Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-105036 | high | 7.5 | No | EnergizeLab AI Station firmware, EilikO Linux robot firmware v2.1_20260617182218_release, and the EnergizeLab Windows desktop app 3.1.2 down... | 2026-10-16 |
| CVE-2026-105035 | high | 7.8 | No | The EnergizeLab FirmwareUpdater (AArch64 ELF, distributed in the CDN bin.zip) uses a single hard-coded AES key shared by all installations.... | 2026-10-16 |
| CVE-2026-107794 | high | 7.5 | No | ExtUtils::Typemaps::STL::List versions before 1.07 for Perl allocate a 32 GiB array on an empty list. The OUTPUT typemaps call av_extend( a... | 2026-10-16 |
| CVE-2026-102693 | critical | 9.6 | No | RIOT is an open-source microcontroller operating system designed for Internet of Things devices and other embedded systems. Prior to 2026.04... | 2026-10-16 |
| CVE-2026-105034 | high | 8.2 | No | The EnergizeLab Eilik NestJS auth service issues device tokens for arbitrary robot serial numbers without authentication. An unauthenticated... | 2026-10-16 |
| CVE-2026-105033 | high | 8.8 | No | The EnergizeLab AI Station (RK3562) firmware image ships with default root credentials and SSH enabled. An attacker with network access to t... | 2026-10-16 |
| CVE-2026-105032 | critical | 9.1 | No | The EnergizeLab Eilik and EilikO AI skill upload endpoint, served by the FastAPI AI inference and profiling services, does not require authe... | 2026-10-16 |
| CVE-2026-68908 | medium | 5.3 | No | libIEC61850 is an open-source implementation of IEC 61850 client and server protocols including MMS, GOOSE, Sampled Values, and R-Session. P... | 2026-10-16 |
| CVE-2026-68907 | not reported | — | No | libIEC61850 is an open-source implementation of IEC 61850 client and server protocols including MMS, GOOSE, Sampled Values, and R-Session. P... | 2026-10-16 |
| CVE-2026-57447 | medium | 4.3 | No | Discourse Doc Categories is a plugin for organizing Discourse topics as documentation. Prior to the verified source fix, the doc category in... | 2026-10-16 |
| CVE-2026-55836 | medium | 6.8 | No | Open Zaak is an open-source data and services layer for Dutch case-oriented working. From 1.13.0 until 1.27.2, 1.28.2, and 1.29.0, _import_d... | 2026-10-16 |
| CVE-2026-54657 | medium | 6.5 | No | Open Zaak is an open-source data and services layer for Dutch case-oriented working. From 1.0.0 until 1.27.2, 1.28.2, and 1.29.0, the POST s... | 2026-10-16 |
| CVE-2026-48503 | high | 7.5 | No | libIEC61850 is an open-source implementation of IEC 61850 client and server protocols including MMS, GOOSE, Sampled Values, and R-Session. P... | 2026-10-16 |
| CVE-2026-97851 | critical | 9.1 | No | The storage status-change REST service allows location records still associated with DICOM instances to be changed to deletion-related state... | 2026-10-16 |
| CVE-2026-107621 | high | 7.5 | No | JPEGParser can enter an infinite loop while parsing a specially crafted or truncated stream. | 2026-10-16 |
| CVE-2026-105667 | high | 7.5 | No | In the default configuration, the HL7 listener accepts ADT^A40 patient-merge messages without authenticating the sending application. A remo... | 2026-10-16 |
| CVE-2026-105279 | critical | 9.1 | No | In the default configuration, the archive accepts DICOM associations from an unregistered calling AE. A remote peer can use C-FIND and C-GET... | 2026-10-16 |
| CVE-2026-105273 | high | 7.5 | No | MP4Parser does not adequately validate MP4 box sizes. A malformed box can cause parsing to make no forward progress and repeatedly process t... | 2026-10-16 |
| CVE-2026-101021 | high | 7.5 | No | MultipartInputStream performs inefficient boundary matching and unnecessary buffer copying. Crafted multipart input can force excessive boun... | 2026-10-16 |
| CVE-2026-97858 | medium | 5.3 | No | An attacker can cause the server to unbind the target device from its current owner and rebind it to the requesting account, regardless of w... | 2026-10-16 |