EnergizeLab station-middleware (NestJS) Docker images 1.6.5 through 1.8.2 allow any registered, low-privilege

EnergizeLab station-middleware (NestJS) Docker images 1.6.5 through 1.8.2 allow any registered, low-privilege account to read arbitrary files from the server by supplying an attacker-controlled file p

CVSS 9.9

The EnergizeLab Eilik and EilikO FastAPI AI inference and profiling services expose AI model administration fu

The EnergizeLab Eilik and EilikO FastAPI AI inference and profiling services expose AI model administration functions without authentication. An unauthenticated remote attacker can change AI model con

CVSS 9.8

NetLicensing MCP Server is a natural-language interface that enables agentic applications to manage the softwa

NetLicensing MCP Server is a natural-language interface that enables agentic applications to manage the software-licensing lifecycle in Labs64 NetLicensing. Prior to 0.1.8, netlicensing_get_product pa

CVSS 9.6

EnergizeLab station-middleware (NestJS) Docker images 1.6.5 through 1.8.2 do not check user roles on administr

EnergizeLab station-middleware (NestJS) Docker images 1.6.5 through 1.8.2 do not check user roles on administrative APIs. Any authenticated low-privilege user can retrieve AI provider keys and change

CVSS 9.6

BMC Helix Network Management on-prem before 26.3.01 contains an authentication bypass vulnerability that allow

BMC Helix Network Management on-prem before 26.3.01 contains an authentication bypass vulnerability that allows unauthenticated attackers to log in as the local administrator with any password when SA

CVSS 9.5

An unauthenticated remote attacker can bypass authentication and gain full access to administrative API endpoi

An unauthenticated remote attacker can bypass authentication and gain full access to administrative API endpoints in Nutanix Prism Element by including a crafted internal management HTTP header. The v

CVSS 9.3

runwasi facilitates running Wasm and WASI workloads managed by containerd. Prior to 0.6.1, containerd-shim-was

runwasi facilitates running Wasm and WASI workloads managed by containerd. Prior to 0.6.1, containerd-shim-wasmtime-v1 can treat Wasmtime precompiled bytes supplied directly in an OCI image layer as a

CVSS 9.3

The vulnerability exists within internal components of BeyondTrust’s Remote Support product. The components di

The vulnerability exists within internal components of BeyondTrust’s Remote Support product. The components did not adequately validate the origin of the messages it received. Under the right conditio

CVSS 9.3

Jooan JA-A12 IP cameras with firmware 009_20171107 and 05.02.31.105 contain a remote code execution vulnerabil

Jooan JA-A12 IP cameras with firmware 009_20171107 and 05.02.31.105 contain a remote code execution vulnerability that allows unauthenticated attackers to run root commands via hard-coded credentials.

CVSS 9.3

Archon 0.2.13 through 0.11.1 contains a missing authentication vulnerability that allows unauthenticated attac

Archon 0.2.13 through 0.11.1 contains a missing authentication vulnerability that allows unauthenticated attackers to access the /api/* control API, which binds to 0.0.0.0 by default. Attackers with n

CVSS 9.3

JuggleIM im-server through 1.8.16 ships default administrator credentials admin/123456 that allow unauthentica

JuggleIM im-server through 1.8.16 ships default administrator credentials admin/123456 that allow unauthenticated remote attackers to access the admin console on port 8090. Attackers can log in as adm

CVSS 9.3

OpenHealth through 0.2.0 contains a missing authentication and authorization vulnerability in the /api/health-

OpenHealth through 0.2.0 contains a missing authentication and authorization vulnerability in the /api/health-data/[id] GET, PATCH and DELETE handlers that query records by id without session or autho

CVSS 9.2

joserfc is a Python library that provides an implementation of several JSON Object Signing and Encryption (JOS

joserfc is a Python library that provides an implementation of several JSON Object Signing and Encryption (JOSE) standards. Prior to 1.7.4, joserfc.jws.deserialize_json() accepts a JWS General JSON Se

CVSS 9.1

An authorization bypass vulnerability exists in the REST API of multiple versions of OpenNMS Meridian and Hori

An authorization bypass vulnerability exists in the REST API of multiple versions of OpenNMS Meridian and Horizon. The /rest/** Spring Security filter chains authorize requests with intercept-url rule

CVSS 9.1

Tianji is an open source analytics, uptime monitoring, and server status platform. Prior to 1.31.29, formatStr

Tianji is an open source analytics, uptime monitoring, and server status platform. Prior to 1.31.29, formatString() in src/server/utils/template.ts passes survey feedTemplate and monitor notification

CVSS 9.1