CVE-2026-105xxx records
Browse official CVE Program records with vulnerability descriptions, affected products, CVSS scores and source references. Browse by the year and numeric range in each CVE ID; publication and update dates appear on each record.
622 records · Page 7 of 7
EnergizeLab station-middleware (NestJS) Docker images 1.6.5 through 1.8.2 do not check user roles on administrative APIs. Any authenticated low-privilege user can retrieve AI provider keys and change configuration and object-store contents.
Updated- CVE-2026-105038: EnergizeLab Eilik Unauthenticated AI Model Administration and Runtime Model Switching 9.8 Critical
The EnergizeLab Eilik and EilikO FastAPI AI inference and profiling services expose AI model administration functions without authentication. An unauthenticated remote attacker can change AI model configuration and switch the model in use at runtime.
Updated - CVE-2026-105037: EnergizeLab Station Middleware Authenticated Path Traversal Arbitrary File Read 9.9 Critical
EnergizeLab station-middleware (NestJS) Docker images 1.6.5 through 1.8.2 allow any registered, low-privilege account to read arbitrary files from the server by supplying an attacker-controlled file path. This exposes middleware files and server secrets.
Updated - CVE-2026-105036: EnergizeLab Firmware Updates Downloaded over HTTP Without Integrity Checks 7.5 High
EnergizeLab AI Station firmware, EilikO Linux robot firmware v2.1_20260617182218_release, and the EnergizeLab Windows desktop app 3.1.2 download firmware updates over plain HTTP and do not verify their integrity or authenticity. An attacker able to intercept or modify the traffic can substitute a malicious update.
Updated The EnergizeLab FirmwareUpdater (AArch64 ELF, distributed in the CDN bin.zip) uses a single hard-coded AES key shared by all installations. An attacker who recovers the key from the updater can decrypt and forge firmware packages for any device that trusts it.
UpdatedThe EnergizeLab Eilik NestJS auth service issues device tokens for arbitrary robot serial numbers without authentication. An unauthenticated remote attacker can obtain a valid device token for any serial number and act as that device against the cloud services.
UpdatedThe EnergizeLab AI Station (RK3562) firmware image ships with default root credentials and SSH enabled. An attacker with network access to the device can log in as root and take full control of it.
Updated- CVE-2026-105032: EnergizeLab Eilik AI Skill Upload Unauthenticated Path Traversal Arbitrary File Write 9.1 Critical
The EnergizeLab Eilik and EilikO AI skill upload endpoint, served by the FastAPI AI inference and profiling services, does not require authentication and does not constrain uploaded file paths. An unauthenticated remote attacker can use path traversal to write arbitrary files, and thereby tamper with AI skill files used by Eilik and EilikO robots.
Updated When using the OpenSSL TLS implementation, both the pn_ssl_domain_set_trusted_ca_db() & pn_tls_config_set_trusted_certs() APIs added to rather than replaced the default system trust anchors. Leading to potentially trusting unexpected peer certificates. This can be worked around by setting the SSL_CERT_FILE environment variable for the application to /dev/null. This issue does not affect the
Updated- CVE-2026-105030: Kener 4.0.0 before 4.1.6 Hidden Monitor Data Disclosure via Dashboard API 6.9 Medium
Kener 4.0.0 before 4.1.6 contains an information disclosure vulnerability that allows unauthenticated attackers to retrieve hidden or inactive monitor data by querying dashboard API handlers lacking visibility filters. Attackers can supply a known or guessed monitor tag to endpoints such as monitor-bar and monitor-latency-chart to obtain names, descriptions, status, uptime history and latency.
Updated UVdesk support-center-bundle before 1.1.3.3 contains an insecure direct object reference vulnerability in the rateTicket action of Controller/Ticket.php that allows authenticated customers to rate other customers' tickets. Attackers can supply arbitrary ticket IDs, which are loaded without an ownership check, to submit or change satisfaction ratings on tickets owned by other customers.
UpdatedHeap-based buffer overflow in Microsoft QUIC allows an unauthorized attacker to execute code over a network.
UpdatedImproper neutralization of special elements used in a command ('command injection') in Azure Pipelines allows an unauthorized attacker to execute code over a network.
UpdatedDeserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.
Updated- CVE-2026-105010: Microsoft Windows Search Component Elevation of Privilege Vulnerability 9.8 Critical
Use after free in Microsoft Windows Search Component allows an unauthorized attacker to elevate privileges over a network.
Updated Incorrect default permissions in Windows Server Update Service allows an authorized attacker to elevate privileges locally.
UpdatedNo cwe for this issue in Windows Schannel allows an unauthorized attacker to perform spoofing over a network.
UpdatedAn elevation of privilege vulnerability exists in the Network Driver Interface Specification (NDIS) when ndis.sys fails to check the length of a buffer prior to copying memory to it. To exploit the vulnerability, in a local attack scenario, an attacker could run a specially crafted application to elevate the attacker's privilege level. An attacker who successfully exploited this vulnerability coul
UpdatedUse after free in HID class driver allows an unauthorized attacker to elevate privileges with a physical attack.
UpdatedOut-of-bounds write in Windows Schannel allows an unauthorized attacker to execute code over a network.
UpdatedOut-of-bounds read in Windows Overlay Filter allows an authorized attacker to elevate privileges locally.
UpdatedHeap-based buffer overflow in HID class driver allows an authorized attacker to elevate privileges locally.
Updated