EUVD-2026-109308

A vulnerability has been found in Travisun Opptrix 0.4.0. This impacts an unknown function of the file /api/system-update/import of the component Import Endpoint. Such manipulation leads to code injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public...

EUVD-2026-109309

A vulnerability was found in Travisun Opptrix 0.4.0. Affected is the function Buffer.concat of the file /api/channels/webhook/ of the component preParsing handler. Performing a manipulation results in denial of service. The attack can be initiated remotely. The exploit has been made public and...

EUVD-2026-109306

A flaw has been found in Travisun Opptrix 0.4.0. This affects an unknown function of the file /api/auth/setup of the component Schedule API. This manipulation causes command injection. It is possible to initiate the attack remotely. The exploit has been published and may be used. The project has...

CVE-2026-115971

A vulnerability in Travisun Opptrix 0.4.0 allows for a remote denial of service (DoS) via the Buffer.concat function located in the /api/channels/webhook/ file of the preParsing handler component. The root cause is a design flaw that primarily affected local environments during early development....

CVE-2026-115970

A code injection vulnerability exists in Travisun Opptrix 0.4.0 within the Import Endpoint component, specifically affecting an unknown function of the file /api/system-update/import. This flaw allows for remote code injection . While the maintainer stated the risk was a design flaw primarily for...

CVE-2026-115969 Travisun Opptrix Schedule API setup command injection

A flaw has been found in Travisun Opptrix 0.4.0. This affects an unknown function of the file /api/auth/setup of the component Schedule API. This manipulation causes command injection. It is possible to initiate the attack remotely. The exploit has been published and may be used. The project has...

CVE-2026-115969

A command injection vulnerability exists in Travisun Opptrix version 0.4.0 within the Schedule API component, specifically affecting an unknown function in the /api/auth/setup file. The flaw allows for remote execution of commands. Although a fix was developed, it was only pushed to a private rep...