Catalog
Findings
Filter the merged record by severity, source, stack, and weakness type.
- High8.8The EnergizeLab Eilik NestJS auth service accepts a user-controlled user ID in account update requests (mass assignment).Oct 15, 2026
- Critical9.6EnergizeLab station-middleware (NestJS) Docker images 1.6.5 through 1.8.2 do not check user roles on administrative APIs.Oct 15, 2026
- Critical9.8The EnergizeLab Eilik and EilikO FastAPI AI inference and profiling services expose AI model administration functions without authentication.Oct 15, 2026
- Critical9.9EnergizeLab station-middleware (NestJS) Docker images 1.6.5 through 1.8.2 allow any registered, low-privilege account to read arbitrary files from the server by supply…Oct 15, 2026
- High7.5EnergizeLab AI Station firmware, EilikO Linux robot firmware v2.1_20260617182218_release, and the EnergizeLab Windows desktop app 3.1.2 download firmware updates over…Oct 15, 2026
- High7.8The EnergizeLab FirmwareUpdater (AArch64 ELF, distributed in the CDN bin.zip) uses a single hard-coded AES key shared by all installations.Oct 15, 2026
- High8.2The EnergizeLab Eilik NestJS auth service issues device tokens for arbitrary robot serial numbers without authentication.Oct 15, 2026
- High8.8The EnergizeLab AI Station (RK3562) firmware image ships with default root credentials and SSH enabled.Oct 15, 2026
- Critical9.1The EnergizeLab Eilik and EilikO AI skill upload endpoint, served by the FastAPI AI inference and profiling services, does not require authentication and does not cons…Oct 15, 2026
- High7.5Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a network.Oct 15, 2026
- Medium6.5Microsoft Office PowerPoint Information Disclosure VulnerabilityOct 15, 2026
- Medium6.5Microsoft Office PowerPoint Information Disclosure VulnerabilityOct 15, 2026
- Medium6.5Microsoft Office PowerPoint Information Disclosure VulnerabilityOct 15, 2026
- High8.8Improper limitation of a pathname to a restricted directory ('path traversal') in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.Oct 15, 2026
- High8.8Numeric truncation error in Microsoft Office Word allows an unauthorized attacker to execute code over a network.Oct 15, 2026
- High8.8Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.Oct 15, 2026
- High8.8Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.Oct 15, 2026
- High7.5Heap-based buffer overflow in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network.Oct 15, 2026
- High7.0Ivanti Connect Secure 22.8R2.4 mishandles the manner in which the dsinvoked broker trusts DSCache configuration data, leading to privilege escalation to root, as explo…Oct 15, 2026
- Medium5.3ZoneMinder is a free, open source closed-circuit television software application.Oct 15, 2026
- Medium5.4Scoold is a Q&A and a knowledge sharing platform for teams.Oct 15, 2026
- Medium5.4Scoold is a Q&A and a knowledge sharing platform for teams.Oct 15, 2026
- High8.1AliasVault is a privacy-first password manager with built-in email aliasing.Oct 15, 2026
- Critical9.1Tianji is an open source analytics, uptime monitoring, and server status platform.Oct 15, 2026
- High8.8Tianji is an open source analytics, uptime monitoring, and server status platform.Oct 15, 2026