Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-106423 | high | 8.8 | No | Use after free in Media in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code inside the sandbox via a... | 2026-10-07 |
| CVE-2026-106337 | medium | 5.4 | No | UI misrepresentation in UI in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker to spoof UI elements via a crafte... | 2026-10-07 |
| CVE-2026-102169 | medium | 6.5 | No | On affected Arista Wi-Fi access points with Captive Portal enabled, an unauthenticated wireless client connected to a captive-portal-enabled... | 2026-10-07 |
| CVE-2026-102168 | medium | 6.5 | No | On affected Arista Wi-Fi access points with Captive Portal enabled, an unauthenticated wireless client connected to a Captive-Portal-enabled... | 2026-10-07 |
| CVE-2026-102167 | high | 7.5 | No | On affected Arista Wi-Fi access points, a memory corruption vulnerability exists in access point's wired uplink network endpoints. An unauth... | 2026-10-07 |
| CVE-2026-102165 | high | 7.5 | No | On affected Arista Wi-Fi access points, an unauthenticated attacker with network access to the capture service can send a crafted packet to... | 2026-10-07 |
| CVE-2026-102164 | low | 3.1 | No | On affected Arista access points configured with VXLAN tunnelling and L2-proxy (a specific configuration unique to the VESPA use-case), a wi... | 2026-10-07 |
| CVE-2026-102163 | high | 8.8 | No | On affected Arista access points with Wireless Intrusion Prevention System (WIPS) active, an unauthenticated attacker within radio frequency... | 2026-10-07 |
| CVE-2026-102162 | high | 8.8 | No | On affected Arista Wi-Fi access points with captive portal, or application firewall enabled on at least one SSID, a vulnerability in the wir... | 2026-10-07 |
| CVE-2026-102161 | high | 8.8 | No | An unauthenticated attacker located on an adjacent private network (or any attacker routed through a reverse proxy/load balancer that forwar... | 2026-10-07 |
| CVE-2026-102160 | high | 7.2 | No | An operating system (OS) command injection vulnerability in CloudVision CUE backup management may allow an authenticated Super User to submi... | 2026-10-07 |
| CVE-2026-102159 | critical | 9.8 | No | An access-control flaw in the CV-CUE backend may allow an unauthenticated network attacker to access functionality intended only for interna... | 2026-10-07 |
| CVE-2026-102158 | medium | 6.5 | No | Improper validation of selected CloudVision CUE application programming interface (API) request parameters may allow an authenticated networ... | 2026-10-07 |
| CVE-2026-102157 | medium | 5.9 | No | An insecure direct object reference (IDOR) vulnerability in a CloudVision CUE file-serving interface may allow an authenticated network user... | 2026-10-07 |
| CVE-2026-102156 | medium | 6.8 | No | Improper neutralization of Lightweight Directory Access Protocol (LDAP) authentication input may allow an unauthenticated network attacker,... | 2026-10-07 |
| CVE-2026-102155 | high | 8.5 | No | An XML External Entity (XXE) injection vulnerability in the WiFi-server Spectralight application allows any authenticated user to send malic... | 2026-10-07 |
| CVE-2026-101158 | high | 8.4 | No | A missing input validation vulnerability in the Fileserver upload API allows an authenticated attacker with file upload privileges to execut... | 2026-10-07 |
| CVE-2026-101157 | high | 8.7 | No | A stored cross-site scripting (XSS) vulnerability may allow an unauthenticated attacker with adjacent-network access to inject malicious con... | 2026-10-07 |
| CVE-2026-101156 | high | 8.4 | No | A stored cross-site scripting (XSS) vulnerability may allow an authenticated, high-privilege administrator to store malicious content in a c... | 2026-10-07 |
| CVE-2026-101155 | critical | 9.1 | No | An authenticated remote attacker with specific permissions can read or write files on the platform filesystem beyond the intended scope thro... | 2026-10-07 |