CVE Vulnerability Catalog

An Improper Check for Unusual or Exceptional Conditions vulnerability in the packet forwarding engine (PFE) of Juniper Networks Junos OS on MX Series allows adjacent subscribers to bypass configured firewall filters.

A race condition vulnerability in the packet forwarding engine (PFE) of Junos OS on SRX Series allows an unauthenticated, network-based attacker to cause a Denial-of-Service (DoS). The flaw affects flow timeout handling, leading to session accumulation and potential system crash or reboot.

A missing synchronization vulnerability in the sFlow collector handler of Junos OS Evolved on QFX Series allows an unauthenticated adjacent attacker to cause a Denial-of-Service (DoS). When the reachability of an sFlow collector changes and the sFlow thread simultaneously accesses next-hop data, the evo-pfemand process crashes, blocking traffic forwarding until automatic restart.

A missing release of memory after effective lifetime vulnerability in the packet forwarding engine (PFE) of Juniper Networks Junos OS on EX4100 and EX4400 switches allows an unauthenticated adjacent attacker to cause an FPC crash and restart. The issue occurs when sFlow is configured in a Virtual Chassis scenario and multicast traffic is forwarded between VC members.

A Return of Pointer Value Outside of Expected Range vulnerability in the fileio library of Juniper Networks Junos OS and Junos OS Evolved allows a local, low-privileged attacker to cause a Denial-of-Service (DoS). Issuing specific 'show l2-learning' or 'show ethernet-switching' commands triggers an l2ald crash, temporarily impacting all layer 2 services until the process restarts.

A Use of Multiple Resources with Duplicate Identifier vulnerability in the IKE daemon (iked) of Juniper Networks Junos OS on MX with SPC3 and SRX Series allows an unauthenticated, network-based attacker to cause a Denial-of-Service (DoS). When a large number of VPN negotiations fail, a peer index rollover occurs, causing iked to crash repeatedly.

An Improper Check for Unusual or Exceptional Conditions vulnerability in the Packet Forwarding Engine (PFE) of Juniper Junos OS on MX with SPC3 and SRX Series allows an unauthenticated, network-based attacker to cause a Denial-of-Service (DoS). When the device initiates a TCP connection to an attacker-controlled system that responds with a specific packet, the PFE crashes and restarts, affecting all services until automatic recovery.

An out-of-bounds write vulnerability in the http-gatekeeper (http-gk) component of Junos OS on SRX Series allows an unauthenticated, network-based attacker to crash the http-gk process. The attack requires a remote-access VPN with pre-logon compliance check configured.

An Improper Check for Unusual or Exceptional Conditions vulnerability in the packet forwarding engine of Junos OS on QFX10000 Series in an EVPN-VxLAN scenario allows an unauthenticated adjacent attacker to cause a DoS. Sending IPv6 multicast traffic to a non-IRB interface on a spine switch triggers an endless forwarding loop, saturating links and impacting legitimate traffic.

An improper validation of specified quantity in input vulnerability in the Packet Forwarding Engine (PFE) of Juniper Networks Junos OS on MX Series allows an unauthenticated, adjacent attacker to cause a Denial-of-Service (DoS). A crafted packet triggers incorrect size calculation, leading to an FPC major error and reset, disrupting traffic until recovery.

In OpenFGA prior to version 1.18.0, the OIDC authenticator skipped JWT audience validation when authn.method was set to oidc, authn.oidc.issuer was configured, and authn.oidc.audience was not set. This allows a token minted for an unrelated service by the same identity provider to authenticate to OpenFGA.

A vulnerability in the DeepSeek MCP Server (versions 1.4.2 through 1.7.x) allows unauthenticated clients to access the HTTP POST /mcp endpoint. The lack of authentication enables session initialization, tool enumeration, and invocation of deepseek_sessions and deepseek_chat tools, potentially exposing the DeepSeek API key.

In Discourse prior to versions 2026.6.0, 2026.5.1, 2026.4.2, and 2026.1.5, a topic featured link was not sufficiently normalized and escaped before being rendered in the topic list. This allowed a user who can set a featured link to inject JavaScript when default Content Security Policy protections were modified or disabled.

In OpenFGA prior to version 1.18.0, when MySQL is used as the datastore, the tuple, changelog, and authorization_model identifier columns compare case-distinct values (e.g., user:Alice and user:alice) as equivalent, causing two distinct check requests to return the same response.

In Discourse prior to versions 2026.6.0, 2026.5.1, 2026.4.2, and 2026.1.5, insufficient SVG sanitization in upload and user avatar handling could lead to cross-site scripting when a user visited specific URLs that are not normally part of community browsing.

In Discourse prior to versions 2026.6.0, 2026.5.1, 2026.4.2, and 2026.1.5, the AWS SES bounce webhook verified SNS message signatures but did not bind them to trusted TopicArn values, allowing any AWS account holder to send forged Bounce notifications that revoke a targeted user email.

In Discourse prior to versions 2026.6.0, 2026.5.1, 2026.4.2, and 2026.1.5, regular users could route direct S3 multipart uploads through ExternalUploadManager into the admin backup store.

A vulnerability in Discourse prior to versions 2026.6.0, 2026.5.1, 2026.4.2, and 2026.1.5 allowed EventSerializer to expose invited group names, sample invitees, and attendance statistics to users who could view the topic but were not entitled to view the private event invitee list.

In the 'decompress' library before version 4.2.2, a path traversal and arbitrary file write vulnerability exists due to improper path containment check. The safeMakeDir function and extraction path validation use String.indexOf() to verify the resolved path is within the output directory, which can be bypassed by missing a path separator boundary. An attacker can write arbitrary files outside the intended directory, bypassing the fix for CVE-2020-12265.

The 'decompress' library before version 4.2.2 allows arbitrary hardlink creation during archive extraction. An attacker can craft an archive with a hardlink entry containing an absolute path to any file on the same filesystem, leading to file content disclosure or overwriting.