CVE-2026-105036

EnergizeLab Firmware Updates Downloaded over HTTP Without Integrity Checks

EnergizeLab AI Station firmware, EilikO Linux robot firmware v2.1_20260617182218_release, and the EnergizeLab Windows desktop app 3.1.2 download firmware updates over plain HTTP and do not verify their integrity or authenticity. An attacker able to intercept or modify the traffic can substitute a malicious update.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Energizelab

Products

Ai Station Firmware (rk3562) Robot Firmware (mode 104000) Windows Desktop App (energizelabsetup-3.1.2-win.exe)

CVE-2026-105037

EnergizeLab Station Middleware Authenticated Path Traversal Arbitrary File Read

EnergizeLab station-middleware (NestJS) Docker images 1.6.5 through 1.8.2 allow any registered, low-privilege account to read arbitrary files from the server by supplying an attacker-controlled file path. This exposes middleware files and server secrets.

CVSS 3.1 · 9.9 Critical EPSS < 1% KEV · Not listed

Vendors

Energizelab

Products

Station-middleware

CVE-2026-105038

EnergizeLab Eilik Unauthenticated AI Model Administration and Runtime Model Switching

The EnergizeLab Eilik and EilikO FastAPI AI inference and profiling services expose AI model administration functions without authentication. An unauthenticated remote attacker can change AI model configuration and switch the model in use at runtime.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Energizelab

Products

Fastapi Ai Inference Server

CVE-2026-105039

EnergizeLab Station Middleware Admin APIs Missing Role Checks

EnergizeLab station-middleware (NestJS) Docker images 1.6.5 through 1.8.2 do not check user roles on administrative APIs. Any authenticated low-privilege user can retrieve AI provider keys and change configuration and object-store contents.

CVSS 3.1 · 9.6 Critical EPSS < 1% KEV · Not listed

Vendors

Energizelab

Products

Station-middleware

CVE-2026-105040

EnergizeLab Eilik User-ID Mass Assignment Account Takeover

The EnergizeLab Eilik NestJS auth service accepts a user-controlled user ID in account update requests (mass assignment). A registered user can set another account's identifier and take over that account.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Energizelab

Products

Nestjs Auth Service

CVE-2026-111273

unarr through 1.1.1 Off-by-One Heap Buffer Overflow via tar_get_name

unarr through 1.1.1 contains an off-by-one heap-based buffer overflow in tar_get_name() in tar/parse-tar.c, reachable through the ar_entry_get_name() API. Attackers can supply a crafted TAR archive with a full ustar prefix and name to write a NUL byte past the allocation, corrupting heap memory and crashing the process.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Selmf

Products

Unarr

CVE-2026-111355

zhontai Admin.Core through 10.1.0 Authorization Bypass via User and Organization By-ID Endpoints

zhontai Admin.Core through 10.1.0 contains an authorization bypass vulnerability that allows authenticated users to ignore department DataScope restrictions by supplying out-of-scope record ids. Attackers holding user or organization module permissions with Dept or Self scope can call UserService and OrgService by-id methods to read, modify, disable, and delete users in other departments.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Zhontai

Products

Admin.core

CVE-2026-111364

MinDoc through 2.2-beta.2 IDOR via /api/:key/content/:id GET Branch

MinDoc through 2.2-beta.2 contains an insecure direct object reference vulnerability in DocumentController.Content that allows authenticated users to read documents from unauthorized books. Attackers holding a non-observer role on any book can name that book and iterate sequential document ids to read markdown and HTML from private books.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Mindoc-org

Products

Mindoc

CVE-2026-111451

Command Injection and File Manipulation via Wheels CLI

Wheels CLI 4.0.0 through 4.1.1 insufficiently validates or escapes caller-supplied values and package contents. Deploy release/version/rollback values can execute shell commands on deploy hosts as the SSH user and on the CI runner during builds. Package removal and destroy paths can delete unintended files; package extraction can overwrite other vendor files; generator names can write outside the project or inject executable CFML into generated code. Inputs may originate from CI variables, branch names, packages or an AI agent using the CLI's MCP tools. Also relevant are unencoded display properties in generated scaffold show views since 4.1.0 and in generated admin views, permitting stored XSS, and stale process-ID handling in RustCFML server commands that can terminate an unrelated process. This is fixed in 4.1.2; existing affected generated views also require the documented edit.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Wheels

Products

Wheels Cli

CVE-2026-14177

User Enumeration via Password Reset in IKAS Technology Inc.'s ikas E-Commerce Infrastructure

Observable response discrepancy vulnerability in IKAS Technology Inc. Ikas E-Commerce Infrastructure allows Account Footprinting. This issue affects ikas E-Commerce Infrastructure: through 2026-07-13.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Ikas Technology

Products

E-commerce Infrastructure

CVE-2026-15219

IDOR in SFM Software's Costifier

Authorization bypass through User-Controlled key vulnerability in SFM Software Technologies Inc. Costifier allows Exploitation of Trusted Identifiers. This issue affects Costifier: through 2026-10-16.  NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Sfm Software Technologies

Products

Costifier

CVE-2026-15575

Sensitive Information Disclosure Due to Enabled Debug Mode in Production in SFM Software's Costifier

Active debug code vulnerability in SFM Software Technologies Inc. Costifier allows Exploit Non-Production Interfaces. This issue affects Costifier: through 2026-10-16. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Sfm Software Technologies

Products

Costifier

CVE-2026-105664

Guangzhou Juan IoT Technology EseeCloud Observable Response Discrepancy

The endpoint exposes an observable response discrepancy when processing ID values. A request submitted with a nonexistent ID returns a distinct error response code from one submitted with a valid, registered ID, allowing an attacker holding a valid access token - but without further authentication or authorization - to distinguish valid ID values from the full 10-digit numeric search space. Combined with the absence of meaningful rate limiting on this endpoint, this discrepancy constitutes an enumeration oracle, enabling an attacker to discover registered devices at scale.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Guangzhou Juan Iot Technology

Products

Eseecloud App Eseecloud Firmware

CVE-2026-105273

J4Care dcm4che Loop with Unreachable Exit Condition

MP4Parser does not adequately validate MP4 box sizes. A malformed box can cause parsing to make no forward progress and repeatedly process the same input.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

J4care

Products

Dcm4chee-arc-light

CVE-2026-101021

J4Care dcm4che Inefficient Algorithmic Complexity

MultipartInputStream performs inefficient boundary matching and unnecessary buffer copying. Crafted multipart input can force excessive boundary comparisons and repeated copying.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

J4care

Products

Dcm4chee-arc-light

CVE-2026-105279

J4Care dcm4che Missing Authentication for Critical Function

In the default configuration, the archive accepts DICOM associations from an unregistered calling AE. A remote peer can use C-FIND and C-GET to enumerate and retrieve patient information and medical images. It can also use C-STORE to file fabricated study content under an existing patient identity.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed

Vendors

J4care

Products

Dcm4chee-arc-light

CVE-2026-105667

J4Care dcm4che Missing Authentication for Critical Function

In the default configuration, the HL7 listener accepts ADT^A40 patient-merge messages without authenticating the sending application. A remote sender can reassign studies and related workflow records from one patient identity to another. The archive's unmerge does not reverse this.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

J4care

Products

Dcm4chee-arc-light

CVE-2026-111728

Seanime v3.10.3 Argument Injection via TranscodeHwAccelCustomSettings

Seanime v3.7.0 to v3.10.3 contains an argument injection vulnerability reachable through improper authorization, allowing unauthenticated LAN or Tailnet clients to bypass the privileged mediastream settings guard by setting transcodeHwAccel to custom and supplying attacker-controlled decodeFlags and encodeFlags via the transcodeHwAccelCustomSettings field, which are appended verbatim to the ffmpeg argument vector. Attackers can trigger execution via the mediastream request and HLS playlist endpoints to achieve arbitrary file write and file truncation on the host as the user running seanime, with the injected input options also enabling potential arbitrary local file read and outbound data exfiltration through ffmpeg's protocol handlers.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

5rahim

Products

Seanime

CVE-2026-96424

Incorrect Permission Assignment for Critical Resource in lomiri-download-manager

Incorrect DBus policy for lomiri-upload-manager (part of lomiri-download-manager) allows arbitrary user to read arbitrary file as root over DBus

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Ubports

Products

Lomiri-download-manager

CVE-2026-96425

Incorrect Permission Assignment for Critical Resource in lomiri-download-manager

Incorrect DBus policy for lomiri-download-manager allows arbitrary user to run arbitrary command as root over DBus

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Ubports

Products

Lomiri-download-manager