Looker CVE-2026-15810

We need to produce a JSON with the fields as specified. The input data includes description, CVSS vector (CVSS 4.0), CWE, EPSS, SSVC, patch info, CPE, tags, references, etc. The output must be a JSON object.

Let's analyze the data:

• CVE-2026-15810: XSS in Google Cloud Looker (formerly Looker) versions prior to several patched versions. Allows arbitrary JavaScript execution leading to administrative account takeover via malicious URL. Looker-hosted and Self-hosted. Hosted already mitigated. Self-hosted must upgrade.
• CVSS 4.0 vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Amber
• AV:N network, AC:L low, AT:N none, PR:N none, UI:P passive (user interaction required), VC:H/VI:H/VA:H (high impact on vulnerable system integrity, confidentiality, availability), SC:L/SI:L/SA:L (low impact on subsequent system). Overall base score 8.7? Actually the vector doesn't include score, but we are given "CVSS Score: 8.7" and vector. So CVSS 4.0 base score 8.7. However, the output requires "assessed_cvss_vector" (CVSS 3.1) and "assessed_cvss40_vector". The instruction: "Your OWN independent CVSS 3.1 base-metric vector for THIS vulnerability, grounded in the description and exploitation conditions — NOT a copy of any score in the input." And also "assessed_cvss40_vector" "The SAME assessment expressed as a CVSS 4.0 base vector, consistent with your 3.1 choice." So we need to provide a 3.1 vector, and then a 4.0 vector based on our assessment. But we also have the input's CVSS 4.0 vector. We can use that to derive our own. It's an XSS with high impact: admin account takeover. User interaction required (UI:P in CVSS 4.0 means passive user interaction, so in 3.1, UI:R). No privileges required (PR:N). Network attack vector. So for 3.1: AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H? Actually XSS typically scope changed? In CVSS 3.1, XSS usually has scope changed