Known vulnerabilities in Palo Alto PAN-OS 10.2.10-h14

Version: 10.2.10-h14
Software CPE: cpe:2.3:o:palo_alto_networks:pan-os:*:*:*:*:*:*:*:*
Total vulnerabilities: 22
Public exploits: 2
Known exploited (KEV): 3
Highest CVSSv4 Score: 10

Vulnerabilities by Severity

Severity distribution of vulnerabilities affecting Palo Alto PAN-OS version 10.2.10-h14 Palo Alto PAN-OS 10.2.10-h14 is affected by 22 vulnerabilities: 2 critical, 8 high, 5 medium, 7 low Critical High Medium Low

Vulnerabilities (22)

Vulnerability CWE-ID CSH Severity Public Exploit KEV First fixed release Published Bulletins
#VU137318 - Improper Check for Unusual or Exceptional Conditions
CVE-2026-0287
CWE-754 Medium
No
No
10.2.7-h36, 10.2.10-h39, 10.2.13-h23, 10.2.16-h9, 10.2.18-h8, 11.1.4-h35, 11.1.6-h35, 11.1.7-h8, 11.1.10-h30, 11.1.13-h9, 11.1.16, 11.2.4-h20, 11.2.7-h18, 11.2.10-h12, 11.2.13, 12.1.4-h8, 12.1.7-h2, 12.1.8 10.07.2026 SB2026071034
#VU137309 - Incorrect Calculation of Buffer Size
CVE-2026-0280
CWE-131 Medium
No
No
10.2.7-h36, 10.2.10-h39, 10.2.13-h23, 10.2.16-h9, 10.2.18-h8, 11.1.4-h35, 11.1.6-h35, 11.1.7-h8, 11.1.10-h30, 11.1.13-h9, 11.1.16, 11.2.4-h20, 11.2.7-h18, 11.2.10-h11, 11.2.13, 12.1.4-h8, 12.1.7-h2, 12.1.8 10.07.2026 SB2026071034
#VU137306 - Missing Authentication for Critical Function
CVE-2026-0283
CWE-306 High
No
No
10.2.7-h36, 10.2.10-h39, 10.2.13-h23, 10.2.16-h9, 10.2.18-h8, 11.1.4-h35, 11.1.6-h35, 11.1.7-h8, 11.1.10-h30, 11.1.13-h9, 11.1.16, 11.2.4-h20, 11.2.7-h18, 11.2.10-h12, 11.2.13, 12.1.4-h8, 12.1.7-h2, 12.1.8 10.07.2026 SB2026071034
#VU137305 - Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
CVE-2026-0284
CWE-74 High
No
No
10.2.7-h36, 10.2.10-h39, 10.2.13-h23, 10.2.16-h9, 10.2.18-h8, 11.1.4-h35, 11.1.6-h35, 11.1.7-h8, 11.1.10-h30, 11.1.13-h9, 11.1.16, 11.2.4-h20, 11.2.7-h18, 11.2.10-h12, 11.2.13, 12.1.4-h8, 12.1.7-h2, 12.1.8 10.07.2026 SB2026071034
#VU137304 - Server-Side Request Forgery (SSRF)
CVE-2026-0285
CWE-918 Low
No
No
10.2.7-h36, 10.2.10-h39, 10.2.13-h23, 10.2.16-h9, 10.2.18-h8, 11.1.4-h35, 11.1.6-h35, 11.1.7-h8, 11.1.10-h30, 11.1.13-h9, 11.1.16, 11.2.4-h20, 11.2.7-h18, 11.2.10-h11, 11.2.13, 12.1.4-h8, 12.1.7-h2, 12.1.8 10.07.2026 SB2026071034
#VU137303 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
CVE-2026-0286
CWE-78 Low
No
No
10.2.7-h36, 10.2.10-h39, 10.2.13-h23, 10.2.16-h9, 10.2.18-h8, 11.1.4-h35, 11.1.6-h35, 11.1.7-h8, 11.1.10-h30, 11.1.13-h9, 11.1.16, 11.2.4-h20, 11.2.7-h18, 11.2.10-h11, 11.2.13, 12.1.4-h8, 12.1.7-h2, 12.1.8 10.07.2026 SB2026071034
#VU137301 - Out-of-bounds write
CVE-2026-0288
CWE-787 High
No
No
10.2.7-h36, 10.2.10-h39, 10.2.13-h23, 10.2.16-h9, 10.2.18-h8, 11.1.4-h35, 11.1.6-h35, 11.1.7-h8, 11.1.10-h30, 11.1.13-h9, 11.1.16, 11.2.4-h20, 11.2.7-h18, 11.2.10-h12, 11.2.13, 12.1.4-h8, 12.1.7-h2, 12.1.8 10.07.2026 SB2026071034
#VU134592 - Missing Authorization
CVE-2026-0272
CWE-862 Low
No
No
10.2.7-h35, 10.2.10-h37, 10.2.13-h22, 10.2.16-h8, 10.2.18-h5, 11.1.4-h34, 11.1.6-h33, 11.1.10-h27, 11.1.13-h7, 11.1.14, 11.2.4-h18, 11.2.7-h16, 11.2.10-h9, 11.2.11, 12.1.4-h7, 12.1.5 16.06.2026 SB2026061640
#VU131778 - Reliance on Cookies without Validation and Integrity Checking
CVE-2026-0257
CWE-565 Critical
No
Exploited
10.2.7-h34, 10.2.10-h36, 10.2.13-h21, 10.2.16-h7, 10.2.18-h6, 11.1.4-h33, 11.1.6-h32, 11.1.7-h6, 11.1.10-h25, 11.1.13-h5, 11.1.15, 11.2.4-h17, 11.2.8, 11.2.12, 12.1.7 19.05.2026 SB2026051910
#VU131777 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2026-0256
CWE-79 Low
No
No
10.2.7-h34, 10.2.10-h36, 10.2.13-h21, 10.2.16-h7, 10.2.18-h6, 11.1.4-h33, 11.1.6-h32, 11.1.7-h6, 11.1.10-h25, 11.1.13-h5, 11.1.15, 11.2.4-h17, 11.2.7-h13, 11.2.10-h6, 11.2.12, 12.1.4-h5, 12.1.7 19.05.2026 SB2026051910
#VU131776 - Server-Side Request Forgery (SSRF)
CVE-2026-0258
CWE-918 High
No
No
10.2.7-h34, 10.2.10-h36, 10.2.13-h21, 10.2.16-h7, 10.2.18-h6, 11.1.4-h33, 11.1.6-h32, 11.1.7-h6, 11.1.10-h25, 11.1.13-h5, 11.1.15, 11.2.4-h17, 11.2.7-h13, 11.2.10-h6, 11.2.12, 12.1.4-h5, 12.1.7 19.05.2026 SB2026051910
#VU131775 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
CVE-2026-0261
CWE-78 Low
No
No
10.2.7-h34, 10.2.10-h36, 10.2.13-h21, 10.2.16-h7, 10.2.18-h6, 11.1.4-h33, 11.1.6-h32, 11.1.7-h6, 11.1.10-h25, 11.1.13-h5, 11.1.15, 11.2.4-h17, 11.2.7-h13, 11.2.10-h6, 11.2.12, 12.1.4-h5, 12.1.7 19.05.2026 SB2026051910
#VU131774 - Improper Check for Unusual or Exceptional Conditions
CVE-2026-0262
CWE-754 Medium
No
No
10.2.7-h34, 10.2.10-h36, 10.2.13-h21, 10.2.16-h7, 10.2.18-h6, 11.1.4-h33, 11.1.6-h32, 11.1.7-h6, 11.1.10-h25, 11.1.13-h5, 11.1.15, 11.2.4-h17, 11.2.7-h13, 11.2.10-h6, 11.2.12, 12.1.4-h5, 12.1.7 19.05.2026 SB2026051910
#VU131772 - Heap-based Buffer Overflow
CVE-2026-0264
CWE-122 High
No
No
10.2.7-h34, 10.2.10-h36, 10.2.13-h21, 10.2.16-h7, 10.2.18-h6, 11.1.4-h33, 11.1.6-h32, 11.1.7-h6, 11.1.10-h25, 11.1.13-h5, 11.1.15, 11.2.4-h17, 11.2.7-h13, 11.2.10-h6, 11.2.12, 12.1.4-h5, 12.1.7 19.05.2026 SB2026051910
#VU131771 - Improper Verification of Cryptographic Signature
CVE-2026-0265
CWE-347 High
Public exploit available
Exploited
10.2.7-h34, 10.2.10-h36, 10.2.13-h21, 10.2.16-h7, 10.2.18-h6, 11.1.4-h33, 11.1.6-h32, 11.1.7-h6, 11.1.10-h25, 11.1.13-h5, 11.1.15, 11.2.4-h17, 11.2.7-h13, 11.2.10-h6, 11.2.12, 12.1.4-h5, 12.1.7 19.05.2026 SB2026051910
#VU130217 - Out-of-bounds write
CVE-2026-0300
CWE-787 Critical
Public exploit available
Exploited
10.2.10-h36, 10.2.16-h7, 10.2.18-h6, 11.1.4-h33, 11.1.6-h32, 11.1.10-h25, 11.1.13-h5, 11.2.7-h13, 11.2.10-h6, 12.1.4-h5 06.05.2026 SB2026050606
#VU122749 - Improper Certificate Validation
CVE-2026-0228
CWE-295 Medium
No
No
10.2.17, 11.1.11, 11.2.8 12.02.2026 SB2026021223
#VU121528 - Improper Check for Unusual or Exceptional Conditions
CVE-2026-0227
CWE-754 Medium
No
No
10.2.7-h32, 10.2.10-h30, 10.2.13-h18, 10.2.16-h6, 10.2.18-h1, 11.1.4-h27, 11.1.6-h23, 11.1.10-h9, 11.1.13, 11.2.4-h15, 11.2.7-h8, 11.2.10-h2, 12.1.4 14.01.2026 SB20260114185
#VU116857 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
CVE-2025-4615
CWE-78 Low
No
No
10.2.17, 11.1.11, 11.2.8 09.10.2025 SB2025100914
#VU116855 - Exposure of Sensitive System Information to an Unauthorized Control Sphere
CVE-2025-4614
CWE-497 Low
No
No
10.2.17, 11.1.12, 11.2.8 09.10.2025 SB2025100913


Showing elements 1 - 20 out of 22