AHA

Latest CVEs · RSS

• CVE-2026-105040 2026-10-15 · CVSS 8.8
  The EnergizeLab Eilik NestJS auth service accepts a user-controlled user ID in account update requests (mass assignment). A registered user can set another acco
• CVE-2026-105039 2026-10-15 · CVSS 9.6
  EnergizeLab station-middleware (NestJS) Docker images 1.6.5 through 1.8.2 do not check user roles on administrative APIs. Any authenticated low-privilege user c
• CVE-2026-105038 2026-10-15 · CVSS 9.8
  The EnergizeLab Eilik and EilikO FastAPI AI inference and profiling services expose AI model administration functions without authentication. An unauthenticated
• CVE-2026-105037 2026-10-15 · CVSS 9.9
  EnergizeLab station-middleware (NestJS) Docker images 1.6.5 through 1.8.2 allow any registered, low-privilege account to read arbitrary files from the server by
• CVE-2026-105036 2026-10-15 · CVSS 7.5
  EnergizeLab AI Station firmware, EilikO Linux robot firmware v2.1_20260617182218_release, and the EnergizeLab Windows desktop app 3.1.2 download firmware update
• CVE-2026-105035 2026-10-15 · CVSS 7.8
  The EnergizeLab FirmwareUpdater (AArch64 ELF, distributed in the CDN bin.zip) uses a single hard-coded AES key shared by all installations. An attacker who reco
• CVE-2026-105034 2026-10-15 · CVSS 8.2
  The EnergizeLab Eilik NestJS auth service issues device tokens for arbitrary robot serial numbers without authentication. An unauthenticated remote attacker can
• CVE-2026-105033 2026-10-15 · CVSS 8.8
  The EnergizeLab AI Station (RK3562) firmware image ships with default root credentials and SSH enabled. An attacker with network access to the device can log in
• CVE-2026-105032 2026-10-15 · CVSS 9.1
  The EnergizeLab Eilik and EilikO AI skill upload endpoint, served by the FastAPI AI inference and profiling services, does not require authentication and does n
• CVE-2026-14765 2026-10-14 · CVSS 7.7
  Epic Games Unreal Engine versions up to and including 5.8.0 ship with an insecure default configuration for the LaunchURL Blueprint node (UKismetSystemLibrary::
• CVE-2026-7574 2026-06-23 · CVSS 8.7
  Anthropic Claude Desktop Cowork VM image handling (confirmed across v1.1348.0 through v1.2278.0, including v1.1348.0, v1.1617.0, and v1.2278.0) validates only f
• CVE-2026-7415 2026-05-07 · CVSS 9.8
  The MQTT broker embedded in Yarbo firmware v2.3.9 is configured to allow anonymous connections with no topic-level read or write ACLs. Any host on the same netw
• CVE-2026-7414 2026-05-07 · CVSS 9.8
  Yarbo firmware v2.3.9 contains hardcoded administrative credentials embedded in the firmware image. These credentials are identical across all devices running t
• CVE-2026-7413 2026-05-07 · CVSS 7.2
  A hidden, persistent backdoor was found in Yarbo firmware v2.3.9 that provides remote, unauthenticated (or weakly authenticated) access to privileged functional
• CVE-2026-4946 2026-03-29 · CVSS 8.8
  Ghidra versions prior to 12.0.3 improperly process annotation directives embedded in automatically extracted binary data, resulting in arbitrary command executi
• CVE-2026-1442 2026-02-27 · CVSS 7.8
  Since the encryption algorithm used to protect firmware updates is itself encrypted using key material available to an attacker (or anyone paying attention), th
• CVE-2025-35028 2025-11-30 · CVSS 9.1
  By providing a command-line argument starting with a semi-colon ; to an API endpoint created by the EnhancedCommandExecutor class of the HexStrike AI MCP server
• CVE-2025-35021 2025-11-04 · CVSS 6.5
  By failing to authenticate three times to an unconfigured Abilis CPX device via SSH, an attacker can login to a restricted shell on the fourth attempt, and from
• CVE-2025-35027 2025-09-26 · CVSS 7.3
  Multiple robotic products by Unitree sharing a common firmware, including the Go2, G1, H1, and B2 devices, contain a command injection vulnerability. By setting
• CVE-2025-8452 2025-08-12 · CVSS 4.3
  By using the "uscan" protocol provided by the eSCL specification, an attacker can discover the serial number of multi-function printers that implement the Broth
• CVE-2025-35010 2025-06-08 · CVSS 7.1
  Products that incorporate the Microhard BulletLTE-NA2 and IPn4Gii-NA2 are vulnerable to a post-authentication command injection issue in the AT+MNPINGTM command
• CVE-2025-35009 2025-06-08 · CVSS 7.1
  Products that incorporate the Microhard BulletLTE-NA2 and IPn4Gii-NA2 are vulnerable to a post-authentication command injection issue in the AT+MNNETSP command
• CVE-2025-35008 2025-06-08 · CVSS 7.1
  Products that incorporate the Microhard BulletLTE-NA2 and IPn4Gii-NA2 are vulnerable to a post-authentication command injection issue in the AT+MMNAME command t
• CVE-2025-35007 2025-06-08 · CVSS 7.1
  Products that incorporate the Microhard BulletLTE-NA2 and IPn4Gii-NA2 are vulnerable to a post-authentication command injection issue in the AT+MFRULE command t
• CVE-2025-35006 2025-06-08 · CVSS 7.1
  Products that incorporate the Microhard BulletLTE-NA2 and IPn4Gii-NA2 are vulnerable to a post-authentication command injection issue in the AT+MFPORTFWD comman