https://vulnogram.org/ Most recent CVEs assigned by Austin Hackers Anonymous (aha). https://vulnogram.org/seaview/icons/aha.png https://vulnogram.org/ Wed, 21 Oct 2026 07:00:06 GMT https://vulnogram.org/CVE-2026-105040 https://vulnogram.org/CVE-2026-105040 The EnergizeLab Eilik NestJS auth service accepts a user-controlled user ID in account update requests (mass assignment). A registered user can set another account's identifier and take over that account. High Cloud Hosted Thu, 15 Oct 2026 20:43:47 GMT https://vulnogram.org/CVE-2026-105039 https://vulnogram.org/CVE-2026-105039 EnergizeLab station-middleware (NestJS) Docker images 1.6.5 through 1.8.2 do not check user roles on administrative APIs. Any authenticated low-privilege user can retrieve AI provider keys and change configuration and object-store contents. Critical Cloud Hosted Thu, 15 Oct 2026 20:43:38 GMT https://vulnogram.org/CVE-2026-105038 https://vulnogram.org/CVE-2026-105038 The EnergizeLab Eilik and EilikO FastAPI AI inference and profiling services expose AI model administration functions without authentication. An unauthenticated remote attacker can change AI model configuration and switch the model in use at runtime. Critical Network Exploitable Cloud Hosted Thu, 15 Oct 2026 20:43:30 GMT https://vulnogram.org/CVE-2026-105037 https://vulnogram.org/CVE-2026-105037 EnergizeLab station-middleware (NestJS) Docker images 1.6.5 through 1.8.2 allow any registered, low-privilege account to read arbitrary files from the server by supplying an attacker-controlled file path. This exposes middleware files and server secr… Critical Cloud Hosted Thu, 15 Oct 2026 20:43:13 GMT https://vulnogram.org/CVE-2026-105036 https://vulnogram.org/CVE-2026-105036 EnergizeLab AI Station firmware, EilikO Linux robot firmware v2.1_20260617182218_release, and the EnergizeLab Windows desktop app 3.1.2 download firmware updates over plain HTTP and do not verify their integrity or authenticity. An attacker able to i… High Thu, 15 Oct 2026 20:43:04 GMT https://vulnogram.org/CVE-2026-105035 https://vulnogram.org/CVE-2026-105035 The EnergizeLab FirmwareUpdater (AArch64 ELF, distributed in the CDN bin.zip) uses a single hard-coded AES key shared by all installations. An attacker who recovers the key from the updater can decrypt and forge firmware packages for any device that… High Thu, 15 Oct 2026 20:42:53 GMT https://vulnogram.org/CVE-2026-105034 https://vulnogram.org/CVE-2026-105034 The EnergizeLab Eilik NestJS auth service issues device tokens for arbitrary robot serial numbers without authentication. An unauthenticated remote attacker can obtain a valid device token for any serial number and act as that device against the clou… High Network Exploitable Thu, 15 Oct 2026 20:42:42 GMT https://vulnogram.org/CVE-2026-105033 https://vulnogram.org/CVE-2026-105033 The EnergizeLab AI Station (RK3562) firmware image ships with default root credentials and SSH enabled. An attacker with network access to the device can log in as root and take full control of it. High Thu, 15 Oct 2026 20:42:34 GMT https://vulnogram.org/CVE-2026-105032 https://vulnogram.org/CVE-2026-105032 The EnergizeLab Eilik and EilikO AI skill upload endpoint, served by the FastAPI AI inference and profiling services, does not require authentication and does not constrain uploaded file paths. An unauthenticated remote attacker can use path traversa… Critical Network Exploitable Thu, 15 Oct 2026 20:42:04 GMT https://vulnogram.org/CVE-2026-14765 https://vulnogram.org/CVE-2026-14765 Epic Games Unreal Engine versions up to and including 5.8.0 ship with an insecure default configuration for the LaunchURL Blueprint node (UKismetSystemLibrary::LaunchURL). The URL scheme filter (FURLRequestFilter) is empty by default, which permits a… High Wed, 14 Oct 2026 02:31:08 GMT https://vulnogram.org/CVE-2026-7574 https://vulnogram.org/CVE-2026-7574 Anthropic Claude Desktop Cowork VM image handling (confirmed across v1.1348.0 through v1.2278.0, including v1.1348.0, v1.1617.0, and v1.2278.0) validates only file presence and a version marker string before booting rootfs.img, but does not verify im… High Tue, 23 Jun 2026 23:54:21 GMT https://vulnogram.org/CVE-2026-7415 https://vulnogram.org/CVE-2026-7415 The MQTT broker embedded in Yarbo firmware v2.3.9 is configured to allow anonymous connections with no topic-level read or write ACLs. Any host on the same network can subscribe to sensitive telemetry topics or publish control messages directly to th… Critical Network Exploitable Thu, 07 May 2026 16:11:16 GMT https://vulnogram.org/CVE-2026-7414 https://vulnogram.org/CVE-2026-7414 Yarbo firmware v2.3.9 contains hardcoded administrative credentials embedded in the firmware image. These credentials are identical across all devices running this firmware and cannot be changed or removed by end users, enabling trivial unauthorized… Critical Network Exploitable Thu, 07 May 2026 16:10:02 GMT https://vulnogram.org/CVE-2026-7413 https://vulnogram.org/CVE-2026-7413 A hidden, persistent backdoor was found in Yarbo firmware v2.3.9 that provides remote, unauthenticated (or weakly authenticated) access to privileged functionality. The backdoor is undocumented, cannot be disabled via user-facing settings, and surviv… High Thu, 07 May 2026 16:09:26 GMT https://vulnogram.org/CVE-2026-4946 https://vulnogram.org/CVE-2026-4946 Ghidra versions prior to 12.0.3 improperly process annotation directives embedded in automatically extracted binary data, resulting in arbitrary command execution when an analyst interacts with the UI. Specifically, the @execute annotation (which is… High Network Exploitable Sun, 29 Mar 2026 19:35:30 GMT https://vulnogram.org/CVE-2026-1442 https://vulnogram.org/CVE-2026-1442 Since the encryption algorithm used to protect firmware updates is itself encrypted using key material available to an attacker (or anyone paying attention), the firmware updates may be altered by an unauthorized user, and then trusted by a Unitree p… High Fri, 27 Feb 2026 04:28:46 GMT https://vulnogram.org/CVE-2025-35028 https://vulnogram.org/CVE-2025-35028 By providing a command-line argument starting with a semi-colon ; to an API endpoint created by the EnhancedCommandExecutor class of the HexStrike AI MCP server, the resultant composed command is executed directly in the context of the MCP server’s n… Critical Network Exploitable Sun, 30 Nov 2025 21:27:56 GMT https://vulnogram.org/CVE-2025-35021 https://vulnogram.org/CVE-2025-35021 By failing to authenticate three times to an unconfigured Abilis CPX device via SSH, an attacker can login to a restricted shell on the fourth attempt, and from there, relay connections. Medium Network Exploitable Tue, 04 Nov 2025 00:23:23 GMT https://vulnogram.org/CVE-2025-35027 https://vulnogram.org/CVE-2025-35027 Multiple robotic products by Unitree sharing a common firmware, including the Go2, G1, H1, and B2 devices, contain a command injection vulnerability. By setting a malicious string when configuring the on-board WiFi via a BLE module of an affected rob… High Fri, 26 Sep 2025 06:53:49 GMT https://vulnogram.org/CVE-2025-8452 https://vulnogram.org/CVE-2025-8452 By using the "uscan" protocol provided by the eSCL specification, an attacker can discover the serial number of multi-function printers that implement the Brother-provided firmware. This serial number can, in turn, can be leveraged by the flaw descri… Medium Tue, 12 Aug 2025 15:23:00 GMT https://vulnogram.org/CVE-2025-35010 https://vulnogram.org/CVE-2025-35010 Products that incorporate the Microhard BulletLTE-NA2 and IPn4Gii-NA2 are vulnerable to a post-authentication command injection issue in the AT+MNPINGTM command that can lead to privilege escalation. This is an instance of CWE-88, "Improper Neutraliz… High Sun, 08 Jun 2025 21:06:16 GMT https://vulnogram.org/CVE-2025-35009 https://vulnogram.org/CVE-2025-35009 Products that incorporate the Microhard BulletLTE-NA2 and IPn4Gii-NA2 are vulnerable to a post-authentication command injection issue in the AT+MNNETSP command that can lead to privilege escalation. This is an instance of CWE-88, "Improper Neutraliza… High Sun, 08 Jun 2025 21:06:05 GMT https://vulnogram.org/CVE-2025-35008 https://vulnogram.org/CVE-2025-35008 Products that incorporate the Microhard BulletLTE-NA2 and IPn4Gii-NA2 are vulnerable to a post-authentication command injection issue in the AT+MMNAME command that can lead to privilege escalation. This is an instance of CWE-88, "Improper Neutralizat… High Sun, 08 Jun 2025 21:05:52 GMT https://vulnogram.org/CVE-2025-35007 https://vulnogram.org/CVE-2025-35007 Products that incorporate the Microhard BulletLTE-NA2 and IPn4Gii-NA2 are vulnerable to a post-authentication command injection issue in the AT+MFRULE command that can lead to privilege escalation. This is an instance of CWE-88, "Improper Neutralizat… High Sun, 08 Jun 2025 21:05:38 GMT https://vulnogram.org/CVE-2025-35006 https://vulnogram.org/CVE-2025-35006 Products that incorporate the Microhard BulletLTE-NA2 and IPn4Gii-NA2 are vulnerable to a post-authentication command injection issue in the AT+MFPORTFWD command that can lead to privilege escalation. This is an instance of CWE-88, "Improper Neutrali… High Sun, 08 Jun 2025 21:05:25 GMT https://vulnogram.org/CVE-2025-35005 https://vulnogram.org/CVE-2025-35005 Products that incorporate the Microhard BulletLTE-NA2 and IPn4Gii-NA2 are vulnerable to a post-authentication command injection issue in the AT+MFMAC command that can lead to privilege escalation. This is an instance of CWE-88, "Improper Neutralizati… High Sun, 08 Jun 2025 21:05:15 GMT https://vulnogram.org/CVE-2025-35004 https://vulnogram.org/CVE-2025-35004 Products that incorporate the Microhard BulletLTE-NA2 and IPn4Gii-NA2 are vulnerable to a post-authentication command injection issue in the AT+MFIP command that can lead to privilege escalation. This is an instance of CWE-88, "Improper Neutralizatio… High Sun, 08 Jun 2025 21:05:01 GMT https://vulnogram.org/CVE-2025-32459 https://vulnogram.org/CVE-2025-32459 The Quantenna Wi-Fi chipset ships with a local control script, router_command.sh (in the sync_time argument), that is vulnerable to command injection. This is an instance of CWE-88, "Improper Neutralization of Argument Delimiters in a Command ('Argum… High Sun, 08 Jun 2025 21:04:25 GMT https://vulnogram.org/CVE-2025-32458 https://vulnogram.org/CVE-2025-32458 The Quantenna Wi-Fi chipset ships with a local control script, router_command.sh (in the get_syslog_from_qtn argument), that is vulnerable to command injection. This is an instance of CWE-88, "Improper Neutralization of Argument Delimiters in a Comma… High Sun, 08 Jun 2025 21:04:12 GMT https://vulnogram.org/CVE-2025-32457 https://vulnogram.org/CVE-2025-32457 The Quantenna Wi-Fi chipset ships with a local control script, router_command.sh (in the get_file_from_qtn argument), that is vulnerable to command injection. This is an instance of CWE-88, "Improper Neutralization of Argument Delimiters in a Command… High Sun, 08 Jun 2025 21:03:24 GMT https://vulnogram.org/CVE-2025-32456 https://vulnogram.org/CVE-2025-32456 The Quantenna Wi-Fi chipset ships with a local control script, router_command.sh (in the put_file_to_qtn argument), that is vulnerable to command injection. This is an instance of CWE-88, "Improper Neutralization of Argument Delimiters in a Command (… High Sun, 08 Jun 2025 21:03:12 GMT https://vulnogram.org/CVE-2025-32455 https://vulnogram.org/CVE-2025-32455 The Quantenna Wi-Fi chipset ships with a local control script, router_command.sh (in the run_cmd argument), that is vulnerable to command injection. This is an instance of CWE-88, "Improper Neutralization of Argument Delimiters in a Command ('Argumen… High Sun, 08 Jun 2025 21:02:58 GMT https://vulnogram.org/CVE-2025-3461 https://vulnogram.org/CVE-2025-3461 The Quantenna Wi-Fi chips ship with an unauthenticated telnet interface by default. This is an instance of CWE-306, "Missing Authentication for Critical Function," and is estimated as a CVSS 9.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N). This is… Critical Network Exploitable Sun, 08 Jun 2025 21:02:37 GMT https://vulnogram.org/CVE-2025-3460 https://vulnogram.org/CVE-2025-3460 The Quantenna Wi-Fi chipset ships with a local control script, set_tx_pow, that is vulnerable to command injection. This is an instance of CWE-88, "Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')," and is estimated… High Sun, 08 Jun 2025 21:02:24 GMT https://vulnogram.org/CVE-2025-3459 https://vulnogram.org/CVE-2025-3459 The Quantenna Wi-Fi chipset ships with a local control script, transmit_file, that is vulnerable to command injection. This is an instance of CWE-88, "Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')," and is estimat… High Sun, 08 Jun 2025 21:02:09 GMT https://vulnogram.org/CVE-2025-2894 https://vulnogram.org/CVE-2025-2894 The Go1 also known as "The World's First Intelligence Bionic Quadruped Robot Companion of Consumer Level," contains an undocumented backdoor that can enable the manufacturer, and anyone in possession of the correct API key, complete remote control ov… Medium Fri, 28 Mar 2025 02:51:19 GMT https://vulnogram.org/CVE-2024-4224 https://vulnogram.org/CVE-2024-4224 An authenticated stored cross-site scripting (XSS) exists in the TP-Link TL-SG1016DE affecting version TL-SG1016DE(UN) V7.6_1.0.0 Build 20230616, which could allow an adversary to run JavaScript in an administrator's browser. This issue was fixed in… Medium Mon, 15 Jul 2024 20:34:53 GMT https://vulnogram.org/CVE-2024-2056 https://vulnogram.org/CVE-2024-2056 Services that are running and bound to the loopback interface on the Artica Proxy are accessible through the proxy service. In particular, the "tailon" service is running, running as the root user, is bound to the loopback interface, and is listening… Critical Network Exploitable Tue, 05 Mar 2024 18:57:03 GMT https://vulnogram.org/CVE-2024-2055 https://vulnogram.org/CVE-2024-2055 The "Rich Filemanager" feature of Artica Proxy provides a web-based interface for file management capabilities. When the feature is enabled, it does not require authentication by default, and runs as the root user. Critical Network Exploitable Tue, 05 Mar 2024 18:56:33 GMT https://vulnogram.org/CVE-2024-2054 https://vulnogram.org/CVE-2024-2054 The Artica-Proxy administrative web application will deserialize arbitrary PHP objects supplied by unauthenticated users and subsequently enable code execution as the "www-data" user. Critical Network Exploitable Tue, 05 Mar 2024 18:56:22 GMT https://vulnogram.org/CVE-2024-2053 https://vulnogram.org/CVE-2024-2053 The Artica Proxy administrative web application will deserialize arbitrary PHP objects supplied by unauthenticated users and subsequently enable code execution as the "www-data" user. This issue was demonstrated on version 4.50 of the The Artica-Prox… High Network Exploitable Tue, 05 Mar 2024 18:56:10 GMT https://vulnogram.org/CVE-2023-5841 https://vulnogram.org/CVE-2023-5841 Due to a failure in validating the number of scanline samples of a OpenEXR file containing deep scanline data, Academy Software Foundation OpenEX image parsing library version 3.2.1 and prior is susceptible to a heap-based buffer overflow vulnerabili… Critical Network Exploitable Thu, 01 Feb 2024 18:28:05 GMT https://vulnogram.org/CVE-2023-4504 https://vulnogram.org/CVE-2023-4504 Due to failure in validating the length provided by an attacker-crafted PPD PostScript document, CUPS and libppd are susceptible to a heap-based buffer overflow and possibly code execution. This issue has been fixed in CUPS version 2.4.7, released in… High Thu, 21 Sep 2023 22:47:41 GMT https://vulnogram.org/CVE-2023-2906 https://vulnogram.org/CVE-2023-2906 Due to a failure in validating the length provided by an attacker-crafted CP2179 packet, Wireshark versions 2.0.0 through 4.0.7 is susceptible to a divide by zero allowing for a denial of service attack. Fri, 25 Aug 2023 20:41:19 GMT https://vulnogram.org/CVE-2023-2905 https://vulnogram.org/CVE-2023-2905 Due to a failure in validating the length of a provided MQTT_CMD_PUBLISH parsed message with a variable length header, Cesanta Mongoose, an embeddable web server, version 7.10 is susceptible to a heap-based buffer overflow vulnerability in the defaul… Wed, 09 Aug 2023 04:46:14 GMT https://vulnogram.org/CVE-2023-0667 https://vulnogram.org/CVE-2023-0667 Due to failure in validating the length provided by an attacker-crafted MSMMS packet, Wireshark version 4.0.5 and prior, in an unusual configuration, is susceptible to a heap-based buffer overflow, and possibly code execution in the context of the pr… Medium Network Exploitable Wed, 07 Jun 2023 02:38:07 GMT https://vulnogram.org/CVE-2023-0668 https://vulnogram.org/CVE-2023-0668 Due to failure in validating the length provided by an attacker-crafted IEEE-C37.118 packet, Wireshark version 4.0.5 and prior, by default, is susceptible to a heap-based buffer overflow, and possibly code execution in the context of the process runn… Medium Network Exploitable Wed, 07 Jun 2023 02:32:45 GMT https://vulnogram.org/CVE-2023-0666 https://vulnogram.org/CVE-2023-0666 Due to failure in validating the length provided by an attacker-crafted RTPS packet, Wireshark version 4.0.5 and prior, by default, is susceptible to a heap-based buffer overflow, and possibly code execution in the context of the process running Wire… Medium Network Exploitable Wed, 07 Jun 2023 02:25:27 GMT