CVE-2026-84427

CVE-2026-84427 affects zhayujie CowAgent versions up to 2.1.7 . The vulnerability resides in the Bash Tool component, specifically in the file agent/tools/bash/bash.py. The root-cause function is not precisely identified in the CVE description, though a linked GitHub report title references an ou...

CVE-2026-84425

zhayujie CowAgent (versions up to 2.1.3) is vulnerable to a remote denial of service in the BrowserTool function within agent/tools/browser/browser_tool.py (the Browser Tool component). An attacker with low privileges can trigger the DoS remotely with low complexity and no user interaction. A pro...

CVE-2026-84921

This CVE has been reserved but no technical details (affected product, root cause, or impact) are publicly available yet. Monitor for updates when the candidate is officially publicized.

CVE-2026-84916

The description for CVE-2026-84916 is currently a reserved placeholder with no public technical details provided. No connected documents offer additional information. Monitor for updates when the candidate is publicized.

CVE-2026-73436

CVE-2026-73436 affects Arista EOS platforms running OSPFv2 with segment routing configured. A specially crafted OSPFv2 packet from an adjacent OSPF neighbor can cause the OSPF process to restart unexpectedly , leading to availability disruption (CVSS 3.1: 6.5 , AV:A/AC:L/PR:N/S:U/C:N/I:N/A:H). Ro...

CVE-2026-73438

CVE-2026-73438 affects Arista EOS where an unauthenticated attacker on the same OSPFv3 broadcast domain can send crafted packets that trigger a Reachable Assertion (CWE-617), causing the Ospf3 agent to crash. This results in the loss of all OSPFv3 adjacencies and potential routing disruption acro...

CVE-2026-73455

CVE-2026-73455 is a High severity (CVSS 3.1: 7.5) denial-of-service vulnerability in the OSPFv3 agent on Arista EOS switches. Root cause is CWE-130 (Improper Handling of Length Parameter Inconsistency): a specially crafted packet sent remotely over the network can cause the OSPFv3 process to term...

CVE-2026-84920

CVE-2026-84920 has been reserved by an organization or individual, with no technical details publicly available yet. Monitor for updates when the candidate is publicized.

CVE-2026-16648

CVE-2026-16648 has been reserved but no technical details are yet publicly available in the provided documents. The affected product, root cause, and impact remain unknown. Action: monitor for updates when the candidate is publicized.

CVE-2026-84914

CVE-2026-84914 is currently a reserved candidate with no public technical details. The description indicates it will be filled in when the security issue is officially announced. Monitor for updates as details become available.

CVE-2026-84924

CVE-2026-84924 has been reserved by an organization or individual and no technical details (affected product, root cause, or impact) are publicly available yet. Monitor for updates as the candidate is expected to be publicized with full details.

CVE-2026-73461

Arista EOS is vulnerable to incorrect privilege assignment (CWE-266) in its OpenConfig gRPC request authorization . When AAA-based gRPC request authorization is enabled with mutual TLS, authenticated users' gRPC requests may be authorized at privilege level 0 instead of their assigned level, caus...

CVE-2026-84918

CVE-2026-84918 has been reserved but no technical details are yet publicly available. The vulnerability type, affected products, and impact remain unknown. Monitor for updates once the assigning organization publicizes the entry.

CVE-2026-77190

Arista EOS is affected by a denial-of-service vulnerability in the Pimsm agent (CWE-20: Improper Input Validation). An unauthenticated network-adjacent attacker can send malformed PIM messages to a switch with PIM Sparse Mode and MLAG configured, causing the agent to terminate. Repeated attacks r...

CVE-2026-73442

CVE-2026-73442 affects Arista EOS with VRRP enabled. Peer device VRRP authentication credentials are logged in cleartext in agent trace logs, allowing an authenticated user with sufficient privileges (or a system receiving forwarded log output) to obtain those credentials without direct access to...

CVE-2026-86106

Arista VeloCloud Edge is affected by a missing authentication vulnerability (CWE-306) on the private HA (High Availability) interconnect. An unauthenticated actor with Layer 2 access to the HA interconnect can trigger sensitive HA peer functions, potentially resulting in elevated command executio...

CVE-2026-81163

CVE-2026-81163 is a reserved candidate with no public technical details yet. The affected product, vulnerability type, and impact remain undisclosed. Action: monitor for updates once the reserving organization publicizes the entry.

CVE-2026-84910

CVE-2026-84910 is currently in reserved status with no public technical details available. The vulnerability type, affected products, and impact are not yet disclosed. Monitor for future updates when the assignee publishes the full description.

CVE-2024-26225

CVE-2024-26225 is currently reserved with no public technical details available in the provided documents. Monitor for future updates when the candidate is officially publicized with full disclosure.

CVE-2026-84915

This CVE is currently reserved as a placeholder with no public technical details available regarding the affected product, root cause, or impact. Monitor for updates when the candidate is formally publicized.

CVE-2026-84919

This CVE entry is currently reserved and no technical details are publicly available in the provided documents. Affected products, root cause, and impact remain unspecified. Monitor for updates once the candidate is publicized.

CVE-2025-23029

CVE-2025-23029 is currently in reserved status with no public technical details about the affected product, root cause, or impact. Monitor for updates as the reserving organization publicizes the vulnerability.

CVE-2024-35585

Oxford Nanopore MinKNOW , a sequencing software used in nanopore-based genomic analysis, is vulnerable to weak authentication in versions before 24.06 . The application relies on a client's source IP address as its authentication mechanism, meaning an attacker who can spoof or originate traffic f...

CVE-2026-73456

CVE-2026-73456 is a critical code injection vulnerability (CWE-94, CVSSv3.1 10.0 ) in the gNPSI (gRPC Network Packet Sampling Interface) component of Arista EOS platforms. An unauthenticated gNPSI client can craft a malicious request to achieve arbitrary code execution , granting full administrat...

CVE-2025-46418

Westermo WeOS 5 (version 5.24 and later), an operating system deployed in industrial settings, is vulnerable to OS command injection through unsafe handling of media definitions . An attacker with administrative privileges can execute commands beyond their typical access rights, potentially compr...

CVE-2026-73462

CVE-2026-73462 affects Arista EOS running IGMP snooping (enabled by default on all VLANs). A network-adjacent, unauthenticated attacker can send malformed packets to trigger an out-of-bounds read (CWE-125) in the IGMP snooping agent, causing it to terminate and flood multicast traffic to all port...

CVE-2026-73454

CVE-2026-73454 is a command injection (CWE-77) vulnerability in Arista EOS affecting the gNSI Credentialz service (part of OpenConfig). A specially crafted request can cause unintended modifications to a target account's properties, potentially granting elevated privileges or access beyond what a...

CVE-2026-73463

CVE-2026-73463 is a race condition in the gNSI Authz service on Arista EOS that occurs when multiple gNSI transports are configured. A policy rotation may fail silently, allowing an authenticated user whose access was revoked by the new policy to retain unauthorized access to gRPC interfaces . Th...

CVE-2026-2380

CVE-2026-2380 affects Arista EOS devices running OpenConfig-related services (gNMI , gNSI , RESTCONF , or NETCONF ). Sensitive requests and responses—such as CLI commands containing passwords or OpenConfig YANG leafs with secret keys—may be unintentionally logged by the OpenConfig/Octa agent to l...

CVE-2026-19640

CVE-2026-19640 affects Arista EOS devices with the gNMI (gRPC Network Management Interface) / OpenConfig component configured with authorized requests. The root cause is incorrect authorization (CWE-863) : an authenticated user may receive incorrect authorization results, potentially allowing acc...

CVE-2026-73468

Arista EOS running PIM Sparse Mode is vulnerable to a specially crafted packet that causes premature expiry of multicast forwarding state on affected interfaces, leading to temporary loss of multicast traffic forwarding . The root cause is classified as CWE-670 (Always-Incorrect Control Flow Impl...

CVE-2026-73439

CVE-2026-73439 is a High severity (CVSS 7.5) vulnerability in Arista EOS affecting the OpenConfig gNMI component. When gNSI Pathz is configured with a policy containing both a group rule and a user rule for the same path, gNMI may fail to correctly enforce those rules, allowing an authenticated u...

CVE-2026-73440

CVE-2026-73440 is a medium-severity vulnerability (CVSS 3.1: 4.2) in Arista EOS where SNMPv3 user credentials may be exposed as one-way hashed, localized key values within the device's running and sanitized configurations. An authenticated user who accesses this information could perform unauthor...

CVE-2026-73464

Arista EOS running with gNMI (gRPC Network Management Interface) enabled is vulnerable to arbitrary code execution with root privileges (CWE-94 Code Injection) by a specially crafted request from an authenticated gNMI client. The CVSSv3.1 score is 8.8 (High) . The issue was discovered internally ...

CVE-2026-73435

CVE-2026-73435 affects Arista EOS where OSPFv2 with cryptographic authentication (MD5 or SHA) is configured on a broadcast interface with at least two neighbors. An unauthenticated attacker on the same broadcast segment can send a specially crafted OSPFv2 packet, causing adjacency flapping and pa...

CVE-2026-84923

CVE-2026-84923 has been reserved but no technical details are yet publicly available in the provided documents. Affected products, root cause, and impact remain unknown. Monitor for updates as the reserving organization publishes details.

CVE-2026-84913

This CVE is currently reserved with no public technical details available in the provided documents. The vulnerability description, affected products, and impact remain unknown. Monitor for updates as details are expected once the vendor publicizes the issue.

CVE-2026-84911

CVE-2026-84911 has been reserved by an organization or individual and no technical details are yet publicly available. Monitor for updates when the candidate is publicized.

CVE-2026-73447

Arista EOS network devices are vulnerable to OS command injection (CWE-78) in the gRPC Network Security Interface (gNSI) Certz service (and the Bootz service). An authenticated user can escalate privileges to execute arbitrary OS commands via a crafted Certz Rotate request. The issue was discover...

CVE-2026-73445

CVE-2026-73445 affects Arista EOS (4.31.x–4.36.x trains). The root cause is improper input validation (CWE-20) in the gNSI Authz Rotate RPC : when a Rotate request contains multiple uploadRequest entries, a previously uploaded but not finalized Authz policy may become active instead of the intend...

CVE-2026-77522

CVE-2026-77522 is currently a reserved candidate with no public technical details yet. Affected product, root cause, and impact remain unknown. Monitor for updates when the reserving organization publicizes the vulnerability.

CVE-2026-73443

CVE-2026-73443 affects Arista EOS running VRRPv2 with IP-AH authentication enabled. An unauthenticated attacker on the same Layer 2 segment can capture and replay a legitimate VRRP advertisement indefinitely (CWE-294), advertising stale state that prevents a backup router from assuming the virtua...

CVE-2026-73469

CVE-2026-73469 affects Arista EOS 4.35.4M and earlier releases in the 4.35.x train on 7050X4 and 7358X4 series platforms. When loose mode uRPF (Unicast Reverse Path Forwarding) is configured on an interface, certain traffic that should be dropped by the verification check may instead be processed...

CVE-2026-84912

CVE-2026-84912 has been reserved but no public technical details are currently available. Monitor for updates when the vendor announces the vulnerability and releases associated patch information.

CVE-2026-73453

CVE-2026-73453 is a critical code injection vulnerability (CWE-94) in Arista EOS P4Runtime service, scored CVSS 3.1: 10.0 . An unauthenticated P4Runtime client can achieve arbitrary code execution and complete administrative control over an affected switch by crafting a malicious packet during se...

CVE-2026-73457

CVE-2026-73457 affects Arista EOS platforms with the gRPC Network Packet Sampling Interface (gNPSI) enabled—a feature that is disabled by default . When the gNPSI trace facility EosRpcAuth is explicitly enabled, client credentials may be logged in clear text in local or remote accounting logs, ex...

CVE-2026-86107

CVE-2026-86107 is an out-of-bounds write (CWE-787) in the VCMP tunnel protocol on Arista VeloCloud Edge and VeloCloud Gateway (formerly VeloCloud by Broadcom). The flaw occurs when processing tunneled IP fragments between authenticated overlay neighbors. A successful exploit causes the affected p...

CVE-2026-84917

CVE-2026-84917 is currently in a reserved state. No technical details about affected products, root cause, or impact are publicly available in the provided documents. Monitor for updates once the candidate is publicized.

CVE-2026-84356

CVE-2026-84356 is a UI misrepresentation flaw in the FullScreen component of Google Chrome prior to version 152.0.7977.75 . A remote attacker could deliver a crafted HTML page that spoofs the address bar , allowing the victim to be tricked into believing they are on a different site. Chromium rat...

CVE-2026-84350

CVE-2026-84350 is a use-after-free in the TabStrip component of Google Chrome prior to 152.0.7977.75 . A remote attacker leveraging social engineering can trigger the flaw via UI interaction to execute arbitrary code outside the browser sandbox. Chromium rates the severity as Low , while the assi...