Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-102164 | low | 3.1 | No | On affected Arista access points configured with VXLAN tunnelling and L2-proxy (a specific configuration unique to the VESPA use-case), a wi... | 2026-10-07 |
| CVE-2026-102163 | high | 8.8 | No | On affected Arista access points with Wireless Intrusion Prevention System (WIPS) active, an unauthenticated attacker within radio frequency... | 2026-10-07 |
| CVE-2026-102162 | high | 8.8 | No | On affected Arista Wi-Fi access points with captive portal, or application firewall enabled on at least one SSID, a vulnerability in the wir... | 2026-10-07 |
| CVE-2026-102161 | high | 8.8 | No | An unauthenticated attacker located on an adjacent private network (or any attacker routed through a reverse proxy/load balancer that forwar... | 2026-10-07 |
| CVE-2026-102160 | high | 7.2 | No | An operating system (OS) command injection vulnerability in CloudVision CUE backup management may allow an authenticated Super User to submi... | 2026-10-07 |
| CVE-2026-102159 | critical | 9.8 | No | An access-control flaw in the CV-CUE backend may allow an unauthenticated network attacker to access functionality intended only for interna... | 2026-10-07 |
| CVE-2026-102158 | medium | 6.5 | No | Improper validation of selected CloudVision CUE application programming interface (API) request parameters may allow an authenticated networ... | 2026-10-07 |
| CVE-2026-102157 | medium | 5.9 | No | An insecure direct object reference (IDOR) vulnerability in a CloudVision CUE file-serving interface may allow an authenticated network user... | 2026-10-07 |
| CVE-2026-102156 | medium | 6.8 | No | Improper neutralization of Lightweight Directory Access Protocol (LDAP) authentication input may allow an unauthenticated network attacker,... | 2026-10-07 |
| CVE-2026-102155 | high | 8.5 | No | An XML External Entity (XXE) injection vulnerability in the WiFi-server Spectralight application allows any authenticated user to send malic... | 2026-10-07 |
| CVE-2026-101158 | high | 8.4 | No | A missing input validation vulnerability in the Fileserver upload API allows an authenticated attacker with file upload privileges to execut... | 2026-10-07 |
| CVE-2026-101157 | high | 8.7 | No | A stored cross-site scripting (XSS) vulnerability may allow an unauthenticated attacker with adjacent-network access to inject malicious con... | 2026-10-07 |
| CVE-2026-101156 | high | 8.4 | No | A stored cross-site scripting (XSS) vulnerability may allow an authenticated, high-privilege administrator to store malicious content in a c... | 2026-10-07 |
| CVE-2026-101155 | critical | 9.1 | No | An authenticated remote attacker with specific permissions can read or write files on the platform filesystem beyond the intended scope thro... | 2026-10-07 |
| CVE-2026-101153 | high | 8.0 | No | On affected versions of CloudVision Portal (on-premises) or CloudVision Sensor, a path traversal vulnerability exists. An authenticated user... | 2026-10-07 |
| CVE-2026-101152 | high | 8.0 | No | Insufficient validation in the Single Sign-On (SSO) login flow could allow a remote, unauthenticated attacker to craft a URL that, when clic... | 2026-10-07 |
| CVE-2026-101151 | medium | 4.3 | No | Insufficient validation of request in login flow could allow a remote, unauthenticated attacker to craft a URL that, when clicked by a user,... | 2026-10-07 |
| CVE-2026-101150 | medium | 4.1 | No | Insufficient validation of OIDC bearer token configuration could allow a user with specific high privileges to direct requests to arbitrary... | 2026-10-07 |
| CVE-2026-101149 | medium | 4.1 | No | Insufficient validation of OIDC SSO provider configuration could allow a user with specific high privileges to direct requests to arbitrary... | 2026-10-07 |
| CVE-2026-106426 | high | 8.3 | No | Race condition in Fonts in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to potentially execute arbitrary code outside the... | 2026-10-07 |