EUVD-2026-102435

EnergizeLab station-middleware NestJS Docker images 1.6.5 through 1.8.2 do not check user roles on administrative APIs. Any authenticated low-privilege user can retrieve AI provider keys and change configuration and object-store contents...

EUVD-2026-102434

The EnergizeLab Eilik and EilikO FastAPI AI inference and profiling services expose AI model administration functions without authentication. An unauthenticated remote attacker can change AI model configuration and switch the model in use at runtime...

EUVD-2026-102433

EnergizeLab station-middleware NestJS Docker images 1.6.5 through 1.8.2 allow any registered, low-privilege account to read arbitrary files from the server by supplying an attacker-controlled file path. This exposes middleware files and server secrets...

EUVD-2026-102432

EnergizeLab AI Station firmware, EilikO Linux robot firmware v2.120260617182218release, and the EnergizeLab Windows desktop app 3.1.2 download firmware updates over plain HTTP and do not verify their integrity or authenticity. An attacker able to intercept or modify the traffic can substitute a...

EUVD-2026-102431

The EnergizeLab FirmwareUpdater AArch64 ELF, distributed in the CDN bin.zip uses a single hard-coded AES key shared by all installations. An attacker who recovers the key from the updater can decrypt and forge firmware packages for any device that trusts it...

EUVD-2026-102430

The EnergizeLab Eilik NestJS auth service issues device tokens for arbitrary robot serial numbers without authentication. An unauthenticated remote attacker can obtain a valid device token for any serial number and act as that device against the cloud services...

EUVD-2026-102429

The EnergizeLab AI Station RK3562 firmware image ships with default root credentials and SSH enabled. An attacker with network access to the device can log in as root and take full control of it...

EUVD-2026-102428

The EnergizeLab Eilik and EilikO AI skill upload endpoint, served by the FastAPI AI inference and profiling services, does not require authentication and does not constrain uploaded file paths. An unauthenticated remote attacker can use path traversal to write arbitrary files, and thereby tamper...

EUVD-2026-102427

The vulnerability exists within internal components of BeyondTrust’s Remote Support product. The components did not adequately validate the origin of the messages it received. Under the right conditions, this could allow an attacker to perform file operations on the appliance...

EUVD-2026-98849

TanStack Router: Unauthenticated reflected XSS in TanStack Start server-function responses...

EUVD-2026-101601

Pipecat: Public exposure of Pipecat’s development runner can allow unauthenticated bot session creation...

EUVD-2026-98929

Podman: The podman run command can be instructed to disable almost all sandboxing by image annotation...

EUVD-2026-98809

JupyterLab: Command link trust prompt in JupyterLab can trust a document other than the one clicked...

EUVD-2026-98781

SFTPGo source-side file-pattern filter bypass during copy operations...

EUVD-2026-100461

Claude Code: Plugin Hash Pin Bypass Allows Bypass of Hash Pinning...

EUVD-2026-97822

containerd: Unpack DoS via repeated opaque whiteouts...

EUVD-2026-99225

Distribution: Client manifests.Get does not verify returned content against requested digest...

EUVD-2026-99978

Qwik: Crashing any Qwik Server via Resource thenable...

EUVD-2026-97820

containerd CRI plugin: Checkpoint restore bypasses destination security context...

EUVD-2026-97833

Backstage: Improper access control in backend action invocation...

EUVD-2026-101424

Talos Linux: Support bundle does not redact registry credentials...

EUVD-2026-101431

KEDA: Privilege escalation from namespace admin to cluster admin via KEDA TriggerAuthentication...

EUVD-2026-98917

Argo CD: AppProject destination-namespace and resource restrictions bypassed by PreDelete/PostDelete resource hooks...

EUVD-2026-101529

Appium: Symlink based Zip Slip in @appium/support ZIP extraction...

EUVD-2026-98921

Dio: Cross-origin redirect leaks sensitive request headers in diohttp2adapter...

EUVD-2026-101603

Dgraph: Zero Unauthenticated HTTP Admin removeNode Denial of Service...

EUVD-2026-97760

copyparty FTP: upload outside defined volumes limited path traversal...

EUVD-2026-100525

Vitess vttablet /twopcz reflected XSS...

EUVD-2026-98918

unstructured: Stored XSS via unescaped HTML generation...

EUVD-2026-101154

mise permits untrusted local configuration to override default shell arguments...

EUVD-2026-98753

Gotify: Insufficiently Protected Password Change endpoint...

EUVD-2026-101303

Nezha Monitoring: Whole-instance DoS in Nezha dashboard: a member can crash the process for every tenant...

EUVD-2026-98850

Leantime: Any Authenticated User Can Self-Escalate to Admin via Unauthorized JSON-RPC Methods...

EUVD-2026-98911

FrankenPHP: Cross-request PHP session ID leak in worker mode when the session extension is a shared module...

EUVD-2026-98780

SFTPGo: Denial of service via malformed SSH channel request...

EUVD-2026-97907

Nginx UI: OTP secure-session step-up can be bypassed via MCP configuration tools...

EUVD-2026-97864

Nginx UI: Standalone short tokens survive administrative revocation in cache and authenticate again after account re-enable...

EUVD-2026-97906

Nginx UI: nginx config directive denylist ValidateConfigFile is bypassable via same-line ";" separation → authenticated directive injection RCE on the official image...

EUVD-2026-101452

MCP Python SDK: Unbounded Session Accumulation in StreamableHTTP Transport Enables Resource Exhaustion...

EUVD-2026-101285

YOURLS: Unauthenticated File Inclusion...

EUVD-2026-97963

Nginx UI: Casdoor SSO callback uses a constant state parameter login CSRF...

EUVD-2026-97830

Nginx UI OTP secure-session step-up is missing on sensitive mutation routes...

EUVD-2026-97862

Nginx UI: Account Takeover via Missing RequireSecureSession on User Management Endpoint...

EUVD-2026-97865

Nginx UI: TOTP / passkey enrolment requires no re-authentication, enabling persistent account takeover...

EUVD-2026-97908

Nginx UI: MCP nginxconfigadd Bypasses Directive Validation — Authenticated RCE...

EUVD-2026-97895

Nginx UI: MCP nginxconfigadd skips config directive validation → authenticated nginx directive injection RCE on the official image...

EUVD-2026-97860

Nginx UI: Auto backup name allows path traversal outside validated storage path...

EUVD-2026-97905

Nginx UI: MCP configuration tools bypass restricted directive validation and allow secondary authenticated users to execute NJS in Nginx worker context...

EUVD-2026-102423

ZoneMinder is a free, open source closed-circuit television software application. In versions 1.34.0 through 1.36.38, the web interface mishandles failed token authentication in web/includes/auth.php. validateToken returns false when a token is malformed or has an invalid signature, but the calle...

EUVD-2026-102301

temporal-proxy 0.2.0 through 0.8.0 does not bind encrypted payloads to the namespace they were encrypted for. When payload encryption is enabled, the proxy chooses the decryption key by an identifier stored in the payload rather than by the namespace of the request, and nothing in the ciphertext...