Vulnerabilities
Summary — last 7 days
New vulnerabilities3,517▼ 1,240 vs. last week
Critical / high1,375▼ 1,336 vs. last week
New active exploitation (KEV)13▲ 6 vs. last week
Unscored (no CVSS)692▲ 632 vs. last week
More filters
6 results, sorted by published date (most recent first)
| CVE | Status | Severity | EPSS | Active exploitation | Affected technologies | Published ▼ | Modified | Description |
|---|---|---|---|---|---|---|---|---|
| Deferred | High (7.5) | 0.24% | — | Energizelab AI StationAIEiliko LinuxAIEnergizelab Desktop APPAI | 10/15/2026 | 10/16/2026 | EnergizeLab AI Station firmware, EilikO Linux robot firmware v2.1_20260617182218_release, and the EnergizeLab Windows desktop app 3.1.2 download firmware updates over plain HTTP and do not verify their integrity or authenticity. An attacker able to intercept or modify the traffic can substitute a malicious update. | |
| Deferred | High (8.8) | 0.35% | — | Energizelab AI StationAI | 10/15/2026 | 10/16/2026 | The EnergizeLab AI Station (RK3562) firmware image ships with default root credentials and SSH enabled. An attacker with network access to the device can log in as root and take full control of it. | |
| Modified | Medium (6.1) | 0.78% | — | Buffalo Airstation Whr-g54s Firmware | 9/18/2020 | 6/17/2026 | Cross-site scripting vulnerability in WHR-G54S firmware 1.43 and earlier allows remote attackers to inject arbitrary script via a specially crafted page. | |
| Modified | Medium (4.3) | 1.1% | — | Buffalo Airstation Whr-g54s Firmware | 9/18/2020 | 6/17/2026 | Directory traversal vulnerability in WHR-G54S firmware 1.43 and earlier allows an attacker to access sensitive information such as setting values via unspecified vectors. | |
| Modified | Medium (6.8) | 1.1% | — | Buffalotech Airstation Extreme N600 FirmwareBuffalotech Airstation Extreme N600 | 12/27/2015 | 6/17/2026 | Buffalo WZR-600DHP2 devices with firmware 2.09, 2.13, and 2.16 use an improper algorithm for selecting the ID value in the header of a DNS query, which makes it easier for remote attackers to spoof responses by predicting this value. | |
| Modified | Medium (4.3) | 0.66% | — | Buffalotech Airstation Whr-g54s | 9/11/2007 | 6/16/2026 | Cross-site request forgery (CSRF) vulnerability in the device management interface in Buffalo AirStation WHR-G54S 1.20 allows remote attackers to make configuration changes as an administrator via HTTP requests to certain HTML pages in the res parameter with an inp req parameter to cgi-bin/cgi, as demonstrated by… |