Looker
Monthly
We need to produce a JSON with the fields as specified. The input data includes description, CVSS vector (CVSS 4.0), CWE, EPSS, SSVC, patch info, CPE, tags, references, etc. The output must be a JSON object. Let's analyze the data: - CVE-2026-15810: XSS in Google Cloud Looker (formerly Looker) versions prior to several patched versions. Allows arbitrary JavaScript execution leading to administrative account takeover via malicious URL. Looker-hosted and Self-hosted. Hosted already mitigated. Self-hosted must upgrade. - CVSS 4.0 vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Amber - AV:N network, AC:L low, AT:N none, PR:N none, UI:P passive (user interaction required), VC:H/VI:H/VA:H (high impact on vulnerable system integrity, confidentiality, availability), SC:L/SI:L/SA:L (low impact on subsequent system). Overall base score 8.7? Actually the vector doesn't include score, but we are given "CVSS Score: 8.7" and vector. So CVSS 4.0 base score 8.7. However, the output requires "assessed_cvss_vector" (CVSS 3.1) and "assessed_cvss40_vector". The instruction: "Your OWN independent CVSS 3.1 base-metric vector for THIS vulnerability, grounded in the description and exploitation conditions — NOT a copy of any score in the input." And also "assessed_cvss40_vector" "The SAME assessment expressed as a CVSS 4.0 base vector, consistent with your 3.1 choice." So we need to provide a 3.1 vector, and then a 4.0 vector based on our assessment. But we also have the input's CVSS 4.0 vector. We can use that to derive our own. It's an XSS with high impact: admin account takeover. User interaction required (UI:P in CVSS 4.0 means passive user interaction, so in 3.1, UI:R). No privileges required (PR:N). Network attack vector. So for 3.1: AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H? Actually XSS typically scope changed? In CVSS 3.1, XSS usually has scope changed
An Insecure Direct Object Reference in Google Cloud's Looker allowed metadata exposure across authenticated Looker users sharing the same LookML model. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
We need to produce a JSON with the fields as specified. The input data includes description, CVSS vector (CVSS 4.0), CWE, EPSS, SSVC, patch info, CPE, tags, references, etc. The output must be a JSON object. Let's analyze the data: - CVE-2026-15810: XSS in Google Cloud Looker (formerly Looker) versions prior to several patched versions. Allows arbitrary JavaScript execution leading to administrative account takeover via malicious URL. Looker-hosted and Self-hosted. Hosted already mitigated. Self-hosted must upgrade. - CVSS 4.0 vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Amber - AV:N network, AC:L low, AT:N none, PR:N none, UI:P passive (user interaction required), VC:H/VI:H/VA:H (high impact on vulnerable system integrity, confidentiality, availability), SC:L/SI:L/SA:L (low impact on subsequent system). Overall base score 8.7? Actually the vector doesn't include score, but we are given "CVSS Score: 8.7" and vector. So CVSS 4.0 base score 8.7. However, the output requires "assessed_cvss_vector" (CVSS 3.1) and "assessed_cvss40_vector". The instruction: "Your OWN independent CVSS 3.1 base-metric vector for THIS vulnerability, grounded in the description and exploitation conditions — NOT a copy of any score in the input." And also "assessed_cvss40_vector" "The SAME assessment expressed as a CVSS 4.0 base vector, consistent with your 3.1 choice." So we need to provide a 3.1 vector, and then a 4.0 vector based on our assessment. But we also have the input's CVSS 4.0 vector. We can use that to derive our own. It's an XSS with high impact: admin account takeover. User interaction required (UI:P in CVSS 4.0 means passive user interaction, so in 3.1, UI:R). No privileges required (PR:N). Network attack vector. So for 3.1: AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H? Actually XSS typically scope changed? In CVSS 3.1, XSS usually has scope changed
An Insecure Direct Object Reference in Google Cloud's Looker allowed metadata exposure across authenticated Looker users sharing the same LookML model. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.