Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 2

Export CSV
CVE-2026-105037

EnergizeLab Station Middleware Authenticated Path Traversal Arbitrary File Read

EnergizeLab station-middleware (NestJS) Docker images 1.6.5 through 1.8.2 allow any registered, low-privilege account to read arbitrary files from the server by supplying an attacker-controlled file path. This exposes middleware files and server secrets.

CVSS 3.1 · 9.9 Critical EPSS < 1% KEV · Not listed
Vendors
Energizelab
Products
Station-middleware
CVE-2026-105039

EnergizeLab Station Middleware Admin APIs Missing Role Checks

EnergizeLab station-middleware (NestJS) Docker images 1.6.5 through 1.8.2 do not check user roles on administrative APIs. Any authenticated low-privilege user can retrieve AI provider keys and change configuration and object-store contents.

CVSS 3.1 · 9.6 Critical EPSS < 1% KEV · Not listed
Vendors
Energizelab
Products
Station-middleware