Threat database

CVE-2026-115971 is a denial of service vulnerability in Travisun Opptrix version 0.4.0. It affects the Buffer.concat function in the preParsing handler of the /api/channels/webhook/ component. The vulnerability can be exploited remotely. The project has been deprecated and taken offline, and the maintainer states the issue was a design flaw primarily in local environments during early development stages. A fix was pushed to the GitHub repository before it was made private, but no official patch was released. This vulnerability only affects the unsupported version 0.4.0.

CVE-2026-115970 is a code injection vulnerability in Travisun Opptrix version 0.4.0 affecting the /api/system-update/import endpoint. The flaw allows remote attackers to inject code due to a design issue primarily present in early development stages. The project has been deprecated and taken offline, with no official support or patch available. The maintainer states the risk was addressed in private repository versions but not publicly released. This vulnerability has a medium severity score of 6.9 and no known active exploitation in the wild.

CVE-2026-115969 is a command injection vulnerability in Travisun Opptrix version 0.4.0 affecting the /api/auth/setup endpoint of the Schedule API component. The flaw allows remote attackers to execute arbitrary commands. The project has been deprecated and taken offline, with no official patch released publicly. The maintainer states the vulnerability was primarily a design flaw affecting local environments during early development and was fixed in the private GitHub repository before the project went private. This vulnerability affects unsupported software and has a medium severity rating with a CVSS score of 6.9.