CVE Watch
Every new High and Critical vulnerability, updated automatically from NVD, FIRST EPSS and CISA’s Known Exploited Vulnerabilities list, with whether public exploit code exists. Critical CVEs and exploited Highs are also posted to Bluesky as they appear.
All High & Critical Critical High Exploited (KEV) Public exploit
-
CVE-2026-106079: Juniper Networks Session Smart Router (High, CVSS 8.8)
An Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in AccessManager in Juniper Networks Session Smart Router and Session Smart Conductor allows an attacker with config-write…
-
CVE-2026-103410: Juniper Networks Session Smart Router (High, CVSS 7.5)
An Integer Overflow vulnerability in the DPI certificate scanner in Juniper Networks Session Smart Router allows an unauthenticated remote attacker to cause a denial of service via a specially crafted TLS server…
-
CVE-2026-103409: Juniper Networks Session Smart Router (Critical, CVSS 9.8)
A Missing authentication for critical function vulnerability in Juniper Networks Session Smart Router allows an unauthenticated network-based attacker to obtain administrative privileges by passing crafted URL parameters to an insecure endpoint running…
-
CVE-2026-103407: Juniper Networks Session Smart Router (High, CVSS 8.8)
An Improper Limitation of a Pathname to a Restricted Directory vulnerability in ConfigDirector in Juniper Networks Session Smart Router and Session Smart Conductor allows an authenticated REST user to read, overwrite, or…
-
CVE-2026-103406: Juniper Networks Session Smart Conductor (Critical, CVSS 9.8)
An Improper Neutralization of Special Elements used in an OS Command vulnerability in the AutomatedProvisioner in Juniper Networks Session Smart Conductor allows a remote attacker to execute arbitrary commands as root via…
-
CVE-2026-103401: Juniper Networks Session Smart Router (High, CVSS 8.8)
An Improper Link Resolution Before File Access ('Link Following') vulnerability in the unauthenticated web server handlers in Juniper Networks Session Smart Router and Session Smart Conductor allows a local unprivileged user to…
-
CVE-2026-103402: Juniper Networks Session Smart Router (High, CVSS 8.8)
An Insufficient Verification of Data Authenticity vulnerability in PCLI in Juniper Networks Session Smart Router and Session Smart Conductor allows an attacker with write access to the model cache directory to execute…
-
CVE-2026-103403: Juniper Networks Session Smart Router (High, CVSS 8.8)
An Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in AccessManager in Juniper Networks Session Smart Router and Session Smart Conductor allows an attacker to perform…