Vulnerability feed
CVE and vendor PSIRT advisories from 13 sources, last 30 days. Updated hourly, last run
| Expand | Severity |
Score |
Advisory |
Title |
Source |
Flags |
Published |
|---|---|---|---|---|---|---|---|
| Medium | 5.5 | CVE-2026-115971 |
A vulnerability was found in Travisun Opptrix 0.4.0
TravisunTravisun Opptrix
|
NVD | |||
|
CVE-2026-115971A vulnerability was found in Travisun Opptrix 0.4.0
Executive summaryA denial of service flaw was reported in Travisun Opptrix version 0.4.0, which can be triggered remotely and for which a public exploit exists. The project has been taken offline and deprecated, and the advisory states that the flaw only affects products no longer supported by the maintainer. Technical summaryThe advisory describes a denial of service issue in the Buffer.concat function within the preParsing handler for the /api/channels/webhook/ file in Travisun Opptrix 0.4.0. The attack can be launched remotely, and the advisory says a public exploit exists. The vulnerability class is given only as denial of service; the specific weakness type (such as CWE) is not stated. The maintainer says a fix was pushed to a private GitHub repository, but no fixed version number is stated, and no workaround, CVSS score, or detection guidance is stated. The advisory states the project is deprecated and taken offline, so no supported patched release is indicated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Impact if exploitedConfidentialityNone IntegrityNone AvailabilityLow
How it is exploited
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects
NIST National Vulnerability DatabasePublished
Read the advisory
|
|||||||
| Medium | 5.5 | CVE-2026-115970 |
A vulnerability has been found in Travisun Opptrix 0.4.0
TravisunTravisun Opptrix
|
NVD | |||
|
CVE-2026-115970A vulnerability has been found in Travisun Opptrix 0.4.0
Executive summaryA code injection flaw has been publicly reported in Travisun Opptrix version 0.4.0, and the exploit is public and may be used. The project has been taken offline and deprecated by its maintainer, and the advisory says the flaw only affects products no longer supported by the maintainer. Technical summaryThe advisory describes a code injection vulnerability in the Import Endpoint at the /api/system-update/import path of Travisun Opptrix 0.4.0, which can be triggered remotely. The advisory does not state the specific weakness identifier, authentication requirements, or the exact payload needed for exploitation. The maintainer states the issue was a design flaw that was fixed only in a private GitHub repository before the project went private, but no fixed version number is stated. No workaround, vendor patch version, CVSS score, or detection guidance is stated in the advisory. Because the project is deprecated and offline, the advisory recommends no specific remediation step beyond noting that it is no longer supported. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Impact if exploitedConfidentialityLow IntegrityLow AvailabilityLow
How it is exploited
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects
NIST National Vulnerability DatabasePublished
Read the advisory
|
|||||||
| Medium | 5.5 | CVE-2026-115969 |
A flaw has been found in Travisun Opptrix 0.4.0
TravisunTravisun Opptrix
|
NVD | |||
|
CVE-2026-115969A flaw has been found in Travisun Opptrix 0.4.0
Executive summaryA command injection flaw has been reported in Travisun Opptrix version 0.4.0, a scheduling application. The advisory says the exploit has been published and may be used, and that the project is now offline and deprecated. The advisory states that only products no longer supported by the maintainer are affected. Technical summaryThe flaw is a command injection issue in an unknown function of the /api/auth/setup file within the Schedule API component of Travisun Opptrix 0.4.0. The advisory says it can be started remotely and that a public exploit has been published. The maintainer states that the underlying design flaw was fixed in the GitHub repository before that repository went private, but no fixed version number is stated. No workarounds, CVSS score, detection guidance, or affected version range beyond 0.4.0 are stated in the advisory. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Impact if exploitedConfidentialityLow IntegrityLow AvailabilityLow
How it is exploited
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects
NIST National Vulnerability DatabasePublished
Read the advisory
|
|||||||