CVE-2026-102029
A NULL Pointer Dereference vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an un
CVSS
7.5
High
EPSS
0.5%
p39
KEV
—
Exploit Today
12
0-100
Published: Oct 14, 2026 · Last modified: Oct 16, 2026 · CWE-476
0.5%EPSS · 30 days0.5%
2026-10-152026-10-20
A NULL Pointer Dereference vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated configured MSDP peer or adjacent PIM sender to cause a denial of service via an MSDP or PIM policy that uses AS-path expansion.
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2026-1140466.5 MED—
——0FreeRDP 3.0.0 before 3.32.0 contains a null-pointer dereference in the smartcard emulation backend that accepts a null per-reader name in SCardGetStatusChange requests. A malicious RDP server can send a crafted reader-state entry with a null szReader, causing strcmp or _wcscmp to crash the client process.1dCVE-2026-1136805.5 MED—
——0HarfBuzz from 8.0.0 through 14.6.0 contains a NULL pointer dereference vulnerability in the experimental WebAssembly shaper host imports buffer_set_contents, face_create, and font_set_coords. Attackers can supply a crafted font whose embedded wasm module passes out-of-range addresses with non-zero lengths, crashing any application that shapes text with the font.1dCVE-2026-43842—18.6%
——6A NULL pointer dereference vulnerability in the license manager service could allow an unauthenticated attacker to crash the service via the rpc_rx_fsm function when msglen is set to 0.1dCVE-2026-43841—18.6%
——6A NULL pointer dereference vulnerability in the license manager service could allow an unauthenticated attacker to crash the service via the rpc_rx_fsm function.1dCVE-2026-43839—18.6%
——6A NULL pointer dereference vulnerability in the logs management functionality could allow an unauthenticated attacker to crash the service.1dCVE-2026-112405—20.4%
——6Pillow is a Python imaging library. From 12.0.0 until 13.0.0, Pillow's Image.merge() can dereference a null image8 plane. Validation skips the first input band, allowing a 32-bit integer or floating-point image backed by image32 storage to be merged as a narrower multiband image. A crafted IPTC file can reach this path when an application opens and loads it, or a caller can invoke Image.merge() directly with such a first band. This causes a native process crash. This issue is fixed in version 13.0.0.1d