CVE-2026-115996 is a medium severity vulnerability in Unitree Robotics Unitree Go2 versions 1.1.0 through 1.1.15.1. It involves improper certificate validation in the WebSocketClient.connect function within the chat_go component, allowing remote attackers to potentially manipulate TLS server certificate validation. The attack complexity is high and exploitability is difficult. No official patch or remediation details are provided in the available data.
CVE-2026-115995 is a critical OS command injection vulnerability in Unitree Robotics Unitree Go2 versions 1.1.11.0 through 1.1.11.4. The flaw exists in the set_volume function within the gpt_thread.py file of the chat_go component, allowing remote attackers to execute arbitrary OS commands by manipulating the Value argument. Upgrading to version 1.1.11.5 resolves this issue.
CVE-2026-115982 is a cross-site scripting (XSS) vulnerability in phpIPAM versions 1.8.0 through 1.8.3. The flaw exists in the create_rack_link function within the app/tools/racks/show-rack-popup.php file, where manipulation of the deviceid argument can lead to XSS. Remote exploitation is possible, and public exploit code is available. The vulnerability has a medium severity rating with a CVSS score of 5.3.
CVE-2026-115981 is a cross-site scripting (XSS) vulnerability in phpIPAM versions 1.8.0 through 1.8.3. It involves manipulation of the REQUEST_URI argument in the upgrade/index.php file, allowing remote attackers to execute script code. The vulnerability has a medium severity rating with a CVSS score of 4.8. Public exploit code has been disclosed, but no known active exploitation in the wild is reported. The vendor was notified early about this issue.
This report discusses difficulties in getting phishing sites hosted on Vercel's platform taken down despite abuse reports. The phishing site impersonates a legitimate brand to harvest credit card data via fake checkout and 3DS OTP prompts. The reporter seeks community advice on effective takedown strategies, including reporting methods and escalation tactics. No direct technical details or exploit code are provided.
A malicious file identified by the SHA-256 hash d3e15a3cb34e3615b12e148369ac3bcebd5566760ebbf569ec59d02505420a74 was observed three times on October 24, 2026, by OffSeq Mirage honeypot sensors. The file is associated with attacker activity involving the MITRE ATT&CK technique T1105 (Ingress Tool Transfer). The payload could be a dropper, web shell, miner, or post-exploitation tool. The attacker infrastructure was located in Poland. This indicator should be matched against files in security environments and threat intelligence feeds for detection purposes.
A malicious file identified by the SHA-256 hash 1c0688bb8702fd6c977efffa5e9d1a5c2da77431d41bd6c31f86cbc3ce368700 was observed by OffSeq Mirage honeypot sensors on 2026-10-24. The file was detected four times in attacker activity involving the T1105 technique (Ingress Tool Transfer) originating from attacker infrastructure in Poland. This hash corresponds to a specific malicious payload such as a dropper, web shell, miner, or post-exploitation tool. No known exploits or threat actors have been associated with this indicator yet. There is no information about affected software versions or patches.
Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JSSE). Supported versions that are affected are Oracle Java SE: 8u511-b32, 8u511-perf-b32, 11.0.33.0.2, 17.0.21.0.2, 21.0.13.0.2, 25.0.5.0.2, 27.0.1.0.2; Oracle GraalVM for JDK: 17.0.21.0.2 and 21.0.13.0.2; Oracle GraalVM Enterprise Edition: 21.3.20.0.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data as well as unauthorized access to critical data or complete access to all Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 9.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N).
A malicious file identified by the SHA-256 hash d53eda7a637c99cc7fb566d96e9fa109bf15c478410a3f5eb4d4c4e26cd081f6 was observed by OffSeq Mirage honeypot sensors on 2026-10-24. The file is associated with attacker activity involving the MITRE ATT&CK technique T1105 (Ingress Tool Transfer). The payload could be a dropper, web shell, miner, or post-exploitation tool. The file was seen originating from attacker infrastructure in Poland. There is no information about active exploitation or affected software versions. This indicator should be matched against files in environments and security tools for detection purposes.
CVE-2026-115973 is a medium severity vulnerability in FaveoSuite Faveo Helpdesk version 2.0.3 affecting the password recovery functionality. The issue lies in the ForgotPasswordController::sendResetLinkEmail and PasswordController::reset functions, which allow weak password recovery mechanisms. This vulnerability can be exploited remotely without authentication and may lead to compromised account recovery processes.
CVE-2026-115972 is a medium severity vulnerability in FaveoSuite Faveo Helpdesk versions 2.0.0 through 2.0.3. It involves missing authorization checks in several functions of the UnAuthController, allowing remote attackers to manipulate status-related arguments without proper authorization.
CVE-2026-115971 is a denial of service vulnerability in Travisun Opptrix version 0.4.0. It affects the Buffer.concat function in the preParsing handler of the /api/channels/webhook/ component. The vulnerability can be exploited remotely. The project has been deprecated and taken offline, and the maintainer states the issue was a design flaw primarily in local environments during early development stages. A fix was pushed to the GitHub repository before it was made private, but no official patch was released. This vulnerability only affects the unsupported version 0.4.0.
CVE-2026-115970 is a code injection vulnerability in Travisun Opptrix version 0.4.0 affecting the /api/system-update/import endpoint. The flaw allows remote attackers to inject code due to a design issue primarily present in early development stages. The project has been deprecated and taken offline, with no official support or patch available. The maintainer states the risk was addressed in private repository versions but not publicly released. This vulnerability has a medium severity score of 6.9 and no known active exploitation in the wild.
The URL http://play.nopixel-rp.ir/ was observed twice in attacker activity on 2026-10-24 by OffSeq Mirage honeypot sensors. It is associated with the MITRE ATT&CK technique T1105 (Ingress Tool Transfer), indicating its use in attacker payloads such as tool downloads, callbacks, or exploitation targets. The attacker infrastructure was identified as originating from Great Britain. This URL serves as an indicator of compromise (IOC) and should be blocked and monitored in network defenses.
ANAT (AI Network Anomaly Tracker) is an open-source, lightweight Intrusion Detection System (IDS) designed for real-time network traffic monitoring and anomaly detection. It captures packets, detects suspicious activities such as port scans, floods, and large packets, and visualizes alerts through a cyberpunk-themed dashboard. The tool supports alert logging, filtering, trusted source suppression, and integration with Discord for alert notifications. It is intended for educational and authorized security testing purposes only and requires elevated privileges for packet capture.
CVE-2026-115969 is a command injection vulnerability in Travisun Opptrix version 0.4.0 affecting the /api/auth/setup endpoint of the Schedule API component. The flaw allows remote attackers to execute arbitrary commands. The project has been deprecated and taken offline, with no official patch released publicly. The maintainer states the vulnerability was primarily a design flaw affecting local environments during early development and was fixed in the private GitHub repository before the project went private. This vulnerability affects unsupported software and has a medium severity rating with a CVSS score of 6.9.
An attacker URL https://wrpddqm0rp.rbmock.dev/ was observed in the wild by OffSeq Mirage honeypot sensors on 2026-10-24. The URL was seen 4 times in attacker activity related to the T1105 technique (Ingress Tool Transfer), indicating its use for payload delivery or command and control. The attacker infrastructure was located in Colorado, USA. This URL is associated with attacker payloads such as tool downloads, callbacks, or exploitation targets. No specific software versions are affected, and no known exploits are reported in the wild for this indicator.
Postiz-app versions from 2.15.0 up to but not including 2.25.3 have a critical vulnerability (CVE-2026-115933) where session, invitation, and password reset tokens are signed with a single shared secret without distinguishing token types. This flaw allows an attacker with limited privileges to craft tokens with arbitrary claims that the application accepts as valid sessions, invitations with chosen roles, password resets, or provisioning tokens. The vulnerability stems from improper authentication design (CWE-290) and insecure token handling.
Python has added a denylist for known compromised certificates to the "ssl" module to ensure user safety even without certificate revocation configured. Known compromised certificates will automatically be rejected regardless of the SSLContext policy configuration.
Missing Authorization vulnerability in Knit Pay UPI QR Code Payment Gateway for WooCommerce upi-qr-code-payment-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects UPI QR Code Payment Gateway for WooCommerce: from n/a through 1.6.3.