🕵️ RESEARCH & DEEP DIVES
- Unitree G1 EDU Firmware Exposes Unauthenticated Bluetooth Root RCE
CVE-2026-76639
Unitree G1 EDU robots are vulnerable to unauthenticated remote code execution.- Unitree G1 EDU humanoid robots are affected.
- Firmware versions through 1.5.2 are vulnerable to CVE-2026-76639.
- An attacker within Bluetooth range can execute commands without authentication.
- The vulnerability provides root-level access through the robot’s Bluetooth interface.
📄 Source: boschko.ca · 📎 Coverage: thehackerwire.com · 👁 via thehackerwire.com (discovered), r/netsec
🔓 CVEs & KEV
-
CVE-2026-74820 — CVSS 10.0 — Unauthenticated SQL Injection via Dynamic Schema ORDER BY ClauseServiceNow ha...
-
CVE-2026-18886 — CVSS 10.0 — Unauthenticated Privilege Escalation via System Configuration Image Upload Pr...
-
CVE-2026-18885 — CVSS 10.0 — Unauthenticated Remote Code Execution in GraphQL Composite Data APIServiceNow...
-
CVE-2026-53579 — CVSS 9.3 — Trilium: Note Import to RCE via Book NoteTrilium is an open-source hierarchic...
-
CVE-2026-53578 — CVSS 9.3 — Trilium: Note Import to RCE via Mind Elixir dangerouslySetInnerHtmlTrilium is...
-
CVE-2026-81934 — CVSS 9.2 — Redis TLS pending-data list use-after-freeRedis contains a use-after-free vul...
-
CVE-2026-81730 — CVSS 8.8 — Dolibarr 9.0.0 through 23.0.4 Path Traversal via EmailCollector Attachment Fi...
-
CVE-2026-10036 — CVSS 8.7 — SpeechBrain before 1.1.1 Arbitrary Code Execution via CKPT.yaml ParsingSpeechBrain...
-
CVE-2026-6876 — CVSS 8.7 — Sandbox Escape in Now PlatformServiceNow has remediated a sandbox escape secu...
-
CVE-2026-76639 — CVSS 8.7 — Unitree G1 EDU Firmware RCE (CVE-2026-76639)
-
CVE-2026-81728 — CVSS 8.6 — Dolibarr before 24.0.0 SQL Injection via the CSV and XLSX Import Update KeysD...
-
CVE-2026-53580 — CVSS 8.1 — Trilium arbitrary file read and denial of service via file:// URLs in the aut...
-
CVE-2026-77438 — CVSS 7.5 — Trilium unauthenticated share-search discloses password-protected and hidden ...
-
CVE-2026-81729 — CVSS 7.1 — Dolibarr before 23.0.4 Incorrect Authorization on REST API Document DeletionD...