Arista

Latest CVEs · RSS

• CVE-2026-102165 2026-10-06 · CVSS 7.5
  On affected Arista Wi-Fi access points, an unauthenticated attacker with network access to the capture service can send a crafted packet to cause the service to
• CVE-2026-102167 2026-10-06 · CVSS 7.5
  On affected Arista Wi-Fi access points, a memory corruption vulnerability exists in access point's wired uplink network endpoints. An unauthenticated attacker c
• CVE-2026-102164 2026-10-06 · CVSS 3.1
  On affected Arista access points configured with VXLAN tunnelling and L2-proxy (a specific configuration unique to the VESPA use-case), a wireless client associ
• CVE-2026-102163 2026-10-06 · CVSS 8.8
  On affected Arista access points with Wireless Intrusion Prevention System (WIPS) active, an unauthenticated attacker within radio frequency (RF) proximity can
• CVE-2026-102169 2026-10-06 · CVSS 6.5
  On affected Arista Wi-Fi access points with Captive Portal enabled, an unauthenticated wireless client connected to a captive-portal-enabled SSID can crash the
• CVE-2026-102168 2026-10-06 · CVSS 6.5
  On affected Arista Wi-Fi access points with Captive Portal enabled, an unauthenticated wireless client connected to a Captive-Portal-enabled SSID can crash the
• CVE-2026-102162 2026-10-06 · CVSS 8.8
  On affected Arista Wi-Fi access points with captive portal, or application firewall enabled on at least one SSID, a vulnerability in the wireless gateway servic
• CVE-2026-101157 2026-10-06 · CVSS 8.7
  A stored cross-site scripting (XSS) vulnerability may allow an unauthenticated attacker with adjacent-network access to inject malicious content that executes w
• CVE-2026-101156 2026-10-06 · CVSS 8.4
  A stored cross-site scripting (XSS) vulnerability may allow an authenticated, high-privilege administrator to store malicious content in a configuration. The co
• CVE-2026-102156 2026-10-06 · CVSS 6.8
  Improper neutralization of Lightweight Directory Access Protocol (LDAP) authentication input may allow an unauthenticated network attacker, under high-complexit
• CVE-2026-102161 2026-10-06 · CVSS 8.8
  An unauthenticated attacker located on an adjacent private network (or any attacker routed through a reverse proxy/load balancer that forwards client headers) c
• CVE-2026-102160 2026-10-06 · CVSS 7.2
  An operating system (OS) command injection vulnerability in CloudVision CUE backup management may allow an authenticated Super User to submit a crafted backup r
• CVE-2026-102159 2026-10-06 · CVSS 9.8
  An access-control flaw in the CV-CUE backend may allow an unauthenticated network attacker to access functionality intended only for internal services. Successf
• CVE-2026-102158 2026-10-06 · CVSS 6.5
  Improper validation of selected CloudVision CUE application programming interface (API) request parameters may allow an authenticated network user to perform SQ
• CVE-2026-102157 2026-10-06 · CVSS 5.9
  An insecure direct object reference (IDOR) vulnerability in a CloudVision CUE file-serving interface may allow an authenticated network user, under specific att
• CVE-2026-102155 2026-10-06 · CVSS 8.5
  An XML External Entity (XXE) injection vulnerability in the WiFi-server Spectralight application allows any authenticated user to send malicious requests, leadi
• CVE-2026-101155 2026-10-06 · CVSS 9.1
  An authenticated remote attacker with specific permissions can read or write files on the platform filesystem beyond the intended scope through specially crafte
• CVE-2026-101154 2026-10-06 · CVSS 7.2
  An authenticated remote attacker with specific permissions can read or write files on the platform filesystem beyond the intended scope through specially crafte
• CVE-2026-101153 2026-10-06 · CVSS 8.0
  On affected versions of CloudVision Portal (on-premises) or CloudVision Sensor, a path traversal vulnerability exists. An authenticated user with sufficient hig
• CVE-2026-101152 2026-10-06 · CVSS 8.0
  Insufficient validation in the Single Sign-On (SSO) login flow could allow a remote, unauthenticated attacker to craft a URL that, when clicked by a user, cause
• CVE-2026-101151 2026-10-06 · CVSS 4.3
  Insufficient validation of request in login flow could allow a remote, unauthenticated attacker to craft a URL that, when clicked by a user, redirects the user'
• CVE-2026-101150 2026-10-06 · CVSS 4.1
  Insufficient validation of OIDC bearer token configuration could allow a user with specific high privileges to direct requests to arbitrary destinations.
• CVE-2026-101149 2026-10-06 · CVSS 4.1
  Insufficient validation of OIDC SSO provider configuration could allow a user with specific high privileges to direct requests to arbitrary destinations.
• CVE-2026-101158 2026-10-06 · CVSS 8.4
  A missing input validation vulnerability in the Fileserver upload API allows an authenticated attacker with file upload privileges to execute stored cross-site
• CVE-2026-93952 2026-09-22 · CVSS 10.0
  VeloCloud Orchestrator (VCO) on-prem has a security issue where this issue may allow a remote attacker to access privileged internal functionality and impact th