{"schema_version":"1","data":[{"id":9610,"advisory_id":"8b60106c-5d00-4e6d-b85e-59240827256b","revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-106274","source_published_at":"2026-10-06T18:41:16.294+00:00","published_at":"2026-10-24T23:20:22.833726+00:00","extraction_method":"structured","technologies":["chrome","core-cve"],"cve_ids":["CVE-2026-106274"],"event_types":["advisory"],"payload":{"kind":"advisory","title":"CVE-2026-106274","summary":"Incorrect reference resolution in Browser in Google Chrome on on Mac prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to obtain sensitive information via a crafted HTML page. (Chromium security severity: Medium)","evidence":"cve:CVE-2026-106274","products":[{"name":{"value":"Chrome","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2026-106274","aliases":["CVE-2026-106274"],"metrics":[],"affected":[{"vendor":"Google","product":"Chrome","versions":[{"status":"affected","version":"155.0.8059.39","lessThan":"155.0.8059.39","versionType":"custom"}]}],"modified":"2026-10-06T20:25:51.606Z","provider":"cve","references":["https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","https://issues.chromium.org/issues/497842821"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":8.8,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","integrityImpact":"HIGH","userInteraction":"REQUIRED","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"HIGH"}},{"other":{"type":"ssvc","content":{"id":"CVE-2026-106274","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-06T20:17:07.761451Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-06T20:25:51.606Z"}}],"cna":{"orgId":"ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28","shortName":"Chrome","dateUpdated":"2026-10-06T18:41:16.294Z"}}},"related_cves":[{"value":"CVE-2026-106274","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":null}},{"id":9609,"advisory_id":"902ec4ad-f90b-441c-b921-dbe54dfe1852","revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-106249","source_published_at":"2026-10-06T18:41:39.028+00:00","published_at":"2026-10-24T23:20:22.221526+00:00","extraction_method":"structured","technologies":["chrome","core-cve"],"cve_ids":["CVE-2026-106249"],"event_types":["advisory"],"payload":{"kind":"advisory","title":"CVE-2026-106249","summary":"Incorrect authorization in Autofill in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker to obtain sensitive information via a crafted HTML page. (Chromium security severity: Low)","evidence":"cve:CVE-2026-106249","products":[{"name":{"value":"Chrome","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2026-106249","aliases":["CVE-2026-106249"],"metrics":[],"affected":[{"vendor":"Google","product":"Chrome","versions":[{"status":"affected","version":"155.0.8059.39","lessThan":"155.0.8059.39","versionType":"custom"}]}],"modified":"2026-10-06T20:25:50.371Z","provider":"cve","references":["https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","https://issues.chromium.org/issues/552440317"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":8.8,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","integrityImpact":"HIGH","userInteraction":"REQUIRED","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"HIGH"}},{"other":{"type":"ssvc","content":{"id":"CVE-2026-106249","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-06T20:16:48.228784Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-06T20:25:50.371Z"}}],"cna":{"orgId":"ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28","shortName":"Chrome","dateUpdated":"2026-10-06T18:41:39.028Z"}}},"related_cves":[{"value":"CVE-2026-106249","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":null}},{"id":9608,"advisory_id":"9aae77a1-2f9f-4d6c-ab0f-7afc4ba1f77f","revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-106256","source_published_at":"2026-10-06T18:41:41.158+00:00","published_at":"2026-10-24T23:20:21.594682+00:00","extraction_method":"structured","technologies":["chrome","core-cve"],"cve_ids":["CVE-2026-106256"],"event_types":["advisory"],"payload":{"kind":"advisory","title":"CVE-2026-106256","summary":"Information leak in Passwords in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to obtain sensitive information via a crafted HTML page. (Chromium security severity: Low)","evidence":"cve:CVE-2026-106256","products":[{"name":{"value":"Chrome","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2026-106256","aliases":["CVE-2026-106256"],"metrics":[],"affected":[{"vendor":"Google","product":"Chrome","versions":[{"status":"affected","version":"155.0.8059.39","lessThan":"155.0.8059.39","versionType":"custom"}]}],"modified":"2026-10-06T20:25:49.981Z","provider":"cve","references":["https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","https://issues.chromium.org/issues/553335319"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":8.8,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","integrityImpact":"HIGH","userInteraction":"REQUIRED","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"HIGH"}},{"other":{"type":"ssvc","content":{"id":"CVE-2026-106256","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-06T20:16:41.553063Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-06T20:25:49.981Z"}}],"cna":{"orgId":"ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28","shortName":"Chrome","dateUpdated":"2026-10-06T18:41:41.158Z"}}},"related_cves":[{"value":"CVE-2026-106256","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":null}},{"id":9607,"advisory_id":"2e595af7-a24b-4edf-8195-6a12ef7ecb77","revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-106254","source_published_at":"2026-10-06T18:41:32.975+00:00","published_at":"2026-10-24T23:20:20.955499+00:00","extraction_method":"structured","technologies":["chrome","core-cve"],"cve_ids":["CVE-2026-106254"],"event_types":["advisory"],"payload":{"kind":"advisory","title":"CVE-2026-106254","summary":"Information leak in Mobile in Google Chrome on on Android prior to 155.0.8059.39 allowed a local attacker to obtain sensitive information via a co-installed app. (Chromium security severity: Medium)","evidence":"cve:CVE-2026-106254","products":[{"name":{"value":"Chrome","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2026-106254","aliases":["CVE-2026-106254"],"metrics":[],"affected":[{"vendor":"Google","product":"Chrome","versions":[{"status":"affected","version":"155.0.8059.39","lessThan":"155.0.8059.39","versionType":"custom"}]}],"modified":"2026-10-06T20:21:20.783Z","provider":"cve","references":["https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","https://issues.chromium.org/issues/557036053"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":5.1,"attackVector":"LOCAL","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"HIGH","availabilityImpact":"NONE","privilegesRequired":"NONE","confidentialityImpact":"HIGH"}},{"other":{"type":"ssvc","content":{"id":"CVE-2026-106254","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-06T20:21:17.984313Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-06T20:21:20.783Z"}}],"cna":{"orgId":"ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28","shortName":"Chrome","dateUpdated":"2026-10-06T18:41:32.975Z"}}},"related_cves":[{"value":"CVE-2026-106254","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":null}},{"id":9606,"advisory_id":"29894321-9e4b-4690-ac1f-7b78fde7345e","revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-106225","source_published_at":"2026-10-06T18:41:18.606+00:00","published_at":"2026-10-24T23:20:20.461507+00:00","extraction_method":"structured","technologies":["chrome","core-cve"],"cve_ids":["CVE-2026-106225"],"event_types":["advisory"],"payload":{"kind":"advisory","title":"CVE-2026-106225","summary":"Missing authorization in Autofill in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to obtain sensitive information via a crafted HTML page. (Chromium security severity: Medium)","evidence":"cve:CVE-2026-106225","products":[{"name":{"value":"Chrome","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2026-106225","aliases":["CVE-2026-106225"],"metrics":[],"affected":[{"vendor":"Google","product":"Chrome","versions":[{"status":"affected","version":"155.0.8059.39","lessThan":"155.0.8059.39","versionType":"custom"}]}],"modified":"2026-10-06T20:25:51.344Z","provider":"cve","references":["https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","https://issues.chromium.org/issues/501805355"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":8.8,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","integrityImpact":"HIGH","userInteraction":"REQUIRED","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"HIGH"}},{"other":{"type":"ssvc","content":{"id":"CVE-2026-106225","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-06T20:17:03.630154Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-06T20:25:51.344Z"}}],"cna":{"orgId":"ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28","shortName":"Chrome","dateUpdated":"2026-10-06T18:41:18.606Z"}}},"related_cves":[{"value":"CVE-2026-106225","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":null}},{"id":9605,"advisory_id":"f7cdfc9f-7bba-4df7-b79b-503c4d59170f","revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-106220","source_published_at":"2026-10-06T18:41:38.263+00:00","published_at":"2026-10-24T23:20:20.310044+00:00","extraction_method":"structured","technologies":["chrome","core-cve"],"cve_ids":["CVE-2026-106220"],"event_types":["advisory"],"payload":{"kind":"advisory","title":"CVE-2026-106220","summary":"Information leak in Passwords in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to obtain sensitive information via a crafted HTML page. (Chromium security severity: Low)","evidence":"cve:CVE-2026-106220","products":[{"name":{"value":"Chrome","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2026-106220","aliases":["CVE-2026-106220"],"metrics":[],"affected":[{"vendor":"Google","product":"Chrome","versions":[{"status":"affected","version":"155.0.8059.39","lessThan":"155.0.8059.39","versionType":"custom"}]}],"modified":"2026-10-06T20:25:50.541Z","provider":"cve","references":["https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","https://issues.chromium.org/issues/534843648"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":8.8,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","integrityImpact":"HIGH","userInteraction":"REQUIRED","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"HIGH"}},{"other":{"type":"ssvc","content":{"id":"CVE-2026-106220","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-06T20:16:50.068434Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-06T20:25:50.541Z"}}],"cna":{"orgId":"ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28","shortName":"Chrome","dateUpdated":"2026-10-06T18:41:38.263Z"}}},"related_cves":[{"value":"CVE-2026-106220","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":null}},{"id":9604,"advisory_id":"4959dedc-8518-4774-9530-ea8ebd966c6d","revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-106214","source_published_at":"2026-10-06T18:41:08.709+00:00","published_at":"2026-10-24T23:20:19.861904+00:00","extraction_method":"structured","technologies":["chrome","core-cve"],"cve_ids":["CVE-2026-106214"],"event_types":["advisory"],"payload":{"kind":"advisory","title":"CVE-2026-106214","summary":"Information leak in Proxy in Google Chrome on on Windows prior to 155.0.8059.39 allowed an adjacent attacker to obtain sensitive information via crafted network traffic. (Chromium security severity: High)","evidence":"cve:CVE-2026-106214","products":[{"name":{"value":"Chrome","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2026-106214","aliases":["CVE-2026-106214"],"metrics":[],"affected":[{"vendor":"Google","product":"Chrome","versions":[{"status":"affected","version":"155.0.8059.39","lessThan":"155.0.8059.39","versionType":"custom"}]}],"modified":"2026-10-06T20:22:31.840Z","provider":"cve","references":["https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","https://issues.chromium.org/issues/533493992"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":5.3,"attackVector":"ADJACENT_NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"HIGH","availabilityImpact":"NONE","privilegesRequired":"NONE","confidentialityImpact":"HIGH"}},{"other":{"type":"ssvc","content":{"id":"CVE-2026-106214","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-06T20:22:28.338453Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-06T20:22:31.840Z"}}],"cna":{"orgId":"ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28","shortName":"Chrome","dateUpdated":"2026-10-06T18:41:08.709Z"}}},"related_cves":[{"value":"CVE-2026-106214","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":null}},{"id":9603,"advisory_id":"51bac32a-d081-4c67-acdb-d5ffc8d35f1f","revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-106206","source_published_at":"2026-10-06T18:41:25.01+00:00","published_at":"2026-10-24T23:20:19.665353+00:00","extraction_method":"structured","technologies":["chrome","core-cve"],"cve_ids":["CVE-2026-106206"],"event_types":["advisory"],"payload":{"kind":"advisory","title":"CVE-2026-106206","summary":"Improper input validation in Mobile in Google Chrome on on iOS prior to 155.0.8059.39 allowed a remote attacker to obtain sensitive information via crafted network traffic. (Chromium security severity: Medium)","evidence":"cve:CVE-2026-106206","products":[{"name":{"value":"Chrome","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2026-106206","aliases":["CVE-2026-106206"],"metrics":[],"affected":[{"vendor":"Google","product":"Chrome","versions":[{"status":"affected","version":"155.0.8059.39","lessThan":"155.0.8059.39","versionType":"custom"}]}],"modified":"2026-10-06T20:23:14.384Z","provider":"cve","references":["https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","https://issues.chromium.org/issues/517374100"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":5.9,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"HIGH","availabilityImpact":"NONE","privilegesRequired":"NONE","confidentialityImpact":"HIGH"}},{"other":{"type":"ssvc","content":{"id":"CVE-2026-106206","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-06T20:23:10.954933Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-06T20:23:14.384Z"}}],"cna":{"orgId":"ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28","shortName":"Chrome","dateUpdated":"2026-10-06T18:41:25.010Z"}}},"related_cves":[{"value":"CVE-2026-106206","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":null}},{"id":9602,"advisory_id":"1c3c92a6-1c7b-4044-bce7-e2d9c0914a2e","revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-106212","source_published_at":"2026-10-06T18:41:29.967+00:00","published_at":"2026-10-24T23:20:19.296132+00:00","extraction_method":"structured","technologies":["chrome","core-cve"],"cve_ids":["CVE-2026-106212"],"event_types":["advisory"],"payload":{"kind":"advisory","title":"CVE-2026-106212","summary":"Incorrect authorization in Autofill in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to obtain sensitive information via a crafted HTML page. (Chromium security severity: Medium)","evidence":"cve:CVE-2026-106212","products":[{"name":{"value":"Chrome","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2026-106212","aliases":["CVE-2026-106212"],"metrics":[],"affected":[{"vendor":"Google","product":"Chrome","versions":[{"status":"affected","version":"155.0.8059.39","lessThan":"155.0.8059.39","versionType":"custom"}]}],"modified":"2026-10-06T20:25:50.922Z","provider":"cve","references":["https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","https://issues.chromium.org/issues/540072162"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":8.8,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","integrityImpact":"HIGH","userInteraction":"REQUIRED","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"HIGH"}},{"other":{"type":"ssvc","content":{"id":"CVE-2026-106212","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-06T20:16:56.403857Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-06T20:25:50.922Z"}}],"cna":{"orgId":"ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28","shortName":"Chrome","dateUpdated":"2026-10-06T18:41:29.967Z"}}},"related_cves":[{"value":"CVE-2026-106212","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":null}},{"id":9601,"advisory_id":"32fe9761-f9d6-450e-99ee-4ab334557933","revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-106203","source_published_at":"2026-10-06T18:41:10.252+00:00","published_at":"2026-10-24T23:20:18.994533+00:00","extraction_method":"structured","technologies":["chrome","core-cve"],"cve_ids":["CVE-2026-106203"],"event_types":["advisory"],"payload":{"kind":"advisory","title":"CVE-2026-106203","summary":"Incomplete cleanup in Autofill in Google Chrome on on iOS prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to obtain sensitive information via a crafted HTML page. (Chromium security severity: High)","evidence":"cve:CVE-2026-106203","products":[{"name":{"value":"Chrome","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2026-106203","aliases":["CVE-2026-106203"],"metrics":[],"affected":[{"vendor":"Google","product":"Chrome","versions":[{"status":"affected","version":"155.0.8059.39","lessThan":"155.0.8059.39","versionType":"custom"}]}],"modified":"2026-10-06T20:25:51.733Z","provider":"cve","references":["https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","https://issues.chromium.org/issues/553394296"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":8.8,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","integrityImpact":"HIGH","userInteraction":"REQUIRED","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"HIGH"}},{"other":{"type":"ssvc","content":{"id":"CVE-2026-106203","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-06T20:17:09.614120Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-06T20:25:51.733Z"}}],"cna":{"orgId":"ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28","shortName":"Chrome","dateUpdated":"2026-10-06T18:41:10.252Z"}}},"related_cves":[{"value":"CVE-2026-106203","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":null}},{"id":9600,"advisory_id":"569dc808-6d8c-4f74-bc5d-7e51466cd967","revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-102169","source_published_at":"2026-10-06T19:40:30.888+00:00","published_at":"2026-10-24T23:20:18.686659+00:00","extraction_method":"structured","technologies":["core-cve","wi-fi-access-points"],"cve_ids":["CVE-2026-102169"],"event_types":["advisory"],"payload":{"kind":"advisory","title":"Security Advisory 0194","summary":"On affected Arista Wi-Fi access points with Captive Portal enabled, an unauthenticated wireless client connected to a captive-portal-enabled SSID can crash the portal service with a crafted HTTP request. The service automatically restarts, but a sustained low-rate attack can cause a persistent denial of service of the captive portal. Remote code execution is not possible.","evidence":"cve:CVE-2026-102169","products":[{"name":{"value":"Wi-Fi Access Points","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-102169","aliases":["CVE-2026-102169"],"metrics":[{"format":"CVSS","cvssV3_1":{"version":"3.1","baseScore":6.5,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},"scenarios":[{"lang":"en","value":"GENERAL"}]},{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":7.1,"baseSeverity":"HIGH","vectorString":"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"affected":[{"vendor":"Arista Networks","product":"Wi-Fi Access Points","versions":[{"status":"affected","version":"22.0.0","versionType":"custom","lessThanOrEqual":"22.0.1F-32"},{"status":"affected","version":"21.3.0","versionType":"custom","lessThanOrEqual":"21.3.0M-13"},{"status":"affected","version":"1.0.0","lessThan":"21.3.0","versionType":"custom"}],"platforms":["Wi-Fi Access Points"],"defaultStatus":"unaffected"}],"modified":"2026-10-06T20:07:05.528Z","provider":"cve","references":["https://www.arista.com/en/support/advisories-notices/security-advisory/24810-security-advisory-0194"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-102169","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-06T20:06:55.662490Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-06T20:07:05.528Z"}}],"cna":{"orgId":"c8b34d1a-69ae-45c3-88fe-f3b3d44f39b7","shortName":"Arista","dateUpdated":"2026-10-06T19:40:30.888Z"}}},"related_cves":[{"value":"CVE-2026-102169","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"}},{"id":9599,"advisory_id":"ebaff33c-7d3b-47c8-b552-d834cb76a924","revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-66666","source_published_at":"2026-10-06T17:48:37.371+00:00","published_at":"2026-10-24T23:20:18.106537+00:00","extraction_method":"structured","technologies":["core-cve","wordpress"],"cve_ids":["CVE-2026-66666"],"event_types":["advisory"],"payload":{"kind":"advisory","title":"WordPress Core <= 7.1.2 - Unauthenticated Sensitive Data Exposure of Comments on Private and Unpublished Posts via Comment Feed vulnerability","summary":"Insertion of Sensitive Information Into Sent Data vulnerability in Automattic WordPress allows Retrieve Embedded Sensitive Data. This issue affects WordPress: from 7.1 through 7.1.2, from 7.0 through 7.0.6, from 6.9 through 6.9.9, from 6.8 through 6.8.10, from 6.7 through 6.7.9, and from 6.6 through 6.6.9.","evidence":"cve:CVE-2026-66666","products":[{"name":{"value":"WordPress","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-66666","aliases":["CVE-2026-66666"],"metrics":[{"format":"CVSS","cvssV4_0":{"Safety":"NOT_DEFINED","version":"4.0","Recovery":"NOT_DEFINED","baseScore":6.9,"Automatable":"NOT_DEFINED","attackVector":"NETWORK","baseSeverity":"MEDIUM","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","exploitMaturity":"NOT_DEFINED","providerUrgency":"NOT_DEFINED","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","subIntegrityImpact":"NONE","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"affected":[{"vendor":"Automattic","product":"WordPress","versions":[{"status":"affected","changes":[{"at":"7.1.3","status":"unaffected"}],"version":"7.1","versionType":"custom","lessThanOrEqual":"7.1.2"},{"status":"affected","changes":[{"at":"7.0.7","status":"unaffected"}],"version":"7.0","versionType":"custom","lessThanOrEqual":"7.0.6"},{"status":"affected","changes":[{"at":"6.9.10","status":"unaffected"}],"version":"6.9","versionType":"custom","lessThanOrEqual":"6.9.9"},{"status":"affected","changes":[{"at":"6.8.11","status":"unaffected"}],"version":"6.8","versionType":"custom","lessThanOrEqual":"6.8.10"},{"status":"affected","changes":[{"at":"6.7.10","status":"unaffected"}],"version":"6.7","versionType":"custom","lessThanOrEqual":"6.7.9"},{"status":"affected","changes":[{"at":"6.6.10","status":"unaffected"}],"version":"6.6","versionType":"custom","lessThanOrEqual":"6.6.9"}],"defaultStatus":"unaffected"}],"modified":"2026-10-06T20:05:54.337Z","provider":"cve","references":["https://patchstack.com/database/wordpress/wordpress/wordpress/vulnerability/wordpress-wordpress-wordpress-7-1-2-sensitive-data-exposure-vulnerability?_s_id=cve","https://wordpress.org/news/2026/10/wordpress-7-1-3-maintenance-and-security-release/","https://patchstack.com/articles/wordpress-7-1-3-security-release?_s_id=cve"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-66666","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-06T18:21:14.868038Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-06T18:21:39.557Z"}}],"cna":{"orgId":"21595511-bba5-4825-b968-b78d1f9984a3","shortName":"Patchstack","dateUpdated":"2026-10-06T20:05:54.337Z"}}},"related_cves":[{"value":"CVE-2026-66666","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"}},{"id":9598,"advisory_id":"305bc0a7-bf5d-4642-a3b6-bcb20935180b","revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-106334","source_published_at":"2026-10-06T18:41:42.726+00:00","published_at":"2026-10-24T23:20:17.507689+00:00","extraction_method":"structured","technologies":["chrome","core-cve"],"cve_ids":["CVE-2026-106334"],"event_types":["advisory"],"payload":{"kind":"advisory","title":"CVE-2026-106334","summary":"Information leak in Payments in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to obtain sensitive information via a crafted HTML page. (Chromium security severity: Low)","evidence":"cve:CVE-2026-106334","products":[{"name":{"value":"Chrome","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2026-106334","aliases":["CVE-2026-106334"],"metrics":[],"affected":[{"vendor":"Google","product":"Chrome","versions":[{"status":"affected","version":"155.0.8059.39","lessThan":"155.0.8059.39","versionType":"custom"}]}],"modified":"2026-10-06T20:15:52.357Z","provider":"cve","references":["https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","https://issues.chromium.org/issues/556229780"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":8.8,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","integrityImpact":"HIGH","userInteraction":"REQUIRED","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"HIGH"}},{"other":{"type":"ssvc","content":{"id":"CVE-2026-106334","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-06T20:15:48.174928Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-06T20:15:52.357Z"}}],"cna":{"orgId":"ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28","shortName":"Chrome","dateUpdated":"2026-10-06T18:41:42.726Z"}}},"related_cves":[{"value":"CVE-2026-106334","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":null}},{"id":9597,"advisory_id":"f401b507-fb62-4271-96a7-16aa75b5bec0","revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-106340","source_published_at":"2026-10-06T18:41:33.606+00:00","published_at":"2026-10-24T23:20:16.914925+00:00","extraction_method":"structured","technologies":["chrome","core-cve"],"cve_ids":["CVE-2026-106340"],"event_types":["advisory"],"payload":{"kind":"advisory","title":"CVE-2026-106340","summary":"Missing authorization in CredentialProvider in Google Chrome on on Windows prior to 155.0.8059.39 allowed a local attacker to obtain sensitive information via physical access. (Chromium security severity: Low)","evidence":"cve:CVE-2026-106340","products":[{"name":{"value":"Chrome","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2026-106340","aliases":["CVE-2026-106340"],"metrics":[],"affected":[{"vendor":"Google","product":"Chrome","versions":[{"status":"affected","version":"155.0.8059.39","lessThan":"155.0.8059.39","versionType":"custom"}]}],"modified":"2026-10-06T20:17:54.664Z","provider":"cve","references":["https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","https://issues.chromium.org/issues/503794852"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":4.6,"attackVector":"PHYSICAL","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"NONE","confidentialityImpact":"HIGH"}},{"other":{"type":"ssvc","content":{"id":"CVE-2026-106340","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-06T20:17:51.663714Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-06T20:17:54.664Z"}}],"cna":{"orgId":"ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28","shortName":"Chrome","dateUpdated":"2026-10-06T18:41:33.606Z"}}},"related_cves":[{"value":"CVE-2026-106340","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":null}},{"id":9596,"advisory_id":"05bd9d9b-1adc-4189-9377-fea53701666f","revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-102168","source_published_at":"2026-10-06T19:40:30.345+00:00","published_at":"2026-10-24T23:20:15.934516+00:00","extraction_method":"structured","technologies":["core-cve","wi-fi-access-points"],"cve_ids":["CVE-2026-102168"],"event_types":["advisory"],"payload":{"kind":"advisory","title":"Security Advisory 0194","summary":"On affected Arista Wi-Fi access points with Captive Portal enabled, an unauthenticated wireless client connected to a Captive-Portal-enabled SSID can crash the portal service with a crafted HTTP request. This results in a temporary denial of service until the service automatically restarts. Remote code execution is not possible.","evidence":"cve:CVE-2026-102168","products":[{"name":{"value":"Wi-Fi Access Points","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-102168","aliases":["CVE-2026-102168"],"metrics":[{"format":"CVSS","cvssV3_1":{"version":"3.1","baseScore":6.5,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},"scenarios":[{"lang":"en","value":"GENERAL"}]},{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":7.1,"baseSeverity":"HIGH","vectorString":"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"affected":[{"vendor":"Arista Networks","product":"Wi-Fi Access Points","versions":[{"status":"affected","version":"22.0.0","versionType":"custom","lessThanOrEqual":"22.0.1F-32"},{"status":"affected","version":"21.3.0","versionType":"custom","lessThanOrEqual":"21.3.0M-13"},{"status":"affected","version":"1.0.0","lessThan":"21.3.0","versionType":"custom"}],"platforms":["Wi-Fi Access Points"],"defaultStatus":"unaffected"}],"modified":"2026-10-06T20:06:39.424Z","provider":"cve","references":["https://www.arista.com/en/support/advisories-notices/security-advisory/24810-security-advisory-0194"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-102168","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-06T20:06:24.609870Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-06T20:06:39.424Z"}}],"cna":{"orgId":"c8b34d1a-69ae-45c3-88fe-f3b3d44f39b7","shortName":"Arista","dateUpdated":"2026-10-06T19:40:30.345Z"}}},"related_cves":[{"value":"CVE-2026-102168","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"}},{"id":9595,"advisory_id":"ad99230b-8c05-4647-957b-c82356d45350","revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-102167","source_published_at":"2026-10-06T19:40:32.432+00:00","published_at":"2026-10-24T23:20:15.338563+00:00","extraction_method":"structured","technologies":["core-cve","wi-fi-access-points"],"cve_ids":["CVE-2026-102167"],"event_types":["advisory"],"payload":{"kind":"advisory","title":"Security Advisory 0197","summary":"On affected Arista Wi-Fi access points, a memory corruption vulnerability exists in access point's wired uplink network endpoints. An unauthenticated attacker can crash the sensor service or potentially achieve remote code execution. Exploitation requires the attacker to be on the same network segment as the access point's wired uplink.","evidence":"cve:CVE-2026-102167","products":[{"name":{"value":"Wi-Fi Access Points","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","structured":{"id":"CVE-2026-102167","aliases":["CVE-2026-102167"],"metrics":[{"format":"CVSS","cvssV3_1":{"version":"3.1","baseScore":7.5,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"GENERAL"}]},{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":9,"baseSeverity":"CRITICAL","vectorString":"CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"affected":[{"vendor":"Arista Networks","product":"Wi-Fi Access Points","versions":[{"status":"affected","version":"22.0.0","versionType":"custom","lessThanOrEqual":"22.0.1F-32"},{"status":"affected","version":"21.3.0","versionType":"custom","lessThanOrEqual":"21.3.0M-13"},{"status":"affected","version":"1.0.0","lessThan":"21.3.0","versionType":"custom"}],"platforms":["Wi-Fi Access Points"],"defaultStatus":"unaffected"}],"modified":"2026-10-06T20:00:36.697Z","provider":"cve","references":["https://www.arista.com/en/support/advisories-notices/security-advisory/24813-security-advisory-0197"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-102167","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-10-06T20:00:24.458435Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-06T20:00:36.697Z"}}],"cna":{"orgId":"c8b34d1a-69ae-45c3-88fe-f3b3d44f39b7","shortName":"Arista","dateUpdated":"2026-10-06T19:40:32.432Z"}}},"related_cves":[{"value":"CVE-2026-102167","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"}},{"id":9594,"advisory_id":"b4a76eb5-6698-42b5-8a1e-d390ef89e3bb","revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-102165","source_published_at":"2026-10-06T19:40:32.909+00:00","published_at":"2026-10-24T23:20:14.550669+00:00","extraction_method":"structured","technologies":["core-cve","wi-fi-access-points"],"cve_ids":["CVE-2026-102165"],"event_types":["advisory"],"payload":{"kind":"advisory","title":"Security Advisory 0198","summary":"On affected Arista Wi-Fi access points, an unauthenticated attacker with network access to the capture service can send a crafted packet to cause the service to crash or potentially achieve remote code execution. This exploit requires an uncommonly used non-default streaming mode.","evidence":"cve:CVE-2026-102165","products":[{"name":{"value":"Wi-Fi Access Points","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-102165","aliases":["CVE-2026-102165"],"metrics":[{"format":"CVSS","cvssV3_1":{"version":"3.1","baseScore":7.5,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"GENERAL"}]},{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":7.7,"baseSeverity":"HIGH","vectorString":"CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"affected":[{"vendor":"Arista Networks","product":"Wi-Fi Access Points","versions":[{"status":"affected","version":"22.0.0","versionType":"custom","lessThanOrEqual":"22.0.1F-32"},{"status":"affected","version":"21.3.0","versionType":"custom","lessThanOrEqual":"21.3.0M-13"},{"status":"affected","version":"1.0.0","lessThan":"21.3.0","versionType":"custom"}],"platforms":["Wi-Fi Access Points"],"defaultStatus":"unaffected"}],"modified":"2026-10-06T20:00:05.234Z","provider":"cve","references":["https://www.arista.com/en/support/advisories-notices/security-advisory/24814-security-advisory-0198"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-102165","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-10-06T19:59:55.213686Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-06T20:00:05.234Z"}}],"cna":{"orgId":"c8b34d1a-69ae-45c3-88fe-f3b3d44f39b7","shortName":"Arista","dateUpdated":"2026-10-06T19:40:32.909Z"}}},"related_cves":[{"value":"CVE-2026-102165","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"}},{"id":9593,"advisory_id":"a74074b6-8287-4f44-8613-047bc286fd78","revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-102164","source_published_at":"2026-10-06T19:40:31.913+00:00","published_at":"2026-10-24T23:20:13.734474+00:00","extraction_method":"structured","technologies":["core-cve","wi-fi-access-points"],"cve_ids":["CVE-2026-102164"],"event_types":["advisory"],"payload":{"kind":"advisory","title":"Security Advisory 0196","summary":"On affected Arista access points configured with VXLAN tunnelling and L2-proxy (a specific configuration unique to the VESPA use-case), a wireless client associated to the tunnelled SSID can send a crafted packet, causing the access point to reveal memory contents in network traffic. No write primitive or remote code execution is possible.","evidence":"cve:CVE-2026-102164","products":[{"name":{"value":"Wi-Fi Access Points","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"low","structured":{"id":"CVE-2026-102164","aliases":["CVE-2026-102164"],"metrics":[{"format":"CVSS","cvssV3_1":{"version":"3.1","baseScore":3.1,"baseSeverity":"LOW","vectorString":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N"},"scenarios":[{"lang":"en","value":"GENERAL"}]},{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":2.3,"baseSeverity":"LOW","vectorString":"CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"affected":[{"vendor":"Arista Networks","product":"Wi-Fi Access Points","versions":[{"status":"affected","version":"22.0.0","versionType":"custom","lessThanOrEqual":"22.0.1F-32"},{"status":"affected","version":"21.3.0","versionType":"custom","lessThanOrEqual":"21.3.0M-13"},{"status":"affected","version":"1.0.0","lessThan":"21.3.0","versionType":"custom"}],"platforms":["Wi-Fi Access Points"],"defaultStatus":"unaffected"}],"modified":"2026-10-06T20:07:54.692Z","provider":"cve","references":["https://www.arista.com/en/support/advisories-notices/security-advisory/24812-security-advisory-0196"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-102164","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-06T20:07:46.593021Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-06T20:07:54.692Z"}}],"cna":{"orgId":"c8b34d1a-69ae-45c3-88fe-f3b3d44f39b7","shortName":"Arista","dateUpdated":"2026-10-06T19:40:31.913Z"}}},"related_cves":[{"value":"CVE-2026-102164","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"}},{"id":9592,"advisory_id":"47cc94d4-6bc1-4df4-824e-9df690ac48ae","revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-102163","source_published_at":"2026-10-06T19:40:31.435+00:00","published_at":"2026-10-24T23:20:12.955317+00:00","extraction_method":"structured","technologies":["core-cve","wi-fi-access-points"],"cve_ids":["CVE-2026-102163"],"event_types":["advisory"],"payload":{"kind":"advisory","title":"Security Advisory 0195","summary":"On affected Arista access points with Wireless Intrusion Prevention System (WIPS) active, an unauthenticated attacker within radio frequency (RF) proximity can send a crafted frame to crash the sensor service, disabling WIPS monitoring on the access point, or potentially achieve remote code execution. No wireless association or authentication is required.","evidence":"cve:CVE-2026-102163","products":[{"name":{"value":"Wi-Fi Access Points","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-102163","aliases":["CVE-2026-102163"],"metrics":[{"format":"CVSS","cvssV3_1":{"version":"3.1","baseScore":8.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"GENERAL"}]},{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":8.7,"baseSeverity":"HIGH","vectorString":"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"affected":[{"vendor":"Arista Networks","product":"Wi-Fi Access Points","versions":[{"status":"affected","version":"22.0.0","versionType":"custom","lessThanOrEqual":"22.0.1F-32"},{"status":"affected","version":"21.3.0","versionType":"custom","lessThanOrEqual":"21.3.0M-13"},{"status":"affected","version":"1.0.0","lessThan":"21.3.0","versionType":"custom"}],"platforms":["Wi-Fi Access Points"],"defaultStatus":"unaffected"}],"modified":"2026-10-06T20:07:33.630Z","provider":"cve","references":["https://www.arista.com/en/support/advisories-notices/security-advisory/24811-security-advisory-0195"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-102163","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-10-06T20:07:23.178346Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-06T20:07:33.630Z"}}],"cna":{"orgId":"c8b34d1a-69ae-45c3-88fe-f3b3d44f39b7","shortName":"Arista","dateUpdated":"2026-10-06T19:40:31.435Z"}}},"related_cves":[{"value":"CVE-2026-102163","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"}},{"id":9591,"advisory_id":"50890aa0-448d-4295-af2b-e5838c1d8ec8","revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-102162","source_published_at":"2026-10-06T19:40:29.864+00:00","published_at":"2026-10-24T23:20:12.179237+00:00","extraction_method":"structured","technologies":["core-cve","wi-fi-access-points"],"cve_ids":["CVE-2026-102162"],"event_types":["advisory"],"payload":{"kind":"advisory","title":"Security Advisory 0193","summary":"On affected Arista Wi-Fi access points with captive portal, or application firewall enabled on at least one SSID, a vulnerability in the wireless gateway service could allow an unauthenticated network-adjacent attacker to send a crafted packet that triggers a stack overflow, resulting in a denial-of-service condition or potentially execute arbitrary code on the device. The wireless gateway service is automatically restarted after a crash, allowing repeated exploitation attempts.","evidence":"cve:CVE-2026-102162","products":[{"name":{"value":"Wi-Fi Access Points","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","structured":{"id":"CVE-2026-102162","aliases":["CVE-2026-102162"],"metrics":[{"format":"CVSS","cvssV3_1":{"version":"3.1","baseScore":8.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"GENERAL"}]},{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":9.4,"baseSeverity":"CRITICAL","vectorString":"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"affected":[{"vendor":"Arista Networks","product":"Wi-Fi Access Points","versions":[{"status":"affected","version":"22.0.0","versionType":"custom","lessThanOrEqual":"22.0.1F-32"},{"status":"affected","version":"21.3.0","versionType":"custom","lessThanOrEqual":"21.3.0M-13"},{"status":"affected","version":"1.0.0","lessThan":"21.3.0","versionType":"custom"}],"platforms":["Wi-Fi Access Points"],"defaultStatus":"unaffected"}],"modified":"2026-10-06T20:06:08.243Z","provider":"cve","references":["https://www.arista.com/en/support/advisories-notices/security-advisory/24809-security-advisory-0193"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-102162","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-10-06T20:05:56.170458Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-06T20:06:08.243Z"}}],"cna":{"orgId":"c8b34d1a-69ae-45c3-88fe-f3b3d44f39b7","shortName":"Arista","dateUpdated":"2026-10-06T19:40:29.864Z"}}},"related_cves":[{"value":"CVE-2026-102162","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"}},{"id":9590,"advisory_id":"afe74b58-6803-4467-84ba-c33600cc6e0e","revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-102161","source_published_at":"2026-10-06T19:39:54.646+00:00","published_at":"2026-10-24T23:20:11.582638+00:00","extraction_method":"structured","technologies":["cloudvision-cue","core-cve"],"cve_ids":["CVE-2026-102161"],"event_types":["advisory"],"payload":{"kind":"advisory","title":"Security Advisory 0190","summary":"An unauthenticated attacker located on an adjacent private network (or any attacker routed through a reverse proxy/load balancer that forwards client headers) can forge their source IP address and gain administrative session privileges on the CV-CUE backend.","evidence":"cve:CVE-2026-102161","products":[{"name":{"value":"CloudVision CUE","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-102161","aliases":["CVE-2026-102161"],"metrics":[{"format":"CVSS","cvssV3_1":{"version":"3.1","baseScore":8.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"GENERAL"}]},{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":8.7,"baseSeverity":"HIGH","vectorString":"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"affected":[{"vendor":"Arista Networks","product":"CloudVision CUE","versions":[{"status":"affected","version":"2021.2.0","versionType":"custom","lessThanOrEqual":"2026.2.0"}],"platforms":["CloudVision CUE on-premises, virtual appliance or physical appliance"],"defaultStatus":"unaffected"}],"modified":"2026-10-06T20:04:10.245Z","provider":"cve","references":["https://www.arista.com/en/support/advisories-notices/security-advisory/24806-security-advisory-0190"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-102161","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-10-06T20:04:00.722473Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-06T20:04:10.245Z"}}],"cna":{"orgId":"c8b34d1a-69ae-45c3-88fe-f3b3d44f39b7","shortName":"Arista","dateUpdated":"2026-10-06T19:39:54.646Z"}}},"related_cves":[{"value":"CVE-2026-102161","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"}},{"id":9589,"advisory_id":"6182bd12-6dac-489c-a8f6-8d8c3eb182f1","revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-102160","source_published_at":"2026-10-06T19:39:54.096+00:00","published_at":"2026-10-24T23:20:10.802403+00:00","extraction_method":"structured","technologies":["cloudvision-cue","core-cve"],"cve_ids":["CVE-2026-102160"],"event_types":["advisory"],"payload":{"kind":"advisory","title":"Security Advisory 0190","summary":"An operating system (OS) command injection vulnerability in CloudVision CUE backup management may allow an authenticated Super User to submit a crafted backup request and execute arbitrary commands with the privileges of the affected service.","evidence":"cve:CVE-2026-102160","products":[{"name":{"value":"CloudVision CUE","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-102160","aliases":["CVE-2026-102160"],"metrics":[{"format":"CVSS","cvssV3_1":{"version":"3.1","baseScore":7.2,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"GENERAL"}]},{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":8.6,"baseSeverity":"HIGH","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"affected":[{"vendor":"Arista Networks","product":"CloudVision CUE","versions":[{"status":"affected","version":"2021.2.0","versionType":"custom","lessThanOrEqual":"2026.2.0"}],"platforms":["CloudVision CUE on-premises, virtual appliance or physical appliance"],"defaultStatus":"unaffected"}],"modified":"2026-10-06T20:03:43.702Z","provider":"cve","references":["https://www.arista.com/en/support/advisories-notices/security-advisory/24806-security-advisory-0190"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-102160","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-10-06T20:03:34.193659Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-06T20:03:43.702Z"}}],"cna":{"orgId":"c8b34d1a-69ae-45c3-88fe-f3b3d44f39b7","shortName":"Arista","dateUpdated":"2026-10-06T19:39:54.096Z"}}},"related_cves":[{"value":"CVE-2026-102160","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"}},{"id":9588,"advisory_id":"c0df33e5-c90e-4438-a2be-1156199f0e24","revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-102158","source_published_at":"2026-10-06T19:39:53.096+00:00","published_at":"2026-10-24T23:20:10.236267+00:00","extraction_method":"structured","technologies":["cloudvision-cue","core-cve"],"cve_ids":["CVE-2026-102158"],"event_types":["advisory"],"payload":{"kind":"advisory","title":"Security Advisory 0190","summary":"Improper validation of selected CloudVision CUE application programming interface (API) request parameters may allow an authenticated network user to perform SQL injection against the backend impacting its availability.","evidence":"cve:CVE-2026-102158","products":[{"name":{"value":"CloudVision CUE","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-102158","aliases":["CVE-2026-102158"],"metrics":[{"format":"CVSS","cvssV3_1":{"version":"3.1","baseScore":6.5,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"},"scenarios":[{"lang":"en","value":"GENERAL"}]},{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":7.1,"baseSeverity":"HIGH","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"affected":[{"vendor":"Arista Networks","product":"CloudVision CUE","versions":[{"status":"affected","version":"2022.2.0","versionType":"custom","lessThanOrEqual":"2026.2.0"}],"platforms":["CloudVision CUE on-premises, virtual appliance or physical appliance"],"defaultStatus":"unaffected"}],"modified":"2026-10-06T20:02:40.724Z","provider":"cve","references":["https://www.arista.com/en/support/advisories-notices/security-advisory/24806-security-advisory-0190"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-102158","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-06T20:02:19.932346Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-06T20:02:40.724Z"}}],"cna":{"orgId":"c8b34d1a-69ae-45c3-88fe-f3b3d44f39b7","shortName":"Arista","dateUpdated":"2026-10-06T19:39:53.096Z"}}},"related_cves":[{"value":"CVE-2026-102158","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"}},{"id":9587,"advisory_id":"a226fb5c-382b-433c-89f7-19dba587b084","revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-102159","source_published_at":"2026-10-06T19:39:53.582+00:00","published_at":"2026-10-24T23:20:09.485918+00:00","extraction_method":"structured","technologies":["cloudvision-cue","core-cve"],"cve_ids":["CVE-2026-102159"],"event_types":["advisory"],"payload":{"kind":"advisory","title":"Security Advisory 0190","summary":"An access-control flaw in the CV-CUE backend may allow an unauthenticated network attacker to access functionality intended only for internal services. Successful exploitation may expose sensitive location information or disrupt affected services.","evidence":"cve:CVE-2026-102159","products":[{"name":{"value":"CloudVision CUE","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","structured":{"id":"CVE-2026-102159","aliases":["CVE-2026-102159"],"metrics":[{"format":"CVSS","cvssV3_1":{"version":"3.1","baseScore":9.8,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"GENERAL"}]},{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":9.3,"baseSeverity":"CRITICAL","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"affected":[{"vendor":"Arista Networks","product":"CloudVision CUE","versions":[{"status":"affected","version":"2022.3.0","versionType":"custom","lessThanOrEqual":"2026.2.0"}],"platforms":["CloudVision CUE on-premises, virtual appliance or physical appliance"],"defaultStatus":"unaffected"}],"modified":"2026-10-06T20:03:15.078Z","provider":"cve","references":["https://www.arista.com/en/support/advisories-notices/security-advisory/24806-security-advisory-0190"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-102159","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-10-06T20:03:00.815750Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-06T20:03:15.078Z"}}],"cna":{"orgId":"c8b34d1a-69ae-45c3-88fe-f3b3d44f39b7","shortName":"Arista","dateUpdated":"2026-10-06T19:39:53.582Z"}}},"related_cves":[{"value":"CVE-2026-102159","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"}},{"id":9586,"advisory_id":"8baad36a-b021-48bb-a3de-9b237642008d","revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-102157","source_published_at":"2026-10-06T19:39:52.569+00:00","published_at":"2026-10-24T23:20:08.700877+00:00","extraction_method":"structured","technologies":["cloudvision-cue","core-cve"],"cve_ids":["CVE-2026-102157"],"event_types":["advisory"],"payload":{"kind":"advisory","title":"Security Advisory 0190","summary":"An insecure direct object reference (IDOR) vulnerability in a CloudVision CUE file-serving interface may allow an authenticated network user, under specific attack conditions, to access another user's transient data.","evidence":"cve:CVE-2026-102157","products":[{"name":{"value":"CloudVision CUE","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-102157","aliases":["CVE-2026-102157"],"metrics":[{"format":"CVSS","cvssV3_1":{"version":"3.1","baseScore":5.9,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:L"},"scenarios":[{"lang":"en","value":"GENERAL"}]},{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":6.8,"baseSeverity":"MEDIUM","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:L/SC:N/SI:N/SA:N"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"affected":[{"vendor":"Arista Networks","product":"CloudVision CUE","versions":[{"status":"affected","version":"2021.2.0","versionType":"custom","lessThanOrEqual":"2026.2.0"}],"platforms":["CloudVision CUE on-premises, virtual appliance or physical appliance"],"defaultStatus":"unaffected"}],"modified":"2026-10-06T20:02:04.283Z","provider":"cve","references":["https://www.arista.com/en/support/advisories-notices/security-advisory/24806-security-advisory-0190"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-102157","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-06T20:01:56.142507Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-06T20:02:04.283Z"}}],"cna":{"orgId":"c8b34d1a-69ae-45c3-88fe-f3b3d44f39b7","shortName":"Arista","dateUpdated":"2026-10-06T19:39:52.569Z"}}},"related_cves":[{"value":"CVE-2026-102157","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"}},{"id":9585,"advisory_id":"27089dd4-50b4-4902-b85a-4ee3fac4a0be","revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-101156","source_published_at":"2026-10-06T19:40:28.902+00:00","published_at":"2026-10-24T23:20:07.918048+00:00","extraction_method":"structured","technologies":["cloudvision-cue","core-cve"],"cve_ids":["CVE-2026-101156"],"event_types":["advisory"],"payload":{"kind":"advisory","title":"Security Advisory 0192","summary":"A stored cross-site scripting (XSS) vulnerability may allow an authenticated, high-privilege administrator to store malicious content in a configuration. The content may execute in another authenticated user's browser when that user views or compares the affected configuration. Successful exploitation may allow the attacker to act through the victim's authenticated browser session to access sensitive data, modify configurations, or disrupt managed wireless services.","evidence":"cve:CVE-2026-101156","products":[{"name":{"value":"CloudVision CUE","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-101156","aliases":["CVE-2026-101156"],"metrics":[{"format":"CVSS","cvssV3_1":{"version":"3.1","baseScore":8.4,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"GENERAL"}]},{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":6.2,"baseSeverity":"MEDIUM","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:A/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"affected":[{"vendor":"Arista Networks","product":"CloudVision CUE","versions":[{"status":"affected","version":"2025.2.0","versionType":"custom","lessThanOrEqual":"2026.2.0"}],"platforms":["CloudVision CUE on-premises, virtual appliance or physical appliance"],"defaultStatus":"unaffected"}],"modified":"2026-10-06T20:05:03.281Z","provider":"cve","references":["https://www.arista.com/en/support/advisories-notices/security-advisory/24808-security-advisory-0192"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-101156","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-10-06T20:04:54.409170Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-06T20:05:03.281Z"}}],"cna":{"orgId":"c8b34d1a-69ae-45c3-88fe-f3b3d44f39b7","shortName":"Arista","dateUpdated":"2026-10-06T19:40:28.902Z"}}},"related_cves":[{"value":"CVE-2026-101156","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"}},{"id":9584,"advisory_id":"8a68663c-e3d0-4c14-91ba-7af99ff1e19a","revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-101157","source_published_at":"2026-10-06T19:40:29.387+00:00","published_at":"2026-10-24T23:20:07.125274+00:00","extraction_method":"structured","technologies":["cloudvision-cue","core-cve"],"cve_ids":["CVE-2026-101157"],"event_types":["advisory"],"payload":{"kind":"advisory","title":"Security Advisory 0192","summary":"A stored cross-site scripting (XSS) vulnerability may allow an unauthenticated attacker with adjacent-network access to inject malicious content that executes when an authenticated user views affected content. Successful exploitation may allow the attacker to compromise the victim's authenticated browser session, access sensitive data, modify system state, or disrupt affected services.","evidence":"cve:CVE-2026-101157","products":[{"name":{"value":"CloudVision CUE","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","structured":{"id":"CVE-2026-101157","aliases":["CVE-2026-101157"],"metrics":[{"format":"CVSS","cvssV3_1":{"version":"3.1","baseScore":8.7,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:L"},"scenarios":[{"lang":"en","value":"GENERAL"}]},{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":9.3,"baseSeverity":"CRITICAL","vectorString":"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:L/SC:H/SI:H/SA:L"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"affected":[{"vendor":"Arista Networks","product":"CloudVision CUE","versions":[{"status":"affected","version":"2021.2.0","versionType":"custom","lessThanOrEqual":"2026.2.0"}],"platforms":["CloudVision CUE on-premises, virtual appliance or physical appliance"],"defaultStatus":"unaffected"}],"modified":"2026-10-06T20:05:36.991Z","provider":"cve","references":["https://www.arista.com/en/support/advisories-notices/security-advisory/24808-security-advisory-0192"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-101157","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-10-06T20:05:27.586474Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-06T20:05:36.991Z"}}],"cna":{"orgId":"c8b34d1a-69ae-45c3-88fe-f3b3d44f39b7","shortName":"Arista","dateUpdated":"2026-10-06T19:40:29.387Z"}}},"related_cves":[{"value":"CVE-2026-101157","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"}},{"id":9583,"advisory_id":"8838285a-d36c-4f31-9696-39686555e451","revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-102156","source_published_at":"2026-10-06T19:40:28.369+00:00","published_at":"2026-10-24T23:20:06.5313+00:00","extraction_method":"structured","technologies":["cloudvision-cue","core-cve"],"cve_ids":["CVE-2026-102156"],"event_types":["advisory"],"payload":{"kind":"advisory","title":"Security Advisory 0191","summary":"Improper neutralization of Lightweight Directory Access Protocol (LDAP) authentication input may allow an unauthenticated network attacker, under high-complexity conditions, to inject queries against the configured directory service.","evidence":"cve:CVE-2026-102156","products":[{"name":{"value":"CloudVision CUE","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-102156","aliases":["CVE-2026-102156"],"metrics":[{"format":"CVSS","cvssV3_1":{"version":"3.1","baseScore":6.8,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N"},"scenarios":[{"lang":"en","value":"GENERAL"}]},{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":6.9,"baseSeverity":"MEDIUM","vectorString":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"affected":[{"vendor":"Arista Networks","product":"CloudVision CUE","versions":[{"status":"affected","version":"2021.2.0","versionType":"custom","lessThanOrEqual":"2026.2.0"}],"platforms":["CloudVision CUE on-premises, virtual appliance or physical appliance"],"defaultStatus":"unaffected"}],"modified":"2026-10-06T20:04:33.983Z","provider":"cve","references":["https://www.arista.com/en/support/advisories-notices/security-advisory/24807-security-advisory-0191"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-102156","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-06T20:04:24.354512Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-06T20:04:33.983Z"}}],"cna":{"orgId":"c8b34d1a-69ae-45c3-88fe-f3b3d44f39b7","shortName":"Arista","dateUpdated":"2026-10-06T19:40:28.369Z"}}},"related_cves":[{"value":"CVE-2026-102156","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"}},{"id":9582,"advisory_id":"29192b1a-789d-40cc-8205-29345fc7af7c","revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-102155","source_published_at":"2026-10-06T19:39:52.037+00:00","published_at":"2026-10-24T23:20:05.72494+00:00","extraction_method":"structured","technologies":["cloudvision-cue","core-cve"],"cve_ids":["CVE-2026-102155"],"event_types":["advisory"],"payload":{"kind":"advisory","title":"Security Advisory 0190","summary":"An XML External Entity (XXE) injection vulnerability in the WiFi-server Spectralight application allows any authenticated user to send malicious requests, leading to arbitrary local file disclosure and partial denial of service.","evidence":"cve:CVE-2026-102155","products":[{"name":{"value":"CloudVision CUE","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-102155","aliases":["CVE-2026-102155"],"metrics":[{"format":"CVSS","cvssV3_1":{"version":"3.1","baseScore":8.5,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L"},"scenarios":[{"lang":"en","value":"GENERAL"}]},{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":7.1,"baseSeverity":"HIGH","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:L/SC:L/SI:N/SA:N"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"affected":[{"vendor":"Arista Networks","product":"CloudVision CUE","versions":[{"status":"affected","version":"2021.2.0","versionType":"custom","lessThanOrEqual":"2026.2.0"}],"platforms":["CloudVision CUE on-premises, virtual appliance or physical appliance"],"defaultStatus":"unaffected"}],"modified":"2026-10-06T20:01:43.823Z","provider":"cve","references":["https://www.arista.com/en/support/advisories-notices/security-advisory/24806-security-advisory-0190"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-102155","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-06T20:01:34.634435Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-06T20:01:43.823Z"}}],"cna":{"orgId":"c8b34d1a-69ae-45c3-88fe-f3b3d44f39b7","shortName":"Arista","dateUpdated":"2026-10-06T19:39:52.037Z"}}},"related_cves":[{"value":"CVE-2026-102155","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"}},{"id":9581,"advisory_id":"54a5ae22-2704-471b-bdd2-e699a4757d76","revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-101155","source_published_at":"2026-10-06T19:38:23.503+00:00","published_at":"2026-10-24T23:20:04.916362+00:00","extraction_method":"structured","technologies":["cloudvision-portal","core-cve"],"cve_ids":["CVE-2026-101155"],"event_types":["advisory"],"payload":{"kind":"advisory","title":"Security Advisory 0189","summary":"An authenticated remote attacker with specific permissions can read or write files on the platform filesystem beyond the intended scope through specially crafted requests and/or crafted file uploads to the Software Management Studio Software Repository.","evidence":"cve:CVE-2026-101155","products":[{"name":{"value":"CloudVision Portal","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","structured":{"id":"CVE-2026-101155","aliases":["CVE-2026-101155"],"metrics":[{"format":"CVSS","cvssV3_1":{"version":"3.1","baseScore":9.1,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"GENERAL"}]},{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":8.6,"baseSeverity":"HIGH","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"affected":[{"vendor":"Arista Networks","product":"CloudVision Portal","versions":[{"status":"affected","version":"2026.2.0","versionType":"custom"},{"status":"affected","version":"2026.1.0","versionType":"custom","lessThanOrEqual":"2026.1.2"},{"status":"affected","version":"2025.3.0","versionType":"custom","lessThanOrEqual":"2025.3.3"},{"status":"affected","version":"2024.2.0","lessThan":"2025.3.0","versionType":"custom"}],"platforms":["CloudVision Portal, virtual appliance or physical appliance"],"defaultStatus":"unaffected"}],"modified":"2026-10-06T20:01:14.740Z","provider":"cve","references":["https://www.arista.com/en/support/advisories-notices/security-advisory/24805-security-advisory-0189"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-101155","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-10-06T20:01:03.294569Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-06T20:01:14.740Z"}}],"cna":{"orgId":"c8b34d1a-69ae-45c3-88fe-f3b3d44f39b7","shortName":"Arista","dateUpdated":"2026-10-06T19:38:23.503Z"}}},"related_cves":[{"value":"CVE-2026-101155","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"}}],"next_after":9610,"next_before":9581}