Veille CVE

Semaine du 12 octobre au 18 octobre 2026

2 CVE

Critique 2 Élevée 0 Moyenne 0 Faible 0 Non évaluée 0 Exploitées (KEV) Tri : plus récentes « EnergizeLab station-middleware » ✕
  1. CVE-2026-105039 9.6 Critique

    EnergizeLab station-middleware

    EnergizeLab station-middleware (NestJS) Docker images 1.6.5 through 1.8.2 do not check user roles on administrative APIs. Any authenticated low-privilege user can retrieve AI provider keys and change configuration and object-store contents.

  2. CVE-2026-105037 9.9 Critique

    EnergizeLab station-middleware

    EnergizeLab station-middleware (NestJS) Docker images 1.6.5 through 1.8.2 allow any registered, low-privilege account to read arbitrary files from the server by supplying an attacker-controlled file path. This exposes middleware files and server secrets.