CVE-2026-115996Low· 3.7▾ SunlitA vulnerability was detected in Unitree Robotics Unitree Go2 up to 1.1.13/1.1.14.1/1.1.15.1. This affects the function WebSocketClient.connect of the file websocket.py of the component chat_go. Performing a manipulation results in improp…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 20.4 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the assigning CNA record, not NVD.
Exploit-prediction probability, daily snapshots since Oct 26.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
Last analysed / modified upstream
0.2%
A vulnerability was detected in Unitree Robotics Unitree Go2 up to 1.1.13/1.1.14.1/1.1.15.1. This affects the function WebSocketClient.connect of the file websocket.py of the component chat_go. Performing a manipulation results in improper certificate validation. The attack may be initiated remotely. The attack's complexity is rated as high. The exploitability is reported as difficult. The vendor confirmed early: "These issues were previously submitted by the researcher through our Security Response Center platform and are tracked internally as follows: Submission 990504 corresponds to our internal ticket #616 (Go2 chat_go WSS client disabled TLS server certificate validation, CWE-295)."
unitree_go2 1.1.0unitree_go2 1.1.1unitree_go2 1.1.2unitree_go2 1.1.3unitree_go2 1.1.4unitree_go2 1.1.5unitree_go2 1.1.6unitree_go2 1.1.7unitree_go2 1.1.8unitree_go2 1.1.9unitree_go2 1.1.10unitree_go2 1.1.11unitree_go2 1.1.12unitree_go2 1.1.13unitree_go2 1.1.14.0unitree_go2 1.1.14.1unitree_go2 1.1.15.0unitree_go2 1.1.15.1Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-115995Critical· 9.6Unitree Robotics Unitree Go2 chat_go gpt_thread.py set_volume os command injection
CVE-2025-64432Medium· 4.7KubeVirt is a virtual machine management add-on for Kubernetes
CVE-2025-37731Medium· 6.8Improper Authentication in Elasticsearch PKI realm can lead to user impersonation via specially crafted client certificates
CVE-2023-49105Critical· 9.8An issue was discovered in ownCloud owncloud/core before 10.13.1
CVE-2019-1946Medium· 6.5A vulnerability in the web-based management interface of Cisco Enterprise NFV Infrastructure Software (NFVIS) could allow an unauthenticated, remote attacker to bypass authentication and get limited access to the web-based management int…
CVE-2022-40684Critical· 9.8An authentication bypass using an alternate path or channel [CWE-288] in Fortinet FortiOS version 7.2.0 through 7.2.1 and 7.0.0 through 7.0.6, FortiProxy version 7.2.0 and version 7.0.0 through 7.0.6 and FortiSwitchManager version 7.2.0 …