Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
18 results
Jun 5, 2026An administrative cross-site scripting (XSS) vulnerability exists in the web user interface dashboard layout of Arista Edge Threat Management - Arista Next GeneCVE-2026-25624 · Other software · Arista Networks · reported by psirt@arista.comMedium 5.8
An administrative cross-site scripting (XSS) vulnerability exists in the web user interface dashboard layout of Arista Edge Threat Management - Arista Next Generation Firewall (NGFW). Unvalidated user-supplied variables are echoed back to administrative profiles, facilitating vector payload processing behavior controls.
- Product
- Arista Edge Threat Management - Arista Next Generation Firewall (NGFW)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 5, 2026An input validation command execution vulnerability exists in the browser management pipeline of Arista Edge Threat Management - Arista Next Generation FirewallCVE-2026-25623 · Other software · Arista Networks · reported by psirt@arista.comHigh 7
An input validation command execution vulnerability exists in the browser management pipeline of Arista Edge Threat Management - Arista Next Generation Firewall (NGFW). Authenticated administrators can leverage this exposure to obtain underlying terminal script code processing execution permissions.
- Product
- Arista Edge Threat Management - Arista Next Generation Firewall (NGFW)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 5, 2026A Captive Portal Custom Handler command injection vulnerability exists in Arista Edge Threat Management - Arista Next Generation Firewall (NGFW).CVE-2026-25622 · Other software · Arista Networks · reported by psirt@arista.comHigh 7
A Captive Portal Custom Handler command injection vulnerability exists in Arista Edge Threat Management - Arista Next Generation Firewall (NGFW). On affected platforms, an administrative account logged into the user interface can exploit this input handling behavior to execute arbitrary platform shell commands.
- Product
- Arista Edge Threat Management - Arista Next Generation Firewall (NGFW)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 5, 2026A Reports application infrastructure vulnerability exists in Arista Edge Threat Management - Arista Next Generation Firewall (NGFW) due to insecure input validaCVE-2026-25621 · Other software · Arista Networks · reported by psirt@arista.comHigh 7
A Reports application infrastructure vulnerability exists in Arista Edge Threat Management - Arista Next Generation Firewall (NGFW) due to insecure input validation. This issue uniquely affects version 17.4.0; earlier software releases are not exposed.
- Product
- Arista Edge Threat Management - Arista Next Generation Firewall (NGFW)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 5, 2026An encrypted password command injection vulnerability exists in the Captive Portal application framework of Arista Edge Threat Management - Arista Next GeneratiCVE-2026-25620 · Other software · Arista Networks · reported by psirt@arista.comHigh 7
An encrypted password command injection vulnerability exists in the Captive Portal application framework of Arista Edge Threat Management - Arista Next Generation Firewall (NGFW). This issue uniquely affects version 17.4.0; earlier software releases are not exposed.
- Product
- Arista Edge Threat Management - Arista Next Generation Firewall (NGFW)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 23, 2025Captive Portal can expose sensitive informationCVE-2025-6980 · Other software · Arista Networks · reported by psirt@arista.comHigh 7.5
Captive Portal can expose sensitive information
- Product
- Arista Edge Threat Management - Arista Next Generation Firewall
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 23, 2025Captive Portal can allow authentication bypassCVE-2025-6979 · Other software · Arista Networks · reported by psirt@arista.comHigh 8.8
Captive Portal can allow authentication bypass
- Product
- Arista Edge Threat Management - Arista Next Generation Firewall
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 23, 2025Diagnostics command injection vulnerabilityCVE-2025-6978 · Other software · Arista Networks · reported by psirt@arista.comHigh 7.2
Diagnostics command injection vulnerability
- Product
- Arista Edge Threat Management - Arista Next Generation Firewall
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 10, 2025Specially constructed queries cause cross platform scripting leaking administrator tokensCVE-2024-9188 · Other software · Arista Networks · reported by psirt@arista.comHigh 8.8
Specially constructed queries cause cross platform scripting leaking administrator tokens
- Product
- Arista Edge Threat Management
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 10, 2025Multiple SQL Injection vulnerabilities exist in the reporting application.CVE-2024-9134 · Other software · Arista Networks · reported by psirt@arista.comHigh 8.3
Multiple SQL Injection vulnerabilities exist in the reporting application. A user with advanced report application access rights can exploit the SQL injection, allowing them to execute commands on the underlying operating system with elevated privileges.
- Product
- Arista Edge Threat Management
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 10, 2025A user with administrator privileges is able to retrieve authentication tokensCVE-2024-9133 · Other software · Arista Networks · reported by psirt@arista.comMedium 6.6
A user with administrator privileges is able to retrieve authentication tokens
- Product
- Arista Edge Threat Management
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 10, 2025The administrator is able to configure an insecure captive portal scriptCVE-2024-9132 · Other software · Arista Networks · reported by psirt@arista.comHigh 8.1
The administrator is able to configure an insecure captive portal script
- Product
- Arista Edge Threat Management
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 10, 2025A user with administrator privileges can perform command injectionCVE-2024-9131 · Other software · Arista Networks · reported by psirt@arista.comHigh 7.2
A user with administrator privileges can perform command injection
- Product
- Arista Edge Threat Management
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 10, 2025A user with advanced report application access rights can perform actions for which they are not authorizedCVE-2024-47520 · Other software · Arista Networks · reported by psirt@arista.comHigh 7.6
A user with advanced report application access rights can perform actions for which they are not authorized
- Product
- Arista Edge Threat Management
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 10, 2025Backup uploads to ETM subject to man-in-the-middle interceptionCVE-2024-47519 · Other software · Arista Networks · reported by psirt@arista.comHigh 8.3
Backup uploads to ETM subject to man-in-the-middle interception
- Product
- Arista Edge Threat Management
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 10, 2025Specially constructed queries targeting ETM could discover active remote access sessionsCVE-2024-47518 · Other software · Arista Networks · reported by psirt@arista.comMedium 6.4
Specially constructed queries targeting ETM could discover active remote access sessions
- Product
- Arista Edge Threat Management
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 10, 2025Expired and unusable administrator authentication tokens can be revealed by units that have timed out from ETM accessCVE-2024-47517 · Other software · Arista Networks · reported by psirt@arista.comMedium 6.8
Expired and unusable administrator authentication tokens can be revealed by units that have timed out from ETM access
- Product
- Arista Edge Threat Management
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 4, 2024Multiple SQL Injection vulnerabilities exist in the reporting application of the Arista Edge Threat Management - Arista NG Firewall (NGFW).CVE-2024-27889 · Other software · Arista Networks · reported by psirt@arista.comHigh 8.8
Multiple SQL Injection vulnerabilities exist in the reporting application of the Arista Edge Threat Management - Arista NG Firewall (NGFW). A user with advanced report application access rights can exploit the SQL injection, allowing them to execute commands on the underlying operating system with elevated privileges.
- Product
- Arista Edge Threat Management - Arista NG Firewall (NGFW)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.