CVE-2026-102158 is a medium severity vulnerability in Arista Networks CloudVision CUE where improper validation of certain API request parameters allows an authenticated network user to perform SQL injection attacks against the backend. This vulnerability impacts the availability of the backend system but does not affect confidentiality or integrity. It affects versions from 2022.2.0 through 2026.2.0 inclusive. No known exploits are reported in the wild, and no patch information is provided in the available data.
CVE-2026-102157 is an insecure direct object reference (IDOR) vulnerability in Arista Networks CloudVision CUE's file-serving interface. It may allow an authenticated network user, under specific conditions, to access another user's transient data. The vulnerability affects versions from 2021.2.0 through 2026.2.0. The CVSS score is 5.9, indicating medium severity. There are no known exploits in the wild and no patch information is provided.
CVE-2026-102155 is an XML External Entity (XXE) injection vulnerability in the WiFi-server Spectralight application component of Arista Networks CloudVision CUE. It allows any authenticated user to send crafted XML requests that can disclose arbitrary local files and cause partial denial of service. The vulnerability affects versions from 2021.2.0 through 2026.2.0 inclusive. It has a high severity with a CVSS score of 8.5. No patch or remediation details are provided, and no known exploits are reported in the wild.
Handlebars provides the power necessary to let users build semantic templates. From 3.0.0 until 4.7.10, Handlebars lookupProperty returns Function.prototype.constructor before applying the prototype-access deny list because constructor is an own property of Function.prototype. When an attacker can render a controlled template with allowProtoMethodsByDefault enabled and an accessible function in the template context, the template can traverse from that function through its prototype to Function.prototype and then obtain the Function constructor through the own-property bypass. This permits attacker-controlled JavaScript to execute with the server application's privileges. This issue is fixed in version 4.7.10.
CVE-2026-101155 is a critical path traversal vulnerability in Arista Networks CloudVision Portal. An authenticated remote attacker with specific permissions can exploit this flaw to read or write files outside the intended directory scope via crafted requests or file uploads in the Software Management Studio Software Repository. The vulnerability affects multiple versions from 2024.2.0 through 2026.2.0. It has a high CVSS score of 9.1, indicating severe impact on confidentiality, integrity, and availability.
CVE-2026-101154 is a path traversal vulnerability in Arista Networks CloudVision Portal that allows an authenticated remote attacker with specific permissions to read or write files outside the intended directory scope. This occurs through specially crafted requests or file uploads to the Network Provisioning Image Repository. The vulnerability affects multiple versions of CloudVision Portal from 2018.1.0 through 2026.2.0. It has a high severity rating with a CVSS score of 7.2, indicating significant confidentiality, integrity, and availability impacts. No known exploits are reported in the wild, and no patch links are provided in the available data. The product is not a cloud service, so remediation depends on vendor advisories. The vulnerability is identified as CWE-22, improper limitation of a pathname to a restricted directory.
CVE-2026-101153 is a path traversal vulnerability in Arista Networks CloudVision Portal (on-premises) and CloudVision Sensor. It allows an authenticated user with high privileges to access unintended data by exploiting improper limitation of pathnames. The vulnerability affects multiple versions from 1.0.0 up to 2026.2.0. The CVSS score is 8.0, indicating high severity with significant confidentiality, integrity, and availability impacts.
CVE-2026-101152 is an open redirect vulnerability in Arista Networks CloudVision Portal's Single Sign-On (SSO) login flow. It allows a remote, unauthenticated attacker to craft a URL that causes the identity provider to send authentication material to an attacker-controlled URL instead of the legitimate CloudVision service. This vulnerability affects multiple versions of CloudVision Portal from 2021.1.0 through 2026.2.0. The CVSS score is 8.0, indicating high severity due to the potential for complete compromise of authentication credentials. No explicit patch information is provided, and no known exploits are reported in the wild.
CVE-2026-101151 is an open redirect vulnerability in Arista Networks CloudVision Portal. It occurs due to insufficient validation of URLs in the login flow, allowing unauthenticated attackers to redirect users to arbitrary external sites after authentication. This vulnerability has a medium severity with a CVSS score of 4.3 and could be leveraged in phishing or social engineering attacks.
CVE-2026-101150 is a server-side request forgery (SSRF) vulnerability in Arista Networks CloudVision Portal. It results from insufficient validation of OIDC bearer token configuration, enabling users with specific high privileges to direct requests to arbitrary destinations. The vulnerability has a medium severity rating with a CVSS score of 4.1. No known exploits in the wild have been reported. There is no available information on patches or remediation.
CVE-2026-101149 is a server-side request forgery (SSRF) vulnerability in Arista Networks CloudVision Portal. It results from insufficient validation of the OpenID Connect (OIDC) single sign-on provider configuration. A user with specific high privileges could exploit this to send requests to arbitrary destinations. The vulnerability has a medium severity with a CVSS score of 4.1. It affects multiple versions of CloudVision Portal from 2020.3.0 through 2026.1.2 and version 2026.2.0. No known exploits are reported in the wild. No patch or remediation details are currently available.
CVE-2026-101158 is a stored cross-site scripting (XSS) vulnerability in the Fileserver upload API of Arista Networks CloudVision Portal. It affects multiple versions including 1.0.0 through 2026.1.2 and version 2026.2.0. An authenticated attacker with file upload privileges can exploit this flaw to execute malicious scripts in the context of other users' browsers. Successful exploitation could allow session hijacking and potentially grant full access to the victim's account and administrative permissions.
CVE-2026-106063 is a heap-based buffer overflow vulnerability in the GIMP DICOM export plug-in on Red Hat Enterprise Linux 10. The flaw occurs when exporting images with extremely large dimensions, causing an integer overflow during buffer allocation. This leads to an undersized buffer being written with more data than it can hold. The vulnerability has a CVSS score of 6.3, indicating medium severity, and impacts integrity and availability. No explicit affected versions or patch information are provided in the available data.
A vulnerability in SSSD on Red Hat Enterprise Linux 10 allows an authenticated user in a trusted domain to bypass Host-Based Access Control (HBAC) rules by exploiting how usernames are compared. The flaw occurs because SSSD strips domain qualifiers and compares only short usernames, enabling users with matching short usernames in trusted domains to gain unauthorized access to protected services or hosts.
CVE-2026-104047 is a medium severity vulnerability in the System Security Services Daemon (SSSD) on Red Hat Enterprise Linux 10. It involves improper sanitization of search inputs when SSSD is configured to use Microsoft Entra ID. This flaw allows a local user to craft lookup requests that manipulate directory query filters, potentially leading to unauthorized disclosure of directory information.
CVE-2026-103009 is a high-severity authorization bypass vulnerability in Elasticsearch affecting versions 8.13.0 through 8.19.22, 9.0.0 through 9.4.7, and 9.5.0 through 9.5.4. It involves the Remote Cluster Security 2.0 model where a cross-cluster search request can be crafted to bypass authorization checks by using mismatched shard identifiers. This allows an attacker with a cross-cluster API key authorized for one index to access documents, field mappings, and metadata of an unauthorized index, and in limited cases modify retention-lease state. The vulnerability has a CVSS score of 7.1 and no known exploits in the wild have been reported. Patch status is not confirmed from the provided data.
CVE-2026-103008 is an uncontrolled recursion vulnerability in Elastic Elasticsearch that can cause a denial of service. It arises from how Elasticsearch builds and serializes geometry values produced by scripted runtime fields without bounding recursion depth. An authenticated user with read access can submit a crafted request that triggers deep recursion, exhausting stack space and terminating the node. The node may not automatically recover, requiring manual intervention. The vulnerability affects multiple Elasticsearch versions from 8.12.0 through 9.5.4.
CVE-2026-103007 is an incorrect authorization vulnerability in Elastic Elasticsearch that allows privilege escalation. It arises from a delegated administrative privilege whose scope is not fully enforced during authorization checks. A user with this delegated privilege can exploit the flaw to update their own role and gain unauthorized access to restricted indices, including internal security data, potentially escalating to full administrative control of the cluster.
CVE-2026-103006 is an uncontrolled recursion vulnerability in Elasticsearch's search aggregation feature. An authenticated user with read access to an index can submit a deeply nested aggregation request that triggers unbounded recursion. This leads to resource exhaustion and causes the affected node to terminate and require manual recovery. The vulnerability affects multiple versions of Elasticsearch from 8.0.0 through 8.19.20, 9.0.0 through 9.4.5, and 9.5.0 through 9.5.1. The CVSS score is 6.5, indicating medium severity.
CVE-2026-103005 is a medium severity vulnerability in Elasticsearch involving excessive memory allocation. An authenticated user with connector management privileges can create connector resources with an excessively large description field, causing the cluster to allocate uncontrolled amounts of memory. This can exhaust heap memory and crash affected nodes, resulting in a denial of service condition.