35
30
30
30
30
35
30
30
30
30
30
45
30
30
30
30
30
30
30
30
30
35
30
30
30
VU#431093: TCG TPM 2.0 reference code found vulnerable to information leakage and timing side-channel attacks
CERT/CC discloses two TPM 2.0 reference code flaws allowing RSA key decryption and forged TPM attestations via crafted commands.
CERT/CC published VU#431093 covering two vulnerabilities in the TCG TPM 2.0 reference implementation: CVE-2026-6726 (information leakage via falsified TPM keys) and CVE-2026-6727 (timing side-channel in RSA OAEP decryption). An attacker with privileged access to a TPM command interface could send crafted TPM commands to decrypt ciphertexts for affected TPM-managed RSA keys, including the RSA Endorsement Key, or obtain credentials enabling forged TPM 2.0 attestations. Remediation is tracked in TCGVRT010 and TCGVRT0011.
55
30
30
30
45
30
30
30
30
30
30
30
30
Hack One Robot, Reach the Next: Unitree G1 Security Flaws
Researcher chained two Unitree G1 flaws (CVE-2026-76639, CVE-2026-76640) to gain unauthenticated root access, with compromised robots able to infect others via Bluetooth.
Security researcher Olivier Laflamme chained a path-traversal file-write flaw (CVE-2026-76639) in the G1 chatbot service and a Bluetooth server buffer overflow (CVE-2026-76640) to achieve unauthenticated root access remotely. The chain abuses Unitree's cloud API as a decryption oracle for the AES-128 key that unlocks BLE and WebRTC channels, and a compromised robot can propagate the attack to nearby G1 units. Unitree patched the cloud ownership-check flaw, paid a $5,000 bounty, and firmware fixes for BLE pairing and the buffer overflow remain harder to deliver.
58
30