https://vulnerability.circl.lu/sightings/feed 2026-08-30T21:51:20.922372+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent sightings. https://vulnerability.circl.lu/sighting/a09f2b7b-5f1c-4d06-81b3-d514a96a84fd/export 2026-08-30T21:51:20.949642+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "a09f2b7b-5f1c-4d06-81b3-d514a96a84fd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-76639", "type": "seen", "source": "https://bsky.app/profile/suriq.io/post/3mucccl2bqg2p", "content": "The Unitree G1 humanoid robot has two flaws that give root with no login (CVE-2026-76639, CVE-2026-76640).\n\nOne works over Bluetooth from across a room, and a hacked robot can infect other G1 units nearby.\n\nUnitree fixed the cloud part; isolate the rest.", "creation_timestamp": "2026-08-30T11:34:22.299254Z"} 2026-08-30T11:34:22.299254+00:00 https://vulnerability.circl.lu/sighting/eed23bf4-0679-4b51-b44d-8b2603e8d843/export 2026-08-30T21:51:20.951362+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "eed23bf4-0679-4b51-b44d-8b2603e8d843", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-76639", "type": "published-proof-of-concept", "source": "Telegram/33VE_JMtbJzhGXLGhc9z7UjTOc8VkRF04n-G2cvJ843fRQE", "content": "", "creation_timestamp": "2026-08-30T00:00:55.949769Z"} 2026-08-30T00:00:55.949769+00:00 https://vulnerability.circl.lu/sighting/1b1145b6-fe49-479e-9887-12b1c1731b6c/export 2026-08-30T21:51:20.951503+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "1b1145b6-fe49-479e-9887-12b1c1731b6c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-76639", "type": "published-proof-of-concept", "source": "Telegram/tndVUT7cQzNaVNRWaPmWA7BbZdZXIbA4uVPA8fo4RiGDHQ", "content": "", "creation_timestamp": "2026-08-30T00:00:55.741376Z"} 2026-08-30T00:00:55.741376+00:00 https://vulnerability.circl.lu/sighting/cc5c8cef-1e3d-4763-b8a1-f442465e22c9/export 2026-08-30T21:51:20.951620+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "cc5c8cef-1e3d-4763-b8a1-f442465e22c9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-76639", "type": "seen", "source": "https://bsky.app/profile/securityrss.bsky.social/post/3mu7u2syxml23", "content": "Two vulnerabilities in the Unitree G1 EDU humanoid robot enable root remote code execution (RCE), tracked as CVE-2026-76639 and CVE-2026-76640. The first involves a network path through chat_go and bashrunner, while the second exploits a Bluetooth Low Energy (BLE) interaction.", "creation_timestamp": "2026-08-29T12:14:11.346169Z"} 2026-08-29T12:14:11.346169+00:00 https://vulnerability.circl.lu/sighting/0a5053ae-a527-425d-bcf7-e1aa217d0cc2/export 2026-08-30T21:51:20.951733+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "0a5053ae-a527-425d-bcf7-e1aa217d0cc2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-76639", "type": "seen", "source": "Telegram/tndVUT7cQzNaVNRWaPmWA7BbZdZXIbA4uVPA8fo4RiGDHQ", "content": "", "creation_timestamp": "2026-08-29T03:00:04.285477Z"} 2026-08-29T03:00:04.285477+00:00 https://vulnerability.circl.lu/sighting/21f30000-4cfb-4bb6-8f22-35316815309b/export 2026-08-30T21:51:20.951848+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "21f30000-4cfb-4bb6-8f22-35316815309b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-76639", "type": "seen", "source": "https://thehackernews.com/2026/08/two-unitree-g1-edu-humanoid-robot-flaws.html", "content": "Security researcher Olivier Laflamme has disclosed two independent root remote code execution (RCE) chains affecting the Unitree G1 EDU, including a Bluetooth Low Energy (BLE) path that can reach root on the robot's Locomotion PC.\n\nThe flaws are tracked as CVE-2026-76639 and CVE-2026-76640, with the first involving a network-adjacent path through chat_go and bashrunner and the", "creation_timestamp": "2026-08-29T01:00:35.151363Z"} 2026-08-29T01:00:35.151363+00:00 https://vulnerability.circl.lu/sighting/ecb4168a-c4fd-4bc9-9c9b-b4e5fbec425e/export 2026-08-30T21:51:20.951958+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "ecb4168a-c4fd-4bc9-9c9b-b4e5fbec425e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-76639", "type": "seen", "source": "Telegram/33VE_JMtbJzhGXLGhc9z7UjTOc8VkRF04n-G2cvJ843fRQE", "content": "", "creation_timestamp": "2026-08-29T00:00:06.730281Z"} 2026-08-29T00:00:06.730281+00:00 https://vulnerability.circl.lu/sighting/3ea73a18-4f3e-4b61-82c1-13dc3899751d/export 2026-08-30T21:51:20.952067+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "3ea73a18-4f3e-4b61-82c1-13dc3899751d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-76639", "type": "seen", "source": "https://thehackernews.com/2026/08/two-unitree-g1-edu-humanoid-robot-flaws.html", "content": "Security researcher Olivier Laflamme has disclosed two independent root remote code execution (RCE) chains affecting the Unitree G1 EDU, including a Bluetooth Low Energy (BLE) path that can reach root on the robot's Locomotion PC.\n\nThe flaws are tracked as CVE-2026-76639 and CVE-2026-76640, with the first involving a network-adjacent path through chat_go and bashrunner and the", "creation_timestamp": "2026-08-28T16:00:54.055683Z"} 2026-08-28T16:00:54.055683+00:00 https://vulnerability.circl.lu/sighting/2a8591ab-6e8a-4c82-ae33-1bcaf7a6f26b/export 2026-08-30T21:51:20.952193+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "2a8591ab-6e8a-4c82-ae33-1bcaf7a6f26b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-76639", "type": "seen", "source": "https://infosec.exchange/users/AAKL/statuses/117173762999493513", "content": "Oh, goodie. The robots come with recycled bugs. These two are tracked as CVE-2026-76639 and CVE-2026-76640.\nThis was posted on August 27.\nBoschko Security Blog: UniBLEed: Unauthenticated Root RCE on Any Unitree G1 Humanoid Robot Within Bluetooth Range https://boschko.ca/g1-ble-rce/\nMore:\nThe Hacker News: Two Unitree G1 EDU Humanoid Robot Flaws Enable Root RCE, One Starts Over Bluetooth https://thehackernews.com/2026/08/two-unitree-g1-edu-humanoid-robot-flaws.html #infosec #vulnerability #robotics", "creation_timestamp": "2026-08-28T15:08:53.808626Z"} 2026-08-28T15:08:53.808626+00:00 https://vulnerability.circl.lu/sighting/a738e1ba-6e1d-4b96-8446-60d17a1dc76b/export 2026-08-30T21:51:20.952302+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "a738e1ba-6e1d-4b96-8446-60d17a1dc76b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-76639", "type": "seen", "source": "https://bsky.app/profile/infosecbriefly.bsky.social/post/3mu5gyx6aad2l", "content": "Two independent root RCE chains affect the Unitree G1 EDU, including a BLE path to root on the Locomotion PC, tracked as CVE-2026-76639 and CVE-2026-76640.\n", "creation_timestamp": "2026-08-28T13:15:09.466024Z"} 2026-08-28T13:15:09.466024+00:00