CVE Vulnerability Catalog

A Return of Pointer Value Outside of Expected Range vulnerability in the fileio library of Juniper Networks Junos OS and Junos OS Evolved allows a local, low-privileged attacker to cause a Denial-of-Service (DoS). Issuing specific 'show l2-learning' or 'show ethernet-switching' commands triggers an l2ald crash, temporarily impacting all layer 2 services until the process restarts.

A Use of Multiple Resources with Duplicate Identifier vulnerability in the IKE daemon (iked) of Juniper Networks Junos OS on MX with SPC3 and SRX Series allows an unauthenticated, network-based attacker to cause a Denial-of-Service (DoS). When a large number of VPN negotiations fail, a peer index rollover occurs, causing iked to crash repeatedly.

An Improper Check for Unusual or Exceptional Conditions vulnerability in the Packet Forwarding Engine (PFE) of Juniper Junos OS on MX with SPC3 and SRX Series allows an unauthenticated, network-based attacker to cause a Denial-of-Service (DoS). When the device initiates a TCP connection to an attacker-controlled system that responds with a specific packet, the PFE crashes and restarts, affecting all services until automatic recovery.

An out-of-bounds write vulnerability in the http-gatekeeper (http-gk) component of Junos OS on SRX Series allows an unauthenticated, network-based attacker to crash the http-gk process. The attack requires a remote-access VPN with pre-logon compliance check configured.

An Improper Check for Unusual or Exceptional Conditions vulnerability in the packet forwarding engine of Junos OS on QFX10000 Series in an EVPN-VxLAN scenario allows an unauthenticated adjacent attacker to cause a DoS. Sending IPv6 multicast traffic to a non-IRB interface on a spine switch triggers an endless forwarding loop, saturating links and impacting legitimate traffic.

An improper validation of specified quantity in input vulnerability in the Packet Forwarding Engine (PFE) of Juniper Networks Junos OS on MX Series allows an unauthenticated, adjacent attacker to cause a Denial-of-Service (DoS). A crafted packet triggers incorrect size calculation, leading to an FPC major error and reset, disrupting traffic until recovery.

In OpenFGA prior to version 1.18.0, the OIDC authenticator skipped JWT audience validation when authn.method was set to oidc, authn.oidc.issuer was configured, and authn.oidc.audience was not set. This allows a token minted for an unrelated service by the same identity provider to authenticate to OpenFGA.

A vulnerability in the DeepSeek MCP Server (versions 1.4.2 through 1.7.x) allows unauthenticated clients to access the HTTP POST /mcp endpoint. The lack of authentication enables session initialization, tool enumeration, and invocation of deepseek_sessions and deepseek_chat tools, potentially exposing the DeepSeek API key.

In Discourse prior to versions 2026.6.0, 2026.5.1, 2026.4.2, and 2026.1.5, a topic featured link was not sufficiently normalized and escaped before being rendered in the topic list. This allowed a user who can set a featured link to inject JavaScript when default Content Security Policy protections were modified or disabled.

In OpenFGA prior to version 1.18.0, when MySQL is used as the datastore, the tuple, changelog, and authorization_model identifier columns compare case-distinct values (e.g., user:Alice and user:alice) as equivalent, causing two distinct check requests to return the same response.

In Discourse prior to versions 2026.6.0, 2026.5.1, 2026.4.2, and 2026.1.5, insufficient SVG sanitization in upload and user avatar handling could lead to cross-site scripting when a user visited specific URLs that are not normally part of community browsing.

In Discourse prior to versions 2026.6.0, 2026.5.1, 2026.4.2, and 2026.1.5, the AWS SES bounce webhook verified SNS message signatures but did not bind them to trusted TopicArn values, allowing any AWS account holder to send forged Bounce notifications that revoke a targeted user email.

In Discourse prior to versions 2026.6.0, 2026.5.1, 2026.4.2, and 2026.1.5, regular users could route direct S3 multipart uploads through ExternalUploadManager into the admin backup store.

A vulnerability in Discourse prior to versions 2026.6.0, 2026.5.1, 2026.4.2, and 2026.1.5 allowed EventSerializer to expose invited group names, sample invitees, and attendance statistics to users who could view the topic but were not entitled to view the private event invitee list.

In the 'decompress' library before version 4.2.2, a path traversal and arbitrary file write vulnerability exists due to improper path containment check. The safeMakeDir function and extraction path validation use String.indexOf() to verify the resolved path is within the output directory, which can be bypassed by missing a path separator boundary. An attacker can write arbitrary files outside the intended directory, bypassing the fix for CVE-2020-12265.

The 'decompress' library before version 4.2.2 allows arbitrary hardlink creation during archive extraction. An attacker can craft an archive with a hardlink entry containing an absolute path to any file on the same filesystem, leading to file content disclosure or overwriting.

A vulnerability in Juniper Networks Junos OS Evolved allows an unauthenticated, network-based attacker to cause limited information disclosure and availability impact. Due to incorrect initialization, an internal process is exposed over the network via an open port.

A missing authorization vulnerability in the CLI of Junos OS on EX2300, EX4000, EX4100, EX4300-MP, and EX4400 switches allows an authenticated local attacker with no specific permissions to execute a privileged 'request' command, causing a complete traffic impact until automatic recovery.

A stored cross-site scripting vulnerability in Bagisto before 2.4.4 allows unauthenticated attackers to execute arbitrary JavaScript in administrator browsers by injecting a malicious payload into the first or last name field during customer registration. The create.blade.php template renders these fields without the v-pre directive, causing Vue.js to evaluate stored expressions as live code.

An Improper Check for Unusual or Exceptional Conditions vulnerability in the routing protocol daemon (RPD) of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent, unauthenticated attacker to send a crafted non-inet/inet6 unicast BGP update over an established BGP session, causing an RPD crash and restart.