A vulnerability was detected in Unitree Robotics Unitree Go2 up to 1.1.13/1.1.14.1/1.1.15.1. This affects the function WebSocketClient.connect of the file websocket.py of the component chat_go. Performing a manipulation results in improper certificate validation. The attack may be initiated remotely. The attack's complexity is rated as high. The exploitability is reported as difficult. The vendor confirmed early: "These issues were previously submitted by the researcher through our Security Response Center platform and are tracked internally as follows: Submission 990504 corresponds to our internal ticket #616 (Go2 chat_go WSS client disabled TLS server certificate validation, CWE-295)."
A security vulnerability has been detected in Unitree Robotics Unitree Go2 up to 1.1.11.4. The impacted element is the function set_volume of the file gpt_thread.py of the component chat_go. Such manipulation of the argument Value leads to os command injection. The attack can be launched remotely. Upgrading to version 1.1.11.5 is sufficient to resolve this issue. You should upgrade the affected component. The vendor confirmed early: "Submission 990502 corresponds to our internal ticket #474 (Go2 chat_go set_volume OS command injection, CWE-78)."
A vulnerability was detected in phpIPAM up to 1.8.3. Affected by this issue is the function create_rack_link of the file app/tools/racks/show-rack-popup.php of the component Rack Link Creation. Performing a manipulation of the argument deviceid results in cross site scripting. Remote exploitation of the attack is possible. The exploit is now public and may be used. The vendor was contacted early about this disclosure.
CVE-2026-115981 is a cross-site scripting (XSS) vulnerability in phpIPAM versions 1.8.0 through 1.8.3. It involves manipulation of the REQUEST_URI argument in the upgrade/index.php file, allowing remote attackers to execute script code. The vulnerability has a medium severity rating with a CVSS score of 4.8. Public exploit code has been disclosed, but no known active exploitation in the wild is reported. The vendor was notified early about this issue.
This content discusses the cybersecurity strategy of reducing the attack surface by minimizing unnecessary technology complexity within enterprise environments. It highlights recent high-severity PHP vulnerabilities that prompted urgent advisories and temporary website shutdowns, illustrating challenges in identifying and patching embedded vulnerable components. The article emphasizes that many enterprises accumulate redundant applications and dependencies over time, increasing security obligations without proportional business value. Reducing unnecessary software and infrastructure can lower risk and improve security sustainability.
This content describes a free, read-only bash script designed to triage WordPress sites for signs of compromise related to the PHP2Shell vulnerabilities (CVE-2026-109618, CVE-2026-109619) and a third CVE-2026-115560. The script checks PHP versions, WordPress core and plugin integrity, suspicious PHP files in uploads, recent file modifications, common web-shell patterns, user accounts, cron jobs, logs, Docker containers, and configuration settings relevant to the vulnerabilities. It generates detailed Markdown reports without modifying the target systems. The PHP2Shell vulnerabilities are critical remote code execution bugs patched in PHP releases 8.2.35, 8.3.36, 8.4.27, and 8.5.12, but the third CVE has no fixed build yet, with a recommended mitigation of setting session.upload_progress.enabled=0. The script helps detect potential backdoors planted before patching, as updating PHP alone does not remove them.
Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JSSE). Supported versions that are affected are Oracle Java SE: 8u511-b32, 8u511-perf-b32, 11.0.33.0.2, 17.0.21.0.2, 21.0.13.0.2, 25.0.5.0.2, 27.0.1.0.2; Oracle GraalVM for JDK: 17.0.21.0.2 and 21.0.13.0.2; Oracle GraalVM Enterprise Edition: 21.3.20.0.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data as well as unauthorized access to critical data or complete access to all Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 9.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N).
CVE-2026-115973 is a medium severity vulnerability in FaveoSuite Faveo Helpdesk version 2.0.3 affecting the password recovery functionality. The issue lies in the ForgotPasswordController::sendResetLinkEmail and PasswordController::reset functions, which allow weak password recovery mechanisms. This vulnerability can be exploited remotely without authentication and may lead to compromised account recovery processes.
A vulnerability was determined in FaveoSuite Faveo Helpdesk up to 2.0.3. Affected by this vulnerability is the function UnAuthController.changeStatus/UnAuthController.close/UnAuthController.open/UnAuthController.resolve of the file app/Http/Controllers/Client/helpdesk/UnAuthController.php. Executing a manipulation of the argument id/status can lead to missing authorization. The attack can be launched remotely. The vendor was contacted early about this disclosure.
A vulnerability was found in Travisun Opptrix 0.4.0. Affected is the function Buffer.concat of the file /api/channels/webhook/ of the component preParsing handler. Performing a manipulation results in denial of service. The attack can be initiated remotely. The exploit has been made public and could be used. The project has been completely taken offline and deprecated. The project maintainer explains: "The mentioned security risk was a design flaw that manifested primarily in local environments during earlier stages of version development. We previously addressed and resolved this specific risk; however, because the project was restricted to a small learning scope and the main versions were intended to run exclusively on localhost, the security fix was only pushed directly to our GitHub repository before it went private." This vulnerability only affects products that are no longer supported by the maintainer.
A vulnerability has been found in Travisun Opptrix 0.4.0. This impacts an unknown function of the file /api/system-update/import of the component Import Endpoint. Such manipulation leads to code injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The project has been completely taken offline and deprecated. The project maintainer explains: "The mentioned security risk was a design flaw that manifested primarily in local environments during earlier stages of version development. We previously addressed and resolved this specific risk; however, because the project was restricted to a small learning scope and the main versions were intended to run exclusively on localhost, the security fix was only pushed directly to our GitHub repository before it went private." This vulnerability only affects products that are no longer supported by the maintainer.
A flaw has been found in Travisun Opptrix 0.4.0. This affects an unknown function of the file /api/auth/setup of the component Schedule API. This manipulation causes command injection. It is possible to initiate the attack remotely. The exploit has been published and may be used. The project has been completely taken offline and deprecated. The project maintainer explains: "The mentioned security risk was a design flaw that manifested primarily in local environments during earlier stages of version development. We previously addressed and resolved this specific risk; however, because the project was restricted to a small learning scope and the main versions were intended to run exclusively on localhost, the security fix was only pushed directly to our GitHub repository before it went private." This vulnerability only affects products that are no longer supported by the maintainer.
Cisco is investigating the impact of an emergency distrust of eMudhra root and intermediate certificate authorities on its product line. The advisory lists numerous Cisco products under active investigation to determine if they are affected. As of now, no specific affected versions or confirmed vulnerabilities have been identified. Cisco will update the advisory as the investigation progresses.
CVE-2026-101896 is a high-severity vulnerability in the @angular/router URL parser affecting server-side rendering (SSR) in Node.js environments. Prior to fixed versions 20.3.32, 21.2.24, and 22.2.0, the router stores numeric matrix parameter names and numeric outlet names as properties on JavaScript objects. This can cause V8 to allocate large dense arrays, leading to excessive heap consumption. An unauthenticated attacker can exploit this by sending crafted requests with repeated numeric parameters, exhausting the Node.js heap and terminating the SSR worker. Pure client-side Angular applications are not affected. The issue is fixed in the specified versions.
Krayin CRM version 2.2.4 is affected by an Insecure Direct Object Reference (IDOR) vulnerability. This vulnerability allows unauthorized attackers to bypass authentication and configure administrative settings via a specific API endpoint. Exploit code is publicly available demonstrating how to create an admin user without proper authorization.
A path traversal vulnerability affects WordPress version 7.0.2 and version 7.0.6, as well as versions prior to 7.1.2. This vulnerability could allow an attacker to access files outside the intended directory structure.
A remote code execution (RCE) vulnerability identified as CVE-2026-86060 affects MikroTik RouterOS versions 7.0 up to but not including 7.23.4, and versions 7.24.0 up to but not including 7.24.2. Exploit code leveraging this vulnerability is publicly available, involving MikroTik CHR 7.23.3 (x86_64) and Python3-paramiko on Kali Linux 2025.x. No official patch or vendor advisory details are provided.
CVE-2026-80428 is a critical unauthenticated PHP Object Injection vulnerability in ILIAS software versions prior to 9.22, between 10.0 and 10.10, and between 11.0 and 11.3. The flaw involves the Shibboleth integration and allows remote code execution (RCE) without authentication.
FreePBX version 17.0.2 is affected by a remote code execution (RCE) vulnerability. This flaw allows an attacker to execute arbitrary code on the affected system remotely. The vulnerability is critical in severity and affects Linux systems running Debian or Ubuntu with Asterisk. No specific affected sub-versions or patch information is provided.
Marimo version 0.20.4 is associated with a remote code execution (RCE) vulnerability identified as CVE-2026-39987. The available information is limited, with no detailed technical data or patch information provided.