Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 425,865

Export CSV
CVE-2026-111156

libTiMidity through 0.2.8 Out-of-Bounds Access via SoundFont Preset Header

libTiMidity through 0.2.8 contains an out-of-bounds access vulnerability in init_soundfont() in src/sndfont.c that allows attackers to corrupt memory by supplying unvalidated SF2 preset header bank and preset values. Attackers can craft a .sf2 file whose bank or preset indexes past the 128-entry tonebank or drumset arrays, causing heap memory reads, writes, and application crashes.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Sezero
Products
Libtimidity
CVE-2026-105032

EnergizeLab Eilik AI Skill Upload Unauthenticated Path Traversal Arbitrary File Write

The EnergizeLab Eilik and EilikO AI skill upload endpoint, served by the FastAPI AI inference and profiling services, does not require authentication and does not constrain uploaded file paths. An unauthenticated remote attacker can use path traversal to write arbitrary files, and thereby tamper with AI skill files used by Eilik and EilikO robots.

CVSS 3.1 · 9.1 Critical EPSS < 1% KEV · Not listed
Vendors
Energizelab
Products
Fastapi Ai Inference Server
CVE-2026-105033

EnergizeLab AI Station Default Root Credentials with SSH Enabled

The EnergizeLab AI Station (RK3562) firmware image ships with default root credentials and SSH enabled. An attacker with network access to the device can log in as root and take full control of it.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Energizelab
Products
Ai Station Firmware (rk3562)
CVE-2026-105034

EnergizeLab Eilik Unauthenticated Device-Token Issuance for Arbitrary Serial Numbers

The EnergizeLab Eilik NestJS auth service issues device tokens for arbitrary robot serial numbers without authentication. An unauthenticated remote attacker can obtain a valid device token for any serial number and act as that device against the cloud services.

CVSS 3.1 · 8.2 High EPSS < 1% KEV · Not listed
Vendors
Energizelab
Products
Nestjs Auth Service
CVE-2026-105035

EnergizeLab FirmwareUpdater Universal Hard-Coded AES Key

The EnergizeLab FirmwareUpdater (AArch64 ELF, distributed in the CDN bin.zip) uses a single hard-coded AES key shared by all installations. An attacker who recovers the key from the updater can decrypt and forge firmware packages for any device that trusts it.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Energizelab
Products
Firmwareupdater
CVE-2026-105036

EnergizeLab Firmware Updates Downloaded over HTTP Without Integrity Checks

EnergizeLab AI Station firmware, EilikO Linux robot firmware v2.1_20260617182218_release, and the EnergizeLab Windows desktop app 3.1.2 download firmware updates over plain HTTP and do not verify their integrity or authenticity. An attacker able to intercept or modify the traffic can substitute a malicious update.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Energizelab
Products
Ai Station Firmware (rk3562) Robot Firmware (mode 104000) Windows Desktop App (energizelabsetup-3.1.2-win.exe)
CVE-2026-105037

EnergizeLab Station Middleware Authenticated Path Traversal Arbitrary File Read

EnergizeLab station-middleware (NestJS) Docker images 1.6.5 through 1.8.2 allow any registered, low-privilege account to read arbitrary files from the server by supplying an attacker-controlled file path. This exposes middleware files and server secrets.

CVSS 3.1 · 9.9 Critical EPSS < 1% KEV · Not listed
Vendors
Energizelab
Products
Station-middleware
CVE-2026-105038

EnergizeLab Eilik Unauthenticated AI Model Administration and Runtime Model Switching

The EnergizeLab Eilik and EilikO FastAPI AI inference and profiling services expose AI model administration functions without authentication. An unauthenticated remote attacker can change AI model configuration and switch the model in use at runtime.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
Energizelab
Products
Fastapi Ai Inference Server
CVE-2026-105039

EnergizeLab Station Middleware Admin APIs Missing Role Checks

EnergizeLab station-middleware (NestJS) Docker images 1.6.5 through 1.8.2 do not check user roles on administrative APIs. Any authenticated low-privilege user can retrieve AI provider keys and change configuration and object-store contents.

CVSS 3.1 · 9.6 Critical EPSS < 1% KEV · Not listed
Vendors
Energizelab
Products
Station-middleware
CVE-2026-105040

EnergizeLab Eilik User-ID Mass Assignment Account Takeover

The EnergizeLab Eilik NestJS auth service accepts a user-controlled user ID in account update requests (mass assignment). A registered user can set another account's identifier and take over that account.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Energizelab
Products
Nestjs Auth Service
CVE-2026-111273

unarr through 1.1.1 Off-by-One Heap Buffer Overflow via tar_get_name

unarr through 1.1.1 contains an off-by-one heap-based buffer overflow in tar_get_name() in tar/parse-tar.c, reachable through the ar_entry_get_name() API. Attackers can supply a crafted TAR archive with a full ustar prefix and name to write a NUL byte past the allocation, corrupting heap memory and crashing the process.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Selmf
Products
Unarr
CVE-2026-111355

zhontai Admin.Core through 10.1.0 Authorization Bypass via User and Organization By-ID Endpoints

zhontai Admin.Core through 10.1.0 contains an authorization bypass vulnerability that allows authenticated users to ignore department DataScope restrictions by supplying out-of-scope record ids. Attackers holding user or organization module permissions with Dept or Self scope can call UserService and OrgService by-id methods to read, modify, disable, and delete users in other departments.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Zhontai
Products
Admin.core
CVE-2026-111364

MinDoc through 2.2-beta.2 IDOR via /api/:key/content/:id GET Branch

MinDoc through 2.2-beta.2 contains an insecure direct object reference vulnerability in DocumentController.Content that allows authenticated users to read documents from unauthorized books. Attackers holding a non-observer role on any book can name that book and iterate sequential document ids to read markdown and HTML from private books.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Mindoc-org
Products
Mindoc
CVE-2026-111451

Command Injection and File Manipulation via Wheels CLI

Wheels CLI 4.0.0 through 4.1.1 insufficiently validates or escapes caller-supplied values and package contents. Deploy release/version/rollback values can execute shell commands on deploy hosts as the SSH user and on the CI runner during builds. Package removal and destroy paths can delete unintended files; package extraction can overwrite other vendor files; generator names can write outside the project or inject executable CFML into generated code. Inputs may originate from CI variables, branch names, packages or an AI agent using the CLI's MCP tools. Also relevant are unencoded display properties in generated scaffold show views since 4.1.0 and in generated admin views, permitting stored XSS, and stale process-ID handling in RustCFML server commands that can terminate an unrelated process. This is fixed in 4.1.2; existing affected generated views also require the documented edit.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Wheels
Products
Wheels Cli
CVE-2026-14177

User Enumeration via Password Reset in IKAS Technology Inc.'s ikas E-Commerce Infrastructure

Observable response discrepancy vulnerability in IKAS Technology Inc. Ikas E-Commerce Infrastructure allows Account Footprinting. This issue affects ikas E-Commerce Infrastructure: through 2026-07-13.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Ikas Technology
Products
E-commerce Infrastructure
CVE-2026-15219

IDOR in SFM Software's Costifier

Authorization bypass through User-Controlled key vulnerability in SFM Software Technologies Inc. Costifier allows Exploitation of Trusted Identifiers. This issue affects Costifier: through 2026-10-16.  NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Sfm Software Technologies
Products
Costifier
CVE-2026-15575

Sensitive Information Disclosure Due to Enabled Debug Mode in Production in SFM Software's Costifier

Active debug code vulnerability in SFM Software Technologies Inc. Costifier allows Exploit Non-Production Interfaces. This issue affects Costifier: through 2026-10-16. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Sfm Software Technologies
Products
Costifier
CVE-2026-105664

Guangzhou Juan IoT Technology EseeCloud Observable Response Discrepancy

The endpoint exposes an observable response discrepancy when processing ID values. A request submitted with a nonexistent ID returns a distinct error response code from one submitted with a valid, registered ID, allowing an attacker holding a valid access token - but without further authentication or authorization - to distinguish valid ID values from the full 10-digit numeric search space. Combined with the absence of meaningful rate limiting on this endpoint, this discrepancy constitutes an enumeration oracle, enabling an attacker to discover registered devices at scale.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Guangzhou Juan Iot Technology
Products
Eseecloud App Eseecloud Firmware
CVE-2026-105273

J4Care dcm4che Loop with Unreachable Exit Condition

MP4Parser does not adequately validate MP4 box sizes. A malformed box can cause parsing to make no forward progress and repeatedly process the same input.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
J4care
Products
Dcm4chee-arc-light
CVE-2026-101021

J4Care dcm4che Inefficient Algorithmic Complexity

MultipartInputStream performs inefficient boundary matching and unnecessary buffer copying. Crafted multipart input can force excessive boundary comparisons and repeated copying.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
J4care
Products
Dcm4chee-arc-light