentication, is limited to confidentiality impact (no writes or denial of service), and proceeds slowly through blind inference. No public exploit code was identified at time of analysis and the issue is not listed in CISA KEV; the vendor has released a fix in version 2.4.0.
Malformed 802.1Q Ethernet frames can panic or corrupt the network receive path in Zephyr RTOS builds that have CONFIG_NET_VLAN=y and a VLAN enabled on the receiving Ethernet interface. ethernet_recv() checks only that the first buffer holds a 14-byte plain Ethernet header, then reinterprets that same buffer as an 18-byte VLAN header when the ethertype is 0x8100, reading the TCI and inner ethertype from offsets 14-17 beyond the buffer's length and raising hdr_len to 18 so net_buf_pull() removes more bytes than exist. A single unauthenticated 14-17 byte broadcast frame with ethertype 0x8100 and TCI 0x0000 suffices, reachable by an adjacent/link-local attacker or a malicious USB host through the CDC ECM/NCM gadget classes; assertion-enabled builds panic (denial of service), while production builds with assertions and CONFIG_NET_BUF_HARDENING disabled suffer a uint16_t length underflow to 65534 that leaves later parsers reading far outside the fragment, giving out-of-bounds access with information-disclosure and corruption potential. No public exploit identified at time of analysis; exploitation is gated by the non-default VLAN configuration and hardware VLAN tag stripping absent.
Malformed firewall-authentication synchronization traffic delivered over a chassis-cluster fabric link can trip a reachable assertion in the srxpfe process on Juniper Networks SRX Series devices running Junos OS, aborting the packet forwarding engine and causing a denial of service of the data plane for traffic traversing the cluster. Exposure is limited to SRX platforms deployed in chassis-cluster high-availability configurations where firewall-authentication synchronization is in use; standalone SRX devices and clusters that do not use that synchronization mechanism are unaffected, and the attacker must already have a position on the normally dedicated point-to-point fabric interconnect (logically adjacent, with no authentication or user interaction required per the assessed vectors). At the time of analysis no public exploit code and no confirmed active exploitation were identified; the CVSS 4.0 base score is 7.1 with availability-only impact (VC:N/VI:N/VA:H), and the vendor advisory is Juniper JSA112186.
Authenticated RDP clients can force unbounded server-side memory allocation in FreeRDP 2.0.0 through 3.31.x by sending a seven-byte DATA_FIRST message on an already-opened dynamic virtual channel (DVC) that declares a large 32-bit length, driving zeroed resident-memory growth until the server's resources are exhausted and service is denied. The flaw is availability-only (CWE-400 resource exhaustion; CVSS 4.0 base 7.1, assessed as CVSS 3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) with no code execution or data disclosure impact, and every action requires a valid authenticated session plus a successfully opened DVC - so real exposure depends on who can authenticate to the RDP service, and it is not remotely exploitable without credentials. No public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis.
Memory exhaustion in the l2ald (Layer 2 address learning) daemon of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent, unauthenticated attacker to cause a denial of service against the device by sending crafted packets, but only when the non-default static MAC-IP EVPN feature is configured. The flaw is tracked as CWE-401 (Missing Release of Memory after Effective Lifetime), meaning the daemon fails to free memory it has allocated, so repeated crafted traffic can drain resources and disrupt the l2ald process; per the assessed vector (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) impact is availability-only and the attacker must sit on the same Layer-2 segment as the target. No public exploit code and no confirmed active exploitation were identified at time of analysis, and realistic risk is limited because the static MAC-IP feature is not enabled by default and routed/remote attackers cannot reach the vulnerable path.
Authenticated buyers on BizSpring Shop and BizSpring Java Mall (BizSpring Shop through commit cf22d39daaf1; Java Mall through commit 369e88c5) can mark orders as paid without any real payment by first generating a payment log via /member/payment/load and then invoking the test/debug handler /member/payment/test_post_pay_{paymentLogSn} (PaymentController.testPostPay). The handler performs no authenticity verification of the payment (CWE-345), so an attacker can obtain goods for free, and by supplying another member's paymentLogSn can also settle other users' orders through an IDOR variant. The flaw is rated CVSS 4.0 base 7.1 (AV:N/AC:L/PR:L/UI:N, high integrity impact) and CVSS 3.1 7.1; it is not listed as confirmed actively exploited (CISA KEV) and no public exploit identified at time of analysis, although the underlying technique is documented in public HackMD writeups.
Cross-tenant IDOR in InvoiceShelf before 2.4.0 lets an authenticated user with the create-invoice ability convert an estimate belonging to a different company by calling POST /api/v1/estimates/{estimate}/convert-to-invoice. Because route-model binding resolves the estimate without a company check, the attacker can copy another tenant's line items, prices, taxes, totals, notes, currency and customer data into an invoice in their own company, and the victim's configured conversion action may also modify or delete the source estimate - an exposed-data and integrity impact scored CVSS 7.1 with PR:L, requiring an authenticated account. Exploitation is only meaningful on multi-company (multi-tenant) deployments and no public exploit code has been identified at time of analysis; the vendor-released fix is version 2.4.0.
Crashing the Junos OS routing protocol daemon (rpd) on MX Series routers is possible for unauthenticated attackers on an adjacent network who can deliver a crafted eBGP route update, but only when hierarchical fast reroute (HFRR) link protection is configured inside a VRF or routing instance. Impact is confined to availability - rpd hits a reachable assertion and aborts, producing a routing-level denial of service - with no confidentiality or integrity exposure, and the adjacent-network vector plus the non-default HFRR-in-VRF prerequisite and MX-only scope bound the overall risk. No public exploit code or confirmed active exploitation was identified at time of analysis, and a vendor patch is available from Juniper.
Denial of service in Juniper Networks Junos OS and Junos OS Evolved allows a network-adjacent, unauthenticated attacker to crash the rpd routing daemon by sending a crafted RSVP Path message, disrupting routing on the affected device (CVSS 7.1; assessed CVSS:3.1 AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, availability-only impact). Exploitation is bounded: the target must have RSVP signaling enabled (typically for MPLS traffic engineering / LSP setup) and the attacker must be reachable at Layer 2 or act as a directly-connected routing neighbor able to inject RSVP control traffic, so arbitrary internet-based attackers are excluded. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV, though the low attack complexity and the unauthenticated nature of the vector make the flaw attractive to anyone already inside the adjacency or peering domain.
Denial of service in the Juniper Junos OS rpd routing process is possible when the non-default Auto-RP mapping feature is enabled, allowing an unauthenticated attacker on an adjacent network segment to send crafted Auto-RP mapping announcements that trigger an out-of-bounds write (CWE-787) and crash the routing plane. Juniper rates this CVSS 4.0 7.1, and our independent assessment concurs it is a moderate-priority availability issue rather than a critical emergency; no public exploit code or CISA KEV entry was identified at time of analysis. The attacker must be within the PIM multicast domain and cannot reach the device from the general internet.
Denial of service in Juniper Networks Junos OS and Junos OS Evolved results from a reachable assertion (CWE-617) in the rpd routing process that can be triggered by adjacent unauthenticated attackers sending LDP control traffic. Devices with Label Distribution Protocol (LDP) configured and active are exposed; the attacker must be on the same Layer 2 segment or directly connected link, but no authentication or user interaction is required. No public exploit code has been identified, and CISA KEV does not list this vulnerability as actively exploited.
An integer underflow in the srxpfe forwarding-plane daemon of Junos OS and Junos OS Evolved on SRX Series firewalls allows an unauthenticated attacker on an adjacent network segment to trigger a denial of service by sending an ICMP message tied to an SVR (Secure Vector Routing) carrier session. Affected deployments are those running SVR/carrier-session functionality on SRX platforms, where successful exploitation degrades or halts packet forwarding; the CVSS 4.0 base score of 7.1 reflects high availability impact with no confidentiality or integrity loss (assessed CVSS 3.1: AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). There is no public exploit code and no confirmed active exploitation (no CISA KEV listing) at time of analysis, but the attack requires only Layer 2 adjacency and no credentials or user interaction, so any SRX device with SVR sessions reachable from an untrusted adjacent segment should be treated as exposed.
Malformed ICCP messages sent to the l2ald daemon in Juniper Networks Junos OS and Junos OS Evolved can disclose process heap memory or crash the daemon, producing a denial-of-service condition. Only devices configured for MC-LAG with ICCP between chassis are exposed, and the attacker must already control or impersonate a configured ICCP peer, i.e. occupy or spoof a trusted position on the inter-chassis control link (CVSS 3.1 AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H, 7.1). Exploitation is not possible against a default configuration or from the general internet, and no public exploit identified at time of analysis.
Denial of service in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent, unauthenticated attacker to disrupt or crash RSVP processing by sending a malformed RSVP packet to an interface where RSVP is explicitly enabled. Exploitation is conditional: RSVP is not enabled by default and is only present in MPLS traffic-engineering/signaling deployments, and the attacker must have Layer-2 or directly-reachable adjacency to the affected interface (CVSS AV:A, PR:N, UI:N), so routers without RSVP configured are not exposed. Impact is availability-only with no confidentiality or integrity exposure; vendor CVSS is 7.1, and no public exploit code or confirmed in-the-wild exploitation was identified at time of analysis.
Denial of service in Juniper Networks Junos OS and Junos OS Evolved stems from an integer overflow/wraparound in the routing protocol daemon (rpd) OSPFv2 handling, allowing an unauthenticated adjacent attacker to disrupt or crash rpd by sending specifically crafted OSPFv2 packets onto an OSPF-enabled interface. Only devices with OSPFv2 configured and reachable at Layer 2 on the attacker's segment are exposed, which is the primary limiting factor; devices without OSPFv2 running are not affected. Scoring is CVSS 4.0 7.1 and CVSS 3.1 7.1 (AV:A/AC:L/PR:N/UI:N, availability-only impact), no public exploit code has been identified at time of analysis, and vendor patches are available for the affected release trains.
A crafted MVRP Ethernet frame sent to an MVRP-enabled interface can crash or disrupt the l2cpd Layer 2 control-protocol daemon in Juniper Networks Junos OS and Junos OS Evolved, causing a denial of service for associated Layer 2 control protocols. Only devices with MVRP (Multiple VLAN Registration Protocol) explicitly enabled on at least one interface, and reachable from the same Layer 2 broadcast domain, are exposed - MVRP is not enabled by default, so the vast majority of deployments are not at risk. No authentication or user interaction is required, but the attacker must have Layer 2 adjacency; the frame cannot be delivered across a Layer 3 boundary or over the internet. Scoring is AV:A with high availability impact only (C:N/I:N per the independent CVSS 3.1 assessment); there is no public exploit identified at time of analysis.
An out-of-bounds write (CWE-787) in the lacpd daemon of Juniper Networks Junos OS Evolved allows a Layer-2-adjacent attacker to crash the device - a denial of service - by sending a crafted frame to an aggregated-Ethernet member port that has LACP enabled. The attacker needs no authentication or user interaction (PR:N/UI:N) and must be positioned on the same local broadcast domain or directly attached to the member port (AV:A), so this is not an internet-reachable flaw; impact is availability-only (VC:N/VI:N/VA:H, with low subsequent-system availability impact SA:L in the CVSS 4.0 vector, assessed as CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). The independent assessment rates this as a genuine but bounded operational risk rather than an emergency: exposure depends entirely on LACP being configured on an AE member port, and no public exploit has been identified at time of analysis (the CVE is not listed in CISA KEV, and no POC is referenced in the available intelligence).
An adjacent attacker positioned on the MPLS-TE signaling plane can crash the rpd routing process on Juniper Networks Junos OS and Junos OS Evolved by way of a numeric truncation error (CWE-197) triggered during MPLS-TE fast-reroute signaling, producing a denial of service against the affected router's control plane. Juniper scores this 7.1 (CVSS 4.0 AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L); our independent assessment maps it to CVSS 3.1 AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, i.e. a high-availability-only impact. Exploitation requires MPLS-TE with fast-reroute (FRR) signaling configured and an attacker able to source or influence that signaling from an adjacent network position - no authentication or user interaction is needed, but default configurations without MPLS-TE FRR are not exposed. No public exploit code and no confirmed active exploitation have been identified at time of analysis, and the adjacency plus feature-configuration prerequisites confine realistic exposure largely to service-provider and large-enterprise MPLS cores.
Adjacent, unauthenticated attackers can crash the routing process (rpd) in Juniper Networks Junos OS and Junos OS Evolved by sending crafted RSVP-TE associated-bidirectional LSP signaling messages, resulting in a denial-of-service condition. This reachable assertion (CWE-617) requires the target device to be configured for RSVP-TE with associated-bidirectional LSP signaling and the attacker to be network-adjacent, meaning they must have an RSVP-TE signaling relationship or adjacency to the device. No public exploit identified at time of analysis, and the impact is limited to availability with automatic recovery, not code execution or data exposure.
Malformed RSVP signaling can trip a reachable assertion inside the rpd routing daemon on Juniper Networks Junos OS and Junos OS Evolved, terminating the daemon and causing a denial of service on the affected device. The flaw is exploitable without authentication or user interaction by an attacker positioned on an adjacent network segment (CVSS 4.0 base 7.1; AV:A/PR:N/UI:N with high availability impact), but only when RSVP signaling is actually enabled - typically MPLS traffic-engineering deployments - so devices without RSVP configured are not exposed. At time of analysis there is no public exploit identified and no CISA KEV listing; the practical risk is a bounded availability issue against the control plane rather than a confidentiality or integrity compromise, with JSA112187 as the sole authoritative vendor source.
A malformed RSVP Path message sent over an EVPL LMP control channel can dereference a NULL pointer in the Juniper Junos OS and Junos OS Evolved routing protocol daemon (rpd), crashing the process and causing a denial of service. Network-adjacent attackers with Layer 2 reachability to the control channel can trigger the crash without authentication or user interaction, though only devices explicitly configured for EVPL service with an LMP control channel are exposed - a non-default configuration. No public exploit has been identified at time of analysis, and the independent assessment characterizes this as a moderate-severity, targeted availability issue rather than a top-tier emergency.
Adjacent unauthenticated attackers can cause a denial of service in Juniper Junos OS and Junos OS Evolved by sending a crafted ICCP peer message to the l2ald process, provided MC-LAG IRB MAC synchronization is enabled. The reachable assertion (CWE-617) crashes the l2ald daemon, affecting availability; this is a conditional DoS requiring a non-default MC-LAG configuration and adjacency to the inter-chassis control link. No public exploit identified at time of analysis; EPSS data not provided.
Denial of service in Juniper Networks Junos OS and Junos OS Evolved can be triggered by a malformed MC-LAG message sent to the l2ald daemon, causing a reachable assertion failure and daemon crash. Only devices explicitly configured for MC-LAG with ICCP peering enabled are affected, and the attacker must hold the network position of a configured ICCP peer (adjacent Layer 2 access). No public exploit code or active exploitation has been identified; the issue is availability-only with no confidentiality or integrity impact.
Denial of service in Juniper Networks Junos OS and Junos OS Evolved can be triggered by an adjacent attacker sending a crafted ICCP MC-LAG message to l2ald, causing the daemon to mishandle a specified quantity field. The flaw only affects devices configured for MC-LAG with ICCP active and the attacker must be on the Layer-2 adjacency or ICCP peering path; no authentication or user interaction is required once that adjacency is achieved, and impact is availability-only (no data exposure or code execution). No public exploit identified at time of analysis, and the independent assessment rates this as a genuine but situational priority rather than a top-tier emergency because the non-default MC-LAG/ICCP prerequisite and adjacency constraint sharply reduce the realistic attacker population.
A NULL pointer dereference in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated attacker on an adjacent network to terminate the daemon and disrupt routing protocol sessions by sending a crafted RSVP packet when MPLS-TE RSVP processing is enabled; the flaw carries a CVSS v4.0 base score of 7.1 (CVSS:3.1 equivalent AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) and affects availability only, with no confidentiality or integrity impact. Exposure is bounded by two prerequisites - the device must actually be configured for RSVP-TE/MPLS-TE signaling, and the attacker must sit on the same L2 segment, directly connected link, or adjacent routing/peering domain rather than being reachable from the open internet. No public exploit code has been identified at time of analysis and there is no indication of confirmed active exploitation (not listed in CISA KEV); EPSS data was not provided in the available intelligence.
Malformed RIPv2 messages delivered to the routing protocol daemon (rpd) can crash or otherwise disrupt routing on Juniper Networks Junos OS and Junos Evolved, producing a denial-of-service condition. Exploitation requires the attacker to be network-adjacent (same link or broadcast domain) and requires that RIPv2 be actively configured and enabled on the target; no authentication or user interaction is needed, and the impact is availability-only, with no confidentiality or integrity effect. The issue is rated CVSS 7.1 (CVSS 4.0 basis) and CVSS 3.1 AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H; there is no public exploit identified at time of analysis and it is not listed in CISA KEV, making this a moderate-risk availability issue rather than a top-tier emergency.
A NULL pointer dereference in the rpd routing daemon of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated attacker positioned on an adjacent Layer 2 segment or as a multicast/routing peer to crash the routing protocol process by sending a malformed PIM Bidirectional (Bidir) message, producing a denial-of-service condition (CVSS 7.1). Exposure is gated by configuration: the target device must be running PIM Bidir, a non-default multicast feature, which means only networks actively deploying bidirectional PIM are at risk, and the attacker must be able to deliver a PIM packet directly to rpd rather than across arbitrary routed networks. Impact is confined to availability of the routing control plane - no code execution, data disclosure, or configuration integrity impact - and there is no public exploit identified at time of analysis.
Adjacent Layer-2 attackers can crash the rpd routing daemon on Juniper Networks Junos OS and Junos OS Evolved devices that run LDP across a link-protected interface, producing a denial of service when two misconfigured LDP neighbors - or a single neighbor duplicated by an L2 loop - advertise the same transport address and trip an internal assertion in the daemon. The CVSS vector (AV:A/PR:N, no confidentiality or integrity impact) shows the attack is unauthenticated but requires link adjacency plus an established LDP session and a non-default misconfiguration or L2 loop, so exposure is conditional rather than universal and is confined to availability; recovery is assessed as automatic (R:A) because the daemon restarts after the crash. No public exploit code or active exploitation has been identified at time of analysis, and the EPSS-style urgency signals in the supplied data do not indicate mass scanning or confirmed in-the-wild abuse.
A reachable-assertion flaw in the Juniper Junos OS and Junos OS Evolved rpd routing daemon lets a network-adjacent attacker crash the daemon by sending a crafted LDP Label message that carries an IPv6 Prefix FEC, producing a denial-of-service condition (CVSS 4.0 base 7.1; availability-only). The attacker must already share an L2 segment or act as a directly connected routing peer and must have an established LDP session with the target, so only devices with LDP configured and actively exchanging IPv6 Prefix FEC bindings are exposed; no authentication or user interaction is required once that adjacency exists (PR:N, UI:N), and the daemon's automatic restart bounds each outage. No public exploit code has been identified at time of analysis and there is no confirmed active exploitation (no CISA KEV listing); impact is limited to availability, with no confidentiality or integrity effect.
Juniper Junos OS and Junos OS Evolved devices that run OSPFv3 on a broadcast interface can be crashed by an unauthenticated adjacent attacker who sends specially crafted OSPFv3 protocol messages to the rpd routing daemon, producing a denial of service and heap memory corruption. Exploitation requires only Layer-2 adjacency to the affected broadcast segment and no credentials or user interaction, but devices that do not run OSPFv3, or that use point-to-point interface types, are not exposed; no public exploit code has been identified at time of analysis. Vendor severity is moderate (CVSS 4.0 7.1) with an availability-only impact, aligning with our independent CVSS 3.1 assessment of 6.5 (AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).
Adjacent, unauthenticated attackers can crash the rpd routing protocol daemon on Juniper Networks Junos OS and Junos OS Evolved devices that are configured for sparse-mode PIM, exploiting a use-after-free flaw triggered by specific PIM Join/Prune messages. Successful exploitation causes a denial of service through daemon failure and subsequent routing churn, with no impact on confidentiality or integrity. Exploitation is conditional: the target must run PIM sparse mode and the attacker must already sit on an adjacent multicast/routing segment with a valid PIM adjacency, and no public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis; the vendor advisory JSA112187 is the authoritative source for affected and fixed releases.
Malformed PIM Hello messages can crash the rpd process in Juniper Networks Junos OS and Junos OS Evolved, causing a denial of service on IPv6-enabled PIM interfaces. This improper input validation flaw (CWE-20) is exploitable by an unauthenticated adjacent attacker (AV:A) without user interaction, but requires PIM to be configured and the target interface to be IPv6-enabled. No public exploit code or active exploitation is known; the CVSS 4.0 base score is 7.1, and independent assessment classifies this as a moderate-severity availability issue with a bounded exposed population.
Denial of service in Juniper Networks SRX Series firewalls running Junos OS in a chassis-cluster (high-availability) configuration allows an adjacent attacker to crash the data plane by sending crafted traffic over the chassis-cluster fabric interconnect. The flaw is a signed-to-unsigned conversion error (CWE-195) in the srxpfe packet forwarding engine; authentication requirements are confirmed as unauthenticated (PR:N) and no user interaction is needed (UI:N) once the attacker has a position on the fabric. There is no public exploit identified at time of analysis and no record of confirmed active exploitation (CISA KEV), and the attack surface is restricted to clustered deployments rather than general network exposure, making this an access-constrained availability threat.
Juniper Networks Junos OS and Junos OS Evolved can be forced into a denial of service by a network-adjacent, already-established BGP peer that drives the routing protocol daemon (rpd) into a reachable assertion (CWE-617) by triggering a specific code path in labeled-unicast processing when the non-default 'aggregate-label' labeled-unicast setting is configured. Impact is confined to availability - the rpd process crashes and must restart, causing route churn and potential traffic loss - with no confidentiality or integrity exposure; the assessed vector CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H reflects that the attack surface is a configured BGP peering relationship rather than an arbitrary remote host, so this is a genuine but conditional priority rather than an inflated high-CVSS issue. No public exploit identified at time of analysis, and exploitation additionally requires both the aggregate-label configuration and an existing BGP session with the target device.
Denial of service in Juniper Networks Junos OS and Junos OS Evolved allows an adjacent, unauthenticated attacker to crash or destabilize the routing daemon (rpd) by sending a specially crafted IS-IS SRv6 packet, disrupting routing on the affected device. Exploitation is tightly constrained: the device must have both SRv6 and Flexible Algorithm explicitly enabled in its IS-IS configuration (a non-default segment-routing setup), and the attacker must already sit on an adjacent network segment able to inject IS-IS packets into the routing domain - a remote Internet attacker cannot reach this path. No public exploit code has been identified at time of analysis and the flaw is not confirmed as actively exploited (not in CISA KEV); with an assessed CVSS:3.1 base of AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H (vendor score 7.1 under CVSS 4.0), it is a moderate-priority, availability-only issue whose real-world exposure is narrowed by its configuration prerequisites and adjacency requirement.
Denial of service in Juniper Networks Junos OS and Junos OS Evolved occurs when an unauthenticated adjacent attacker who is an established LDP peer sends crafted LDP messages, triggering a NULL pointer dereference in the routing protocol daemon (rpd) that can crash the daemon. The flaw is availability-only (CVSS 3.1 AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) and requires MPLS with LDP configured and an operational LDP session; default configurations without MPLS/LDP are not exploitable. No public exploit was identified at time of analysis and the issue is not listed in CISA KEV.
A crafted LDP message sent by a compromised LDP neighbor can trigger a reachable assertion failure that crashes the routing protocol daemon (rpd) on Juniper Networks Junos OS and Junos OS Evolved, producing a denial-of-service condition on the affected device. Only devices with LDP/MPLS actively configured are exposed, and the attacker must already control a device that holds an established LDP adjacency with the target, so the CVSS 4.0 vector (7.1) is scored AV:A - adjacent network, not internet-reachable. Impact is availability-only: no confidentiality or integrity effect, with no confirmed actively exploited campaigns (not in CISA KEV) and no public exploit code identified at time of analysis; this is a moderate-priority availability issue rather than a top-tier emergency.
A malformed BGP VPLS signaling update can crash the routing protocol daemon (rpd) on Juniper Networks Junos OS and Junos OS Evolved, causing a denial of service on the affected device. The flaw is improper input validation (CWE-20) in rpd's handling of BGP signaling messages; the attack vector is adjacent and the CVSS 4.0 vector carries PR:N (no privileges required), but successful exploitation requires the target to be running BGP with VPLS signaling configured and to already have an established peering relationship with the attacking peer. Impact is limited to availability (rpd restart, routing churn, potential traffic loss) with no confidentiality or integrity impact; no public exploit code has been identified and there is no KEV confirmation of active exploitation at time of analysis, so this is a genuine but bounded operational risk rather than an urgent emergency.