Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-27557 | high | 7.5 | No | An unauthenticated remote attacker can exploit a path traversal vulnerability in the /index.php/view_uploaded_iodd_file endpoint allowing th... | 2026-09-16 |
| CVE-2026-27552 | high | 8.1 | No | A low-privileged remote attacker can exploit improper authorization in the /index.php/attached_devices_tab/do_upload endpoint to upload IODD... | 2026-09-16 |
| CVE-2026-27547 | high | 8.8 | No | A low-privileged remote attacker can exploit a command injection vulnerability in the /index.php/ajax/get_iodd_menu_info endpoint using vali... | 2026-09-16 |
| CVE-2026-21588 | not reported | — | No | This High severity DoS (Denial of Service) vulnerability was introduced in versions 8.9.0, 9.0.1, 9.1.0, 9.2.0, 9.3.1, 9.4.0, 9.5.1, 10.0.2,... | 2026-09-16 |
| CVE-2026-89161 | high | 7.8 | No | In PCRE2 before 10.48, pcre2_jit_match mishandles a previously copied subject being passed in as a context. An incorrect free operation can... | 2026-09-16 |
| CVE-2026-70019 | medium | 6.5 | No | Windows hard link in Windows Compressed Folder allows an unauthorized attacker to disclose information over a network. | 2026-09-16 |
| CVE-2026-86107 | medium | 5.9 | No | The VeloCloud Edge and Gateway exhibit an out-of-bounds write vulnerability when processing tunneled IP fragments between authenticated over... | 2026-09-16 |
| CVE-2026-73455 | high | 7.5 | No | On affected platforms running Arista EOS with Open Shortest Path First version 3 (OSPFv3) configured, a specially crafted packet can cause t... | 2026-09-16 |
| CVE-2026-73435 | high | 8.2 | No | On affected platforms running Arista EOS with Open Shortest Path First version 2 (OSPFv2) configured, a specially crafted OSPFv2 packet from... | 2026-09-16 |
| CVE-2026-73445 | medium | 4.9 | No | On affected platforms running Arista EOS, an issue with the gRPC Network Security Interface (gNSI) Authz Rotate RPC may cause an incorrect A... | 2026-09-16 |
| CVE-2026-2380 | high | 7.4 | No | On affected platforms running Arista EOS with OpenConfig-related services (i.e., gNMI, gNSI, RESTCONF and NETCONF), sensitive requests and r... | 2026-09-16 |
| CVE-2026-73467 | medium | 6.3 | No | On affected platforms running Arista EOS, under certain circumstances plaintext shared secrets for configured Terminal Access Controller Acc... | 2026-09-16 |
| CVE-2026-77190 | medium | 6.5 | No | On affected platforms running Arista EOS, an unauthenticated attacker who is network-adjacent to the switch and able to connect to a device... | 2026-09-16 |
| CVE-2026-73469 | medium | 5.8 | No | When specific platforms are using Arista EOS with a loose Unicast Reverse Path Forwarding (uRPF) configuration, certain traffic may not be s... | 2026-09-16 |
| CVE-2026-73468 | medium | 6.5 | No | A specially crafted packet can cause the premature expiry of multicast forwarding state on affected interfaces, potentially resulting in tem... | 2026-09-16 |
| CVE-2026-73440 | medium | 4.2 | No | On affected platforms running Arista EOS with Simple Network Management Protocol (SNMP) configured, SNMPv3 local or remote user credentials... | 2026-09-16 |
| CVE-2026-73436 | medium | 6.5 | No | On affected platforms running Arista EOS with OSPFv2 and OSPFv2 segment routing configured, a specially crafted OSPFv2 packet from an adjace... | 2026-09-16 |
| CVE-2026-19640 | medium | 4.2 | No | On affected platforms running Arista EOS, an authenticated user with access to the gNMI (gRPC Network Management Interface) may receive inco... | 2026-09-16 |
| CVE-2026-73463 | medium | 5.3 | No | On affected platforms running Arista EOS, when multiple gRPC Network Security Interface (gNSI) transports are configured, a race condition i... | 2026-09-16 |
| CVE-2026-73458 | high | 8.2 | No | On affected platforms running Arista EOS with authenticated Bidirectional Forwarding Detection (BFD) sessions configured, a specially crafte... | 2026-09-16 |