193394 matches found
EUVD-2026-109321
A security vulnerability has been detected in Unitree Robotics Unitree Go2 up to 1.1.11.4. The impacted element is the function setvolume of the file gptthread.py of the component chatgo. Such manipulation of the argument Value leads to os command injection. The attack can be launched remotely...
CVE-2026-115995 Unitree Robotics Unitree Go2 chat_go gpt_thread.py set_volume os command injection
A security vulnerability has been detected in Unitree Robotics Unitree Go2 up to 1.1.11.4. The impacted element is the function setvolume of the file gptthread.py of the component chatgo. Such manipulation of the argument Value leads to os command injection. The attack can be launched remotely...
CVE-2026-115995
A critical OS command injection vulnerability exists in the Unitree Robotics Unitree Go2 (versions up to 1.1.11.4 ) within the chat_go component. The flaw is located in the set_volume function of the gpt_thread.py file, where improper neutralization of the Value argument allows an attacker to exe...
jebsec-security-advisories
JebSec Security Advisories Security advisories published by C...
CLSA-2026-1792803646 vim: Fix of 3 CVEs
CVE-2026-73073: fix command injection via a crafted typename in ccomplete.vim omni completion upstream 9.2.0845 - CVE-2026-43961: fix command injection via a crafted filename in netrw marked-file handling upstream 9.2.0480 - CVE-2026-47167: fix Ruby code execution via a crafted pattern in the...
CVE-2026-115969
A flaw has been found in Travisun Opptrix 0.4.0. This affects an unknown function of the file /api/auth/setup of the component Schedule API. This manipulation causes command injection. It is possible to initiate the attack remotely. The exploit has been published and may be used. The project has...
CVE-2026-115969 Travisun Opptrix Schedule API setup command injection
A flaw has been found in Travisun Opptrix 0.4.0. This affects an unknown function of the file /api/auth/setup of the component Schedule API. This manipulation causes command injection. It is possible to initiate the attack remotely. The exploit has been published and may be used. The project has...
EUVD-2026-109306
A flaw has been found in Travisun Opptrix 0.4.0. This affects an unknown function of the file /api/auth/setup of the component Schedule API. This manipulation causes command injection. It is possible to initiate the attack remotely. The exploit has been published and may be used. The project has...
CVE-2026-115969
A command injection vulnerability exists in Travisun Opptrix version 0.4.0 within the Schedule API component, specifically affecting an unknown function in the /api/auth/setup file. The flaw allows for remote execution of commands. Although a fix was developed, it was only pushed to a private rep...
CVE-2026-115969 Travisun Opptrix Schedule API setup command injection
A flaw has been found in Travisun Opptrix 0.4.0. This affects an unknown function of the file /api/auth/setup of the component Schedule API. This manipulation causes command injection. It is possible to initiate the attack remotely. The exploit has been published and may be used. The project has...
php2shell-stx-research-pub
PHP2Shell STX Research I have been testing the PHP memory saf...
CISA Flags Two Actively Exploited Critical Flaws in Collabora Online and Arista VeloCloud
The U.S. Cybersecurity and Infrastructure Security Agency CISA on Friday added two vulnerabilities impacting Collabora Online Built-in CODE Server and Arista VeloCloud Orchestrator VCO to its Known Exploited Vulnerabilities KEV, citing reports of active exploitation in the wild. The...
CLSA-2026-1792807762 vim: Fix of 3 CVEs
CVE-2026-73073: fix command injection via a crafted typename in ccomplete.vim omni completion upstream 9.2.0845 - CVE-2026-43961: fix command injection via a crafted filename in netrw marked-file handling upstream 9.2.0480 - CVE-2026-47167: fix Ruby code execution via a crafted pattern in the...
Important: lrzsz
Issue Overview: lrzsz before 0.13.0 contains an OS command injection vulnerability in the lrz receive utility's pipe mode that allows remote senders to execute commands by supplying crafted filenames. When lrz runs under a suffixed name such as lrztar, procheader in src/lrz.c passes the unescaped...
Amazon Linux 2 : lrzsz (ALAS-2026-4031)
The version of lrzsz installed on the remote host is prior to 0.12.20-36. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2026-4031 advisory. lrzsz before 0.13.0 contains an OS command injection vulnerability in the lrz receive utility's pipe mode that allows remote sende...
VulnCheck KEV: CVE-2024-8517
SPIP before 4.3.2, 4.2.16, and 4.1.18 is vulnerable to a command injection issue. A remote and unauthenticated attacker can execute arbitrary operating system commands by sending a crafted multipart file upload HTTP request...
Unitree Robotics Unitree Go2 command injection vulnerability
Unitree Robotics Unitree Go2 versions 1.1.11.4 and earlier contain a command injection vulnerability. This vulnerability stems from improper handling of the Value parameter in the setvolume function within the chatgo component’s gptthread.py file, potentially allowing remote execution of OS...
PT-2026-122668
Name of the Vulnerable Software and Affected Versions Unitree Robotics Unitree Go2 versions prior to 1.1.11.5 Description An OS command injection flaw exists in the chat go component. A remote attacker can execute arbitrary operating system commands by manipulating the Value argument within the s...
Travis Un Optrix input validation error vulnerability
Travis Un Optrix version 0.4.0 contains a security vulnerability. This vulnerability stems from an unknown function in the file /api/auth/setup within the Schedule API component, which allows command injection. It may enable remote attackers to execute arbitrary commands...
Linux Distros Unpatched Vulnerability : CVE-2026-115774
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Twisted is an event-based framework for internet applications, supporting Python 3.6+. Prior to 26.10.0rc1, twisted.mail.imap4.IMAP4Server reaches...