CVE-2026-105013

HighCVSS 7.4/10Last modified Oct 14, 2026

Description

Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.

Metrics

CVSS 3.1 7.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L

Weakness enumeration

CWE-502

Affected software

No affected versions have been published.

Timeline

Published
Oct 13, 2026
Last modified
Oct 14, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-1050149.1Improper neutralization of special elements used in a command ('command injection') in Azure Pipelines allows an unauthorized attacker to exCVE-2026-1050169.8Heap-based buffer overflow in Microsoft QUIC allows an unauthorized attacker to execute code over a network.CVE-2026-1050294.3UVdesk support-center-bundle before 1.1.3.3 contains an insecure direct object reference vulnerability in the rateTicket action of ControlleCVE-2026-1050305.3Kener 4.0.0 before 4.1.6 contains an information disclosure vulnerability that allows unauthenticated attackers to retrieve hidden or inactiCVE-2026-1050329.1The EnergizeLab Eilik and EilikO AI skill upload endpoint, served by the FastAPI AI inference and profiling services, does not require autheCVE-2026-1050338.8The EnergizeLab AI Station (RK3562) firmware image ships with default root credentials and SSH enabled. An attacker with network access to tCVE-2026-1050348.2The EnergizeLab Eilik NestJS auth service issues device tokens for arbitrary robot serial numbers without authentication. An unauthenticatedCVE-2026-1050357.8The EnergizeLab FirmwareUpdater (AArch64 ELF, distributed in the CDN bin.zip) uses a single hard-coded AES key shared by all installations. CVE-2026-1050367.5EnergizeLab AI Station firmware, EilikO Linux robot firmware v2.1_20260617182218_release, and the EnergizeLab Windows desktop app 3.1.2 downCVE-2026-1050379.9EnergizeLab station-middleware (NestJS) Docker images 1.6.5 through 1.8.2 allow any registered, low-privilege account to read arbitrary fileCVE-2026-1050389.8The EnergizeLab Eilik and EilikO FastAPI AI inference and profiling services expose AI model administration functions without authenticationCVE-2026-1050399.6EnergizeLab station-middleware (NestJS) Docker images 1.6.5 through 1.8.2 do not check user roles on administrative APIs. Any authenticated
CVE-2026-105013: High severity, CVSS 7.4 | Vulnix