Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 2

Export CSV
CVE-2026-105034

EnergizeLab Eilik Unauthenticated Device-Token Issuance for Arbitrary Serial Numbers

The EnergizeLab Eilik NestJS auth service issues device tokens for arbitrary robot serial numbers without authentication. An unauthenticated remote attacker can obtain a valid device token for any serial number and act as that device against the cloud services.

CVSS 3.1 · 8.2 High EPSS < 1% KEV · Not listed
Vendors
Energizelab
Products
Nestjs Auth Service
CVE-2026-105040

EnergizeLab Eilik User-ID Mass Assignment Account Takeover

The EnergizeLab Eilik NestJS auth service accepts a user-controlled user ID in account update requests (mass assignment). A registered user can set another account's identifier and take over that account.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Energizelab
Products
Nestjs Auth Service