NI vulnerabilities and threats

CVE-2026-115995 is a critical OS command injection vulnerability in Unitree Robotics Unitree Go2 versions 1.1.11.0 through 1.1.11.4. The flaw exists in the set_volume function within the gpt_thread.py file of the chat_go component. This vulnerability allows remote attackers to execute arbitrary OS commands by manipulating the argument Value. The issue is resolved by upgrading to version 1.1.11.5.

Missing Authorization vulnerability in Knit Pay UPI QR Code Payment Gateway for WooCommerce upi-qr-code-payment-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects UPI QR Code Payment Gateway for WooCommerce: from n/a through 1.6.3.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Infomaniak Network VOD Infomaniak vod-infomaniak allows Stored XSS.This issue affects VOD Infomaniak: from n/a through 1.5.14.

The Prime Mover – Backup and Migration WordPress plugin (versions up to 2.2.1) is vulnerable to PHP Object Injection via unsafe deserialization of untrusted input stored in comment content. An unauthenticated attacker can submit a crafted base64-encoded serialized object through the comment submission endpoint, which is later unserialized without restrictions during plugin export or restore operations. This leads to a critical remote code execution risk without requiring additional plugins or themes.

A vulnerability was identified in UbiquitousLearning mllm up to 2.0.2. The affected element is the function load_model of the file pymllm/mobile/convertor/__init__.py of the component Convertor. The manipulation of the argument shard_file leads to path traversal. The attack needs to be performed locally. The exploit is publicly available and might be used. The project was informed of the problem early through an issue report but has not responded yet.

When used as an executor in either KNIME Server or KNIME Business Hub, KNIME Analytics Platform LTS versions before 5.8.4 log configured credentials of proxies during startup. An attacker with access to log files can steal the credentials and use the proxy as the user who configured the proxy settings. The issue has been fixed in LTS versions 5.8.4 and 5.12.0 and later.

CVE-2026-112821 is a missing authorization vulnerability in Knit Pay versions prior to 9.6.3.1. This flaw allows unauthorized access due to incorrectly configured access control security levels. The vulnerability has a medium severity with a CVSS score of 6.5. A fix is available in version 9.6.3.1.

KNIME Business Hub versions before 1.19.0 have a vulnerability where sensitive cookies used in HTTPS sessions lack the 'secure' attribute. This omission can allow an unauthenticated remote attacker to compromise user sessions if combined with other security issues like cross-site scripting or man-in-the-middle attacks. No workaround is available for this vulnerability.

CVE-2026-115517 is a vulnerability in KNIME Business Hub versions before 1.19.0 that allows unrestricted network access between execution contexts. An authenticated remote user can access open network ports on executors in different execution contexts if the attacked executor's IP address is known and ports are open without further authentication. By default, no network ports are open, but workflows may open ports, creating an attack surface. Manual network policies can mitigate this risk.

CVE-2026-93336 is a missing authorization vulnerability in Canonical Juju versions 4.0 through 4.0.15. It allows a controller-authenticated principal, such as a unit agent or a user with only login permission, to read any application's charm resource across any model. This includes sensitive data like container-registry credentials, accessible via a crafted request specifying an arbitrary unit.

A missing authorization check allows anyone having access to a "link without login" for a DataApp to list and potentially access jobs of other users created by the same link in KNIME Business Hub prior to 1.19.0. As workaround remove all "links without login" to DataApps.

Overly informative error messages in the catalog functionality of KNIME Business Hub prior to version 1.18.5 may allow an authenticated remote attacker to see workflow names if their ID is known. A workaround is not possible.

A flaw in the cross-site request forgery (CSRF) prevention of KNIME Business Hub prior to version 1.19.0 allows an authenticated attacker to perform a CSRF attack with passive user interaction. This means the state of a resource could be changed without the user noticing. As a workaround, an API gateway for firewall in front of KNIME Business Hub could remove the X-Forwaded-For header from all incoming requests.

An excessive resource allocation issue in the remote workflow editing capabilities of KNIME Business Hub prior to version 1.19.0 allows a authenticated attack to exhaust resources on the server side. This leads to intermittent unavailability of workflow execution functionality. A workaround is not possible.

CVE-2026-114702 is a stored cross-site scripting (XSS) vulnerability in the nicdark ND Shortcodes For Visual Composer plugin. It affects versions from 0 up to and including 7.8. The flaw involves improper neutralization of input during web page generation, which could allow an attacker with low privileges to inject malicious scripts that execute in the context of other users. The vulnerability has a CVSS 3.1 base score of 6.5, indicating a medium severity level with impacts on confidentiality, integrity, and availability. No public exploits or patches are currently documented.

CVE-2026-114696 is a missing authorization vulnerability in the miniOrange Page Restriction WordPress plugin versions before 1.6.1. It allows unauthorized users to bypass access controls due to incorrectly configured security levels. The issue affects versions from initial releases up to 1.6.0 and has a CVSS score of 5.3, indicating medium severity. A fix is available in version 1.6.1.

TastyIgniter versions up to 4.4.5 contain a PHP object injection vulnerability that allows authenticated administrators to execute arbitrary code. This occurs because serialized PHP objects submitted via the admin settings form are stored without sanitization and later unserialized, enabling execution of malicious payloads. The vulnerability can be exploited by submitting a crafted serialized object, such as one generated by phpggc, leading to arbitrary operating system command execution as the PHP process user. The malicious setting value remains effective until overwritten.

CVE-2026-82987 is a vulnerability in the ViewSonic vCast media streaming service used in ViewSonic ViewBoard devices. It involves missing authentication on critical screen capture endpoints (/snapshot or /screen), allowing remote unauthenticated attackers to capture and exfiltrate the current screen content as JPEG images. This affects versions from 0.0.0 up to and including 3.2.715. No CVSS score is provided, and no known exploits are reported in the wild. No patch or official remediation details are currently available from the vendor advisory.

CVE-2026-114123 is a vulnerability in dynamics365ninja's d365fo-mcp-server prior to version 1.11.0 where missing authentication allows unauthenticated access to critical read-only functions. The default deployment leaves the API key unset or empty, causing the server to accept unauthenticated JSON-RPC requests. This exposes proprietary X++ source code snippets and metadata, including business logic and security roles. The issue is fixed in version 1.11.0.

CVE-2026-87096 is a vulnerability in Acronis Cyber Infrastructure (ACI) involving improper authorization checks that can lead to sensitive information disclosure and manipulation. It affects versions before build 6.0.1-112, 6.1.1-64, and 6.2.1-71. The CVSS score is 3.3, indicating a low severity issue. No known exploits are reported in the wild, and no patch or remediation information is provided in the available data.