Threat Feed
Daily intelligence on vulnerabilities, threat actors and geopolitical context — distilled from primary sources.
Filtered Reports
6 / 16 results
criticalbug_reportVulnerabilityCISA: Collabora Online and Arista VeloCloud flaws exploited in wild
Collabora Online Built-in CODE Server (richdocumentscode) when used with NextCloud platform (fixed in version 26.4.303, September 2026); Arista VeloCloud Orchestrator on-premise versions (fixed in 5.2.3.18, 6.1.3.10, and 6.4.2.12, October 2026).
criticalbug_reportVulnerabilityArista VeloCloud Orchestrator SQL injection zero-day under active exploit
Arista VeloCloud Orchestrator (VCO) versions before 5.2.3.18, 6.1.3.10, and 6.4.2.12. On-premises deployments affected; Hosted and Dedicated orchestrators already patched. VeloCloud Gateway and Edge devices not affected.
criticalbug_reportVulnerabilityCVSS 10.0 VeloCloud Orchestrator flaw actively exploited in wild
Arista VeloCloud Orchestrator (VCO) on-premises deployments using certificate-based Edge authentication. Affected versions: 5.2.3.15 and earlier, 6.1.3.7 and earlier, 6.4.2.7 and earlier, 7.0.0.2 and earlier.
criticalbug_reportVulnerabilityArista VeloCloud Orchestrator command injection under active exploitation
Arista VeloCloud Orchestrator (VCO) on-premises versions: 5.2.x prior to 5.2.3.14, 6.1.x prior to 6.1.3.4, 6.4.x prior to 6.4.2.4, and 7.0.x prior to 7.0.0.1. Hosted and dedicated VCO versions already patched.
criticalbug_reportVulnerabilityArista VeloCloud Orchestrator zero-day exploited in the wild (CVE-2026-16812)
Arista VeloCloud Orchestrator on-premises deployments: versions 5.2.x before 5.2.3.14, 6.1.x before 6.1.3.4, 6.4.x before 6.4.2.4, and 7.0.x before 7.0.0.1. Hosted and Dedicated VCO deployments already patched.
highbug_reportVulnerabilityCisco Catalyst SD-WAN Manager actively exploited (CVE-2026-20245)
Cisco Catalyst SD-WAN Manager. Specific affected versions not disclosed. Vulnerability involves improper encoding or escaping of output (CVSS 7.8). Also affects products from Google and Arista (details not provided).