Threat database

CVE-2026-115971 is a denial of service vulnerability in Travisun Opptrix version 0.4.0. It affects the Buffer.concat function in the preParsing handler of the /api/channels/webhook/ component. The vulnerability can be exploited remotely. The project has been deprecated and taken offline, and the maintainer states the issue was a design flaw primarily in local environments during early development stages. A fix was pushed to the GitHub repository before it was made private, but no official patch was released. This vulnerability only affects the unsupported version 0.4.0.

CVE-2026-115969 is a command injection vulnerability in Travisun Opptrix version 0.4.0 affecting the /api/auth/setup endpoint of the Schedule API component. The flaw allows remote attackers to execute arbitrary commands. The project has been deprecated and taken offline, with no official patch released publicly. The maintainer states the vulnerability was primarily a design flaw affecting local environments during early development and was fixed in the private GitHub repository before the project went private. This vulnerability affects unsupported software and has a medium severity rating with a CVSS score of 6.9.