CVE-2026-105040

The EnergizeLab Eilik NestJS auth service accepts a user-controlled user ID in account update requests mass assignment. A registered user can set another account's identifier and take over that account...

CVE-2026-105034

The EnergizeLab Eilik NestJS auth service issues device tokens for arbitrary robot serial numbers without authentication. An unauthenticated remote attacker can obtain a valid device token for any serial number and act as that device against the cloud services...

EUVD-2026-102436

The EnergizeLab Eilik NestJS auth service accepts a user-controlled user ID in account update requests mass assignment. A registered user can set another account's identifier and take over that account...

CVE-2026-105040 EnergizeLab Eilik User-ID Mass Assignment Account Takeover

The EnergizeLab Eilik NestJS auth service accepts a user-controlled user ID in account update requests mass assignment. A registered user can set another account's identifier and take over that account...

CVE-2026-105040

The EnergizeLab Eilik NestJS auth service is vulnerable to a mass assignment flaw. The service accepts a user-controlled user ID during account update requests, allowing a registered user to modify another account's identifier. This vulnerability results in an account takeover , as an attacker ca...

CVE-2026-105040 EnergizeLab Eilik User-ID Mass Assignment Account Takeover

The EnergizeLab Eilik NestJS auth service accepts a user-controlled user ID in account update requests mass assignment. A registered user can set another account's identifier and take over that account...

EUVD-2026-102430

The EnergizeLab Eilik NestJS auth service issues device tokens for arbitrary robot serial numbers without authentication. An unauthenticated remote attacker can obtain a valid device token for any serial number and act as that device against the cloud services...

CVE-2026-105034 EnergizeLab Eilik Unauthenticated Device-Token Issuance for Arbitrary Serial Numbers

The EnergizeLab Eilik NestJS auth service issues device tokens for arbitrary robot serial numbers without authentication. An unauthenticated remote attacker can obtain a valid device token for any serial number and act as that device against the cloud services...

CVE-2026-105034

The EnergizeLab Eilik NestJS auth service is vulnerable to unauthenticated device-token issuance. Due to missing and improper authentication (CWE-306, CWE-287), a remote attacker can obtain a valid device token for any arbitrary robot serial number. This allows the attacker to impersonate any dev...

CVE-2026-105034 EnergizeLab Eilik Unauthenticated Device-Token Issuance for Arbitrary Serial Numbers

The EnergizeLab Eilik NestJS auth service issues device tokens for arbitrary robot serial numbers without authentication. An unauthenticated remote attacker can obtain a valid device token for any serial number and act as that device against the cloud services...

CVE-2026-105040: Authorization Bypass Through User-Controlled Key

The EnergizeLab Eilik NestJS auth service accepts a user-controlled user ID in account update requests mass assignment. A registered user can set another account's identifier and take over that account...

PT-2026-115227

The EnergizeLab Eilik NestJS auth service accepts a user-controlled user ID in account update requests mass assignment. A registered user can set another account's identifier and take over that account...

CVE-2026-105034: Missing Authentication for Critical Function

The EnergizeLab Eilik NestJS auth service issues device tokens for arbitrary robot serial numbers without authentication. An unauthenticated remote attacker can obtain a valid device token for any serial number and act as that device against the cloud services...

PT-2026-115221

The EnergizeLab Eilik NestJS auth service issues device tokens for arbitrary robot serial numbers without authentication. An unauthenticated remote attacker can obtain a valid device token for any serial number and act as that device against the cloud services...

EnergizeLab NestJS auth service has a vulnerability regarding authorization issues.

EnergizeLab NestJS auth service version 1.8.2 has an authorization issue. This vulnerability stems from issuing device tokens to arbitrary robot serial numbers without verification. As a result, unauthenticated remote attackers may obtain valid device tokens for arbitrary serial numbers and use...

EnergizeLab NestJS auth service has a vulnerability regarding authorization issues.

EnergizeLab NestJS auth service version 1.8.2 has a security vulnerability. This vulnerability stems from the acceptance of user-controlled user IDs in account update requests during batch assignments. Registered users can set different identifier for other accounts and thereby take control of...

CentOS Linux 6 [TuxCare] Security Update: dovecot / dovecot-devel / dovecot-mysql / dovecot-pgsql / etc (CENTOS6:CLSA-2025:1758896552)

The CentOS Linux 6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS6:CLSA-2025:1758896552 advisory. - In Dovecot before 2.3.11.3, sending a specially formatted RPA request will crash the auth service because a length of zero is mishandled...

CentOS Linux 6 [TuxCare] Security Update: dovecot / dovecot-devel / dovecot-mysql / dovecot-pgsql / etc (CENTOS6:CLSA-2025:1758645976)

The CentOS Linux 6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS6:CLSA-2025:1758645976 advisory. - In Dovecot before 2.3.11.3, sending a specially formatted NTLM request will crash the auth service because of an out-of-bounds read...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: dovecot (UTSA-2026-090084)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-090084 advisory. In Dovecot before 2.3.11.3, sending a specially formatted NTLM request will crash the auth service because of an out-of-bounds read. Tenable has extracted the...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: dovecot (UTSA-2026-090088)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-090088 advisory. In Dovecot before 2.3.11.3, sending a specially formatted RPA request will crash the auth service because a length of zero is mishandled. Tenable has extracted the...