Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
8 results
Jun 5, 2026An administrative cross-site scripting (XSS) vulnerability exists in the web user interface dashboard layout of Arista Edge Threat Management - Arista Next GeneCVE-2026-25624 · Other software · Arista Networks · reported by psirt@arista.comMedium 5.8
An administrative cross-site scripting (XSS) vulnerability exists in the web user interface dashboard layout of Arista Edge Threat Management - Arista Next Generation Firewall (NGFW). Unvalidated user-supplied variables are echoed back to administrative profiles, facilitating vector payload processing behavior controls.
- Product
- Arista Edge Threat Management - Arista Next Generation Firewall (NGFW)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 5, 2026An input validation command execution vulnerability exists in the browser management pipeline of Arista Edge Threat Management - Arista Next Generation FirewallCVE-2026-25623 · Other software · Arista Networks · reported by psirt@arista.comHigh 7
An input validation command execution vulnerability exists in the browser management pipeline of Arista Edge Threat Management - Arista Next Generation Firewall (NGFW). Authenticated administrators can leverage this exposure to obtain underlying terminal script code processing execution permissions.
- Product
- Arista Edge Threat Management - Arista Next Generation Firewall (NGFW)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 5, 2026A Captive Portal Custom Handler command injection vulnerability exists in Arista Edge Threat Management - Arista Next Generation Firewall (NGFW).CVE-2026-25622 · Other software · Arista Networks · reported by psirt@arista.comHigh 7
A Captive Portal Custom Handler command injection vulnerability exists in Arista Edge Threat Management - Arista Next Generation Firewall (NGFW). On affected platforms, an administrative account logged into the user interface can exploit this input handling behavior to execute arbitrary platform shell commands.
- Product
- Arista Edge Threat Management - Arista Next Generation Firewall (NGFW)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 5, 2026A Reports application infrastructure vulnerability exists in Arista Edge Threat Management - Arista Next Generation Firewall (NGFW) due to insecure input validaCVE-2026-25621 · Other software · Arista Networks · reported by psirt@arista.comHigh 7
A Reports application infrastructure vulnerability exists in Arista Edge Threat Management - Arista Next Generation Firewall (NGFW) due to insecure input validation. This issue uniquely affects version 17.4.0; earlier software releases are not exposed.
- Product
- Arista Edge Threat Management - Arista Next Generation Firewall (NGFW)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 5, 2026An encrypted password command injection vulnerability exists in the Captive Portal application framework of Arista Edge Threat Management - Arista Next GeneratiCVE-2026-25620 · Other software · Arista Networks · reported by psirt@arista.comHigh 7
An encrypted password command injection vulnerability exists in the Captive Portal application framework of Arista Edge Threat Management - Arista Next Generation Firewall (NGFW). This issue uniquely affects version 17.4.0; earlier software releases are not exposed.
- Product
- Arista Edge Threat Management - Arista Next Generation Firewall (NGFW)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 23, 2025Captive Portal can expose sensitive informationCVE-2025-6980 · Other software · Arista Networks · reported by psirt@arista.comHigh 7.5
Captive Portal can expose sensitive information
- Product
- Arista Edge Threat Management - Arista Next Generation Firewall
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 23, 2025Captive Portal can allow authentication bypassCVE-2025-6979 · Other software · Arista Networks · reported by psirt@arista.comHigh 8.8
Captive Portal can allow authentication bypass
- Product
- Arista Edge Threat Management - Arista Next Generation Firewall
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 23, 2025Diagnostics command injection vulnerabilityCVE-2025-6978 · Other software · Arista Networks · reported by psirt@arista.comHigh 7.2
Diagnostics command injection vulnerability
- Product
- Arista Edge Threat Management - Arista Next Generation Firewall
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.