3MPER0RR's picture
Create index.html
58704bd verified
Raw History Blame
44.9 kB
<!DOCTYPE html>
<html lang="en">
<head>
<meta charset="UTF-8">
<meta name="viewport" content="width=device-width, initial-scale=1.0">
<meta name="description" content="Unitree CVE Robustness Dashboard — Public CVE intelligence for Unitree robotics platforms (Go1, Go2, G1, A1, H1, B2).">
<title>🤖 Unitree CVE Robustness Dashboard</title>
<script src="https://cdn.jsdelivr.net/npm/chart.js@4.4.4/dist/chart.umd.min.js"></script>
<style>
:root {
--bg: #070a0f;
--surface: #0d1117;
--surface2: #161b22;
--border: #21262d;
--accent: #00ff88;
--red: #ff3366;
--orange: #ff8c42;
--yellow: #ffd166;
--blue: #00b4d8;
--purple: #7b2fff;
--text: #c9d1d9;
--dim: #8b949e;
--mono: 'Courier New', monospace;
}
*{box-sizing:border-box;margin:0;padding:0}
body{background:var(--bg);color:var(--text);font-family:var(--mono);min-height:100vh;overflow-x:hidden}
body::before{content:'';position:fixed;inset:0;background-image:linear-gradient(rgba(0,255,136,.025) 1px,transparent 1px),linear-gradient(90deg,rgba(0,255,136,.025) 1px,transparent 1px);background-size:44px 44px;pointer-events:none;z-index:0}
#bg{position:fixed;top:0;left:0;width:100%;height:100%;z-index:0;opacity:.25;pointer-events:none}
.app{position:relative;z-index:1;max-width:1380px;margin:0 auto;padding:0 20px 48px}
header{padding:22px 0 18px;border-bottom:1px solid var(--border);margin-bottom:22px;display:flex;align-items:center;justify-content:space-between;flex-wrap:wrap;gap:12px}
.logo{display:flex;align-items:center;gap:14px}
.logo-icon{width:46px;height:46px;background:linear-gradient(135deg,var(--red),var(--purple));border-radius:12px;display:flex;align-items:center;justify-content:center;font-size:22px;animation:glow 2.4s ease-in-out infinite}
@keyframes glow{0%,100%{box-shadow:0 0 10px rgba(255,51,102,.35)}50%{box-shadow:0 0 28px rgba(255,51,102,.75),0 0 50px rgba(123,47,255,.3)}}
.logo h1{font-size:17px;color:#fff;letter-spacing:2px;text-transform:uppercase}
.logo p{font-size:10px;color:var(--dim);letter-spacing:1px;margin-top:3px}
.badge{display:flex;align-items:center;gap:8px;padding:6px 14px;background:rgba(0,255,136,.07);border:1px solid rgba(0,255,136,.18);border-radius:20px;font-size:10px;color:var(--accent);letter-spacing:1px}
.dot{width:6px;height:6px;border-radius:50%;background:var(--accent);animation:blink 1.6s ease-in-out infinite}
@keyframes blink{0%,100%{opacity:1}50%{opacity:.15}}
.tabs{display:flex;gap:4px;margin-bottom:22px;background:var(--surface);padding:4px;border-radius:10px;border:1px solid var(--border)}
.tab{flex:1;padding:10px;text-align:center;font-size:11px;letter-spacing:1px;text-transform:uppercase;cursor:pointer;border-radius:7px;transition:all .2s;color:var(--dim);border:1px solid transparent;background:none;font-family:var(--mono)}
.tab:hover{color:var(--text);background:var(--surface2)}
.tab.active{background:linear-gradient(135deg,rgba(255,51,102,.13),rgba(123,47,255,.13));color:#fff;border-color:rgba(255,51,102,.28)}
.tab .kbd{display:inline-block;padding:1px 5px;background:var(--surface2);border:1px solid var(--border);border-radius:3px;font-size:8px;margin-left:4px;color:var(--dim);vertical-align:middle}
.panel{display:none}
.panel.active{display:block;animation:fadein .3s ease}
@keyframes fadein{from{opacity:0;transform:translateY(8px)}to{opacity:1;transform:translateY(0)}}
.kpi-grid{display:grid;grid-template-columns:repeat(4,1fr);gap:14px;margin-bottom:20px}
.kpi{background:var(--surface);border:1px solid var(--border);border-radius:12px;padding:20px;position:relative;overflow:hidden;transition:transform .2s,border-color .2s}
.kpi:hover{transform:translateY(-2px)}
.kpi::after{content:'';position:absolute;bottom:0;left:0;right:0;height:2px}
.kpi.c1::after{background:var(--red)}.kpi.c2::after{background:var(--orange)}.kpi.c3::after{background:var(--yellow)}.kpi.c4::after{background:var(--blue)}
.kpi:hover.c1{border-color:rgba(255,51,102,.4)}.kpi:hover.c2{border-color:rgba(255,140,66,.4)}.kpi:hover.c3{border-color:rgba(255,209,102,.4)}.kpi:hover.c4{border-color:rgba(0,180,216,.4)}
.kpi-lbl{font-size:9px;letter-spacing:2px;text-transform:uppercase;color:var(--dim);margin-bottom:8px}
.kpi-val{font-size:38px;font-weight:bold;line-height:1;margin-bottom:4px}
.kpi.c1 .kpi-val{color:var(--red)}.kpi.c2 .kpi-val{color:var(--orange)}.kpi.c3 .kpi-val{color:var(--yellow)}.kpi.c4 .kpi-val{color:var(--blue)}
.kpi-sub{font-size:10px;color:var(--dim)}
.cg2{display:grid;grid-template-columns:1fr 2fr;gap:14px;margin-bottom:14px}
.cg2b{display:grid;grid-template-columns:1fr 1fr;gap:14px;margin-bottom:14px}
.card{background:var(--surface);border:1px solid var(--border);border-radius:12px;padding:18px}
.card h3{font-size:9px;letter-spacing:2px;text-transform:uppercase;color:var(--dim);margin-bottom:14px}
.cw{position:relative;height:210px}
.cw-sm{position:relative;height:260px}
.controls{display:flex;gap:10px;margin-bottom:14px;flex-wrap:wrap}
input,select{background:var(--surface);border:1px solid var(--border);color:var(--text);padding:8px 12px;border-radius:8px;font-family:var(--mono);font-size:11px;outline:none;transition:border-color .2s}
input:focus,select:focus{border-color:rgba(0,255,136,.35)}
input{flex:1;min-width:200px}
.table-wrap{background:var(--surface);border:1px solid var(--border);border-radius:12px;overflow:hidden}
.table-scroll{overflow-x:auto}
table{width:100%;border-collapse:collapse;font-size:11px;min-width:780px}
th{background:var(--surface2);padding:11px 14px;text-align:left;color:var(--dim);font-size:9px;letter-spacing:2px;text-transform:uppercase;cursor:pointer;user-select:none;border-bottom:1px solid var(--border);white-space:nowrap}
th:hover{color:var(--text)}
td{padding:11px 14px;border-bottom:1px solid rgba(33,38,45,.5);vertical-align:middle}
tr:last-child td{border-bottom:none}
tr.data-row{cursor:pointer}
tr.data-row:hover td{background:rgba(255,255,255,.018)}
.sev{padding:2px 7px;border-radius:4px;font-size:9px;font-weight:bold;letter-spacing:1px;text-transform:uppercase;white-space:nowrap}
.s-CRITICAL{background:rgba(255,51,102,.14);color:var(--red);border:1px solid rgba(255,51,102,.28)}
.s-HIGH{background:rgba(255,140,66,.14);color:var(--orange);border:1px solid rgba(255,140,66,.28)}
.s-MEDIUM{background:rgba(255,209,102,.14);color:var(--yellow);border:1px solid rgba(255,209,102,.28)}
.s-LOW{background:rgba(0,180,216,.14);color:var(--blue);border:1px solid rgba(0,180,216,.28)}
.s-INFO{background:rgba(139,148,158,.1);color:var(--dim);border:1px solid rgba(139,148,158,.2)}
.cbar{display:flex;align-items:center;gap:6px}
.ctrack{width:60px;height:4px;background:var(--border);border-radius:2px;overflow:hidden;flex-shrink:0}
.cfill{height:100%;border-radius:2px}
.detail-row td{padding:0}
.detail{display:none;padding:14px 16px;background:rgba(0,255,136,.018);border-top:1px solid var(--border)}
.detail.open{display:block}
.dg{display:grid;grid-template-columns:repeat(3,1fr);gap:10px;margin-bottom:10px}
.di .dl{font-size:9px;letter-spacing:1px;text-transform:uppercase;color:var(--dim);margin-bottom:3px}
.di .dv{font-size:11px;color:var(--text)}
.di .dv a{color:var(--accent);text-decoration:none;word-break:break-all}
.di .dv a:hover{text-decoration:underline}
.desc{font-size:11px;color:var(--dim);line-height:1.65;padding:10px;background:var(--surface2);border-radius:6px}
#tcount{margin-top:8px;font-size:10px;color:var(--dim);display:flex;justify-content:space-between;align-items:center;flex-wrap:wrap;gap:8px}
.toolbar-btns{display:flex;gap:6px}
.btn-sm{padding:5px 10px;background:var(--surface);border:1px solid var(--border);border-radius:6px;color:var(--text);font-family:var(--mono);font-size:10px;cursor:pointer;transition:all .2s}
.btn-sm:hover{border-color:rgba(0,255,136,.35);color:var(--accent)}
.cmp-grid{display:grid;grid-template-columns:1fr 1fr;gap:14px;margin-bottom:14px}
.scores{display:flex;flex-direction:column;gap:10px}
.mrow{background:var(--surface);border:1px solid var(--border);border-radius:10px;padding:14px;transition:all .2s;cursor:default}
.mrow:hover{border-color:rgba(0,255,136,.25);background:rgba(0,255,136,.03)}
.mrh{display:flex;justify-content:space-between;align-items:center;margin-bottom:8px}
.mname{font-size:13px;color:#fff}
.mscore{font-size:22px;font-weight:bold}
.sbar{height:5px;background:var(--border);border-radius:3px;overflow:hidden;margin-bottom:6px}
.sfill{height:100%;border-radius:3px;transition:width 1s cubic-bezier(.4,0,.2,1)}
.msub{font-size:9px;color:var(--dim)}
.drop{border:2px dashed var(--border);border-radius:12px;padding:40px;text-align:center;cursor:pointer;transition:all .2s;background:var(--surface);margin-bottom:18px}
.drop:hover,.drop.over{border-color:rgba(0,255,136,.35);background:rgba(0,255,136,.025)}
.drop-ico{font-size:38px;margin-bottom:12px}
.drop h3{color:var(--text);font-size:13px;margin-bottom:6px}
.drop p{color:var(--dim);font-size:11px}
.fmts{display:flex;gap:8px;justify-content:center;margin-top:12px}
.fmt{padding:3px 10px;border-radius:4px;font-size:9px;letter-spacing:1px;background:var(--surface2);border:1px solid var(--border);color:var(--dim)}
.fbtn{display:inline-block;margin-top:14px;padding:8px 18px;background:rgba(0,255,136,.09);border:1px solid rgba(0,255,136,.25);border-radius:8px;color:var(--accent);font-family:var(--mono);font-size:11px;cursor:pointer;transition:all .2s;letter-spacing:1px}
.fbtn:hover{background:rgba(0,255,136,.18)}
.preview{background:var(--surface);border:1px solid var(--border);border-radius:12px;padding:14px;max-height:280px;overflow:auto;font-size:10px;color:var(--dim)}
.preview pre{white-space:pre-wrap;word-break:break-all}
.actions{display:flex;gap:10px;margin-top:14px}
.btn{padding:9px 18px;border-radius:8px;font-family:var(--mono);font-size:11px;cursor:pointer;transition:all .2s;letter-spacing:1px;border:none}
.btn-merge{background:rgba(0,255,136,.09);color:var(--accent);border:1px solid rgba(0,255,136,.25)}
.btn-replace{background:rgba(255,51,102,.1);color:var(--red);border:1px solid rgba(255,51,102,.25)}
.btn-merge:hover{background:rgba(0,255,136,.18)}.btn-replace:hover{background:rgba(255,51,102,.2)}
.schema{background:var(--surface);border:1px solid var(--border);border-radius:12px;padding:14px;font-size:10px;color:var(--dim);margin-top:20px}
.schema pre{white-space:pre-wrap;line-height:1.7}
.toast{position:fixed;bottom:22px;right:22px;padding:11px 18px;background:var(--surface2);border:1px solid rgba(0,255,136,.28);border-radius:10px;color:var(--accent);font-size:11px;z-index:999;transform:translateY(80px);opacity:0;transition:all .3s}
.toast.show{transform:translateY(0);opacity:1}
.disclaimer{background:rgba(255,51,102,.05);border:1px solid rgba(255,51,102,.25);border-radius:12px;padding:16px;margin-top:18px;font-size:10px;color:var(--dim);line-height:1.7}
.disclaimer strong{color:var(--red)}
.ref-list{display:flex;flex-direction:column;gap:10px}
.ref{background:var(--surface);border:1px solid var(--border);border-radius:10px;padding:14px;transition:all .2s}
.ref:hover{border-color:rgba(0,255,136,.25)}
.ref h4{color:#fff;font-size:12px;margin-bottom:4px}
.ref .rauth{color:var(--dim);font-size:10px;margin-bottom:8px}
.ref a{color:var(--accent);font-size:10px;word-break:break-all;text-decoration:none}
.ref a:hover{text-decoration:underline}
.ref p{color:var(--dim);font-size:10px;margin-top:8px;line-height:1.5}
@media(max-width:800px){.kpi-grid{grid-template-columns:repeat(2,1fr)}.cg2,.cg2b,.cmp-grid{grid-template-columns:1fr}.dg{grid-template-columns:1fr}}
::-webkit-scrollbar{width:5px;height:5px}::-webkit-scrollbar-track{background:var(--surface)}::-webkit-scrollbar-thumb{background:var(--border);border-radius:3px}
</style>
</head>
<body>
<canvas id="bg"></canvas>
<div class="app">
<header>
<div class="logo">
<div class="logo-icon">🤖</div>
<div>
<h1>Unitree CVE Dashboard</h1>
<p>Robustness Analysis · CVE Intelligence · Multi-Model</p>
</div>
</div>
<div class="badge"><div class="dot"></div><span id="src-lbl">PUBLIC NVD DATA</span></div>
</header>
<div class="tabs">
<button class="tab active" onclick="tab('dashboard')">📊 Dashboard <span class="kbd">1</span></button>
<button class="tab" onclick="tab('explorer')">🔍 Explorer <span class="kbd">2</span></button>
<button class="tab" onclick="tab('comparison')">⚔️ Comparison <span class="kbd">3</span></button>
<button class="tab" onclick="tab('loader')">📂 Load <span class="kbd">4</span></button>
</div>
<!-- ══ DASHBOARD ══ -->
<div class="panel active" id="panel-dashboard">
<div class="kpi-grid">
<div class="kpi c1"><div class="kpi-lbl">Total CVEs</div><div class="kpi-val" id="k-total">—</div><div class="kpi-sub">public disclosures</div></div>
<div class="kpi c2"><div class="kpi-lbl">Critical</div><div class="kpi-val" id="k-crit">—</div><div class="kpi-sub">CVSS ≥ 9.0</div></div>
<div class="kpi c3"><div class="kpi-lbl">Avg CVSS</div><div class="kpi-val" id="k-cvss">—</div><div class="kpi-sub">weighted score</div></div>
<div class="kpi c4"><div class="kpi-lbl">Models</div><div class="kpi-val" id="k-models">—</div><div class="kpi-sub">unique targets</div></div>
</div>
<div class="cg2">
<div class="card"><h3>Severity Distribution</h3><div class="cw"><canvas id="ch-sev"></canvas></div></div>
<div class="card"><h3>CVE Timeline by Severity</h3><div class="cw"><canvas id="ch-time"></canvas></div></div>
</div>
<div class="cg2b">
<div class="card"><h3>Attack Vector Breakdown</h3><div class="cw"><canvas id="ch-vec"></canvas></div></div>
<div class="card"><h3>CVEs per Model</h3><div class="cw"><canvas id="ch-mod"></canvas></div></div>
</div>
<div class="disclaimer">
<strong>⚠️ ETHICAL USE DISCLAIMER:</strong> This dashboard aggregates <em>publicly disclosed</em> vulnerabilities from NIST NVD and security research publications for <strong>defensive research, blue-team operations, and educational purposes</strong>. Do not use this information to attack devices you do not own or have explicit written authorization to test. Physical AI hacking carries real-world safety risks — compromise of a robot's motion or perception stack can cause physical harm to people and property. Always follow responsible disclosure.
</div>
</div>
<!-- ══ EXPLORER ══ -->
<div class="panel" id="panel-explorer">
<div class="controls">
<input type="text" id="s-search" placeholder="🔍 Search CVE, component, CWE, description…" oninput="renderTable()">
<select id="s-model" onchange="renderTable()"><option value="">All Models</option></select>
<select id="s-sev" onchange="renderTable()">
<option value="">All Severities</option>
<option>CRITICAL</option><option>HIGH</option><option>MEDIUM</option><option>LOW</option>
</select>
<select id="s-vec" onchange="renderTable()">
<option value="">All Vectors</option>
<option>Network</option><option>Adjacent</option><option>Local</option><option>Physical</option>
</select>
</div>
<div class="table-wrap">
<div class="table-scroll">
<table>
<thead>
<tr>
<th onclick="sortBy('id')">CVE ID ↕</th>
<th onclick="sortBy('model')">Model ↕</th>
<th onclick="sortBy('component')">Component ↕</th>
<th onclick="sortBy('cvss')">CVSS ↕</th>
<th onclick="sortBy('severity')">Severity ↕</th>
<th onclick="sortBy('vector')">Vector ↕</th>
<th onclick="sortBy('published')">Published ↕</th>
</tr>
</thead>
<tbody id="tbody"></tbody>
</table>
</div>
</div>
<div id="tcount">
<span id="tcount-txt"></span>
<div class="toolbar-btns">
<button class="btn-sm" onclick="exportCSV()">⬇ CSV</button>
<button class="btn-sm" onclick="exportJSON()">⬇ JSON</button>
</div>
</div>
</div>
<!-- ══ COMPARISON ══ -->
<div class="panel" id="panel-comparison">
<div class="cmp-grid">
<div>
<div style="font-size:9px;letter-spacing:2px;text-transform:uppercase;color:var(--dim);margin-bottom:14px">Model Robustness Scores</div>
<div class="scores" id="scores"></div>
</div>
<div class="card"><h3>Attack Surface Radar</h3><div class="cw-sm"><canvas id="ch-radar"></canvas></div></div>
</div>
<div class="card"><h3>Avg CVSS vs Max CVSS per Model</h3><div class="cw"><canvas id="ch-box"></canvas></div></div>
</div>
<!-- ══ LOADER ══ -->
<div class="panel" id="panel-loader">
<div class="drop" id="drop">
<div class="drop-ico">📂</div>
<h3>Drop your CVE database here</h3>
<p>Drag & drop or click to browse — merge or replace the active dataset</p>
<div class="fmts">
<span class="fmt">JSON</span><span class="fmt">JSONL</span><span class="fmt">CSV</span><span class="fmt">PARQUET</span>
</div>
<label class="fbtn">Browse Files
<input type="file" id="file-input" accept=".json,.jsonl,.csv,.parquet" style="display:none" onchange="onFile(event)">
</label>
</div>
<div id="preview-wrap" style="display:none">
<div style="display:flex;justify-content:space-between;align-items:center;margin-bottom:10px">
<span style="font-size:11px;color:var(--dim)" id="p-label"></span>
<span style="font-size:10px;color:var(--accent)" id="p-count"></span>
</div>
<div class="preview" id="preview"></div>
<div class="actions">
<button class="btn btn-merge" onclick="applyData('merge')">⊕ Merge with existing</button>
<button class="btn btn-replace" onclick="applyData('replace')">⟳ Replace all data</button>
</div>
</div>
<div class="schema">
<div style="font-size:9px;letter-spacing:2px;text-transform:uppercase;color:var(--dim);margin-bottom:10px">Expected JSON Schema</div>
<pre>{
"id": "CVE-2026-27509", // required
"model": "Go2", // required
"component": "DDS actuator_manager", // required
"cvss": 9.1, // required (0.0 – 10.0)
"severity": "CRITICAL", // CRITICAL | HIGH | MEDIUM | LOW
"vector": "Network", // Network | Adjacent | Local | Physical
"description": "...", // optional
"published": "2026-02-27", // optional YYYY-MM-DD
"status": "Patched", // optional
"cwe": "CWE-306", // optional
"references": ["https://nvd.nist.gov/vuln/detail/CVE-XXXX-XXXXX"] // optional
}
For Parquet / CSV, use the same column names.
Column aliases supported: cve_id → id, score → cvss, robot / product → model.</pre>
</div>
<div class="card" style="margin-top:20px">
<h3>📚 NIST NVD — Official CVE Records</h3>
<div class="ref-list" style="margin-top:14px">
<div class="ref">
<h4>NIST National Vulnerability Database</h4>
<div class="rauth">nvd.nist.gov · Authoritative source for all CVE records</div>
<a href="https://nvd.nist.gov/" target="_blank" rel="noopener">nvd.nist.gov</a>
<p>All CVE identifiers and CVSS scores in this dashboard are sourced from the NIST National Vulnerability Database. Individual CVE detail pages are linked directly in each record.</p>
</div>
</div>
</div>
</div>
</div>
<div class="toast" id="toast"></div>
<script>
// ═══════════════════════════════════════════════════════
// REAL CVE DATA (from NIST NVD — public disclosures)
// ═══════════════════════════════════════════════════════
const REAL_CVES = [
// ── Go2 DDS + Mobile RCEs ──
{
id:"CVE-2026-27509", model:"Go2", component:"DDS actuator_manager",
cvss:9.1, severity:"CRITICAL", vector:"Network",
description:"Unauthenticated RCE as root on Go2 firmware V1.1.7-V1.1.11 (EDU). Attacker on LAN joins DDS domain 0 and publishes a malicious Request_ to topic rt/api/programming_actuator/request (api_id=1002), writing arbitrary Python to /unitree/etc/programming/ and binding it to a controller hotkey (R1+Y). Pressing the hotkey executes the script as root with no input validation.",
published:"2026-02-27", status:"Patched (V1.1.13)",
cwe:"CWE-306 / CWE-94",
references:["https://nvd.nist.gov/vuln/detail/CVE-2026-27509"]
},
{
id:"CVE-2026-27510", model:"Go2", component:"Android App / actuator",
cvss:6.4, severity:"MEDIUM", vector:"Local",
description:"Tampering with the Unitree Go2 Android app's local SQLite database (Blockly preprogrammed action blocks) leads to root RCE on the paired robot when a controller keybinding is pressed. Affects firmware V1.1.7-V1.1.11. Patched in V1.1.13 OTA.",
published:"2026-02-27", status:"Patched (V1.1.13)",
cwe:"CWE-94",
references:["https://nvd.nist.gov/vuln/detail/CVE-2026-27510"]
},
// ── G1 BLE chains ──
{
id:"CVE-2026-76639", model:"G1 EDU", component:"BLE / chat_go / bashrunner",
cvss:9.8, severity:"CRITICAL", vector:"Adjacent",
description:"Chained root RCE on G1 EDU humanoid. Attacker triggers cloud-oracle AES key leak via chat_go, hijacks WiFi config, leaks btgatt-server PIE base via bashrunner, then exploits a BLE GATT overflow to call system(reverse-shell). Runs as root pre-pairing.",
published:"2026-08-28", status:"Unverified Fix",
cwe:"CWE-787 / CWE-20 / CWE-78",
references:["https://nvd.nist.gov/vuln/detail/CVE-2026-76639"]
},
{
id:"CVE-2026-76640", model:"G1 EDU", component:"BLE GATT / WiFi stack",
cvss:9.1, severity:"CRITICAL", vector:"Adjacent",
description:"Separate RCE chain on G1 EDU firmware ≤1.5.2 combining BLE GATT server overflow with WiFi provisioning logic. Achieves root shell before pairing completes. Wormable to other G1 units in BLE range.",
published:"2026-08-28", status:"Unverified Fix",
cwe:"CWE-787 / CWE-78",
references:["https://nvd.nist.gov/vuln/detail/CVE-2026-76640"]
},
// ── UniPwn BLE wormable ──
{
id:"CVE-2025-60017", model:"Go2 / G1 / H1 / B2", component:"BLE WiFi config",
cvss:9.8, severity:"CRITICAL", vector:"Adjacent",
description:"Wormable BLE command injection across all modern Unitree platforms sharing common firmware. Hardcoded AES key (df98b715d5c6ed2b25817b6f2554124a) and trivial 'unitree' handshake bypass authentication. Attacker injects shell payload via SSID/password fields, triggered by country-code instruction, executed via system() in wpa_supplicant_restart.sh / hostapd_restart.sh as root.",
published:"2025-09-20", status:"In Progress",
cwe:"CWE-78 / CWE-798 / CWE-287",
references:["https://nvd.nist.gov/vuln/detail/CVE-2025-60017"]
},
{
id:"CVE-2025-35027", model:"Go2 / G1 / H1 / B2", component:"BLE WiFi service",
cvss:7.3, severity:"HIGH", vector:"Adjacent",
description:"OS command injection in shared Unitree firmware. Malicious WiFi SSID/password set via the custom BLE service (UUID 0000ffe0) is passed unsanitized to shell scripts restarting wpa_supplicant and hostapd. Attacker within BLE range achieves root code execution after WiFi service restart.",
published:"2025-09-26", status:"In Progress",
cwe:"CWE-78",
references:["https://nvd.nist.gov/vuln/detail/CVE-2025-35027"]
},
{
id:"CVE-2025-60250", model:"Go2 / G1 / H1 / B2", component:"BLE firmware",
cvss:8.1, severity:"HIGH", vector:"Adjacent",
description:"Authentication bypass in Unitree BLE service due to static AES key shared across all devices. Allows any attacker within radio range to authenticate as legitimate client and send privileged configuration instructions.",
published:"2025-09-25", status:"In Progress",
cwe:"CWE-798 / CWE-287",
references:["https://nvd.nist.gov/vuln/detail/CVE-2025-60250"]
},
// ── Go1 backdoor ──
{
id:"CVE-2025-2894", model:"Go1", component:"CloudSail remote access",
cvss:6.6, severity:"MEDIUM", vector:"Network",
description:"Undocumented backdoor in Go1 quadruped. The CloudSail remote access service accepts a hardcoded API key, allowing the manufacturer — or anyone in possession of the key — to take complete remote control of the robot over the internet, bypassing user-facing authentication.",
published:"2025-03-28", status:"Disputed ('leftover code')",
cwe:"CWE-912",
references:["https://nvd.nist.gov/vuln/detail/CVE-2025-2894"]
},
// ── A1 authentication issues ──
{
id:"CVE-2023-3103", model:"A1", component:"Camera video stream",
cvss:8.0, severity:"HIGH", vector:"Adjacent",
description:"Authentication bypass on the A1 robot allows an adjacent attacker to perform a MITM attack on the camera video stream. If exploited, the attack can also consume robot resources leading to a denial-of-service condition.",
published:"2023-11-22", status:"Patched",
cwe:"CWE-290",
references:["https://nvd.nist.gov/vuln/detail/CVE-2023-3103"]
},
{
id:"CVE-2023-3104", model:"A1", component:"Web server / camera feed",
cvss:7.5, severity:"HIGH", vector:"Network",
description:"Missing authentication on the A1's embedded web server. Any unauthenticated remote user on the LAN can view the live camera feed of the robot, enabling passive surveillance of its visual sensors.",
published:"2023-11-22", status:"Patched",
cwe:"CWE-306",
references:["https://nvd.nist.gov/vuln/detail/CVE-2023-3104"]
},
// ── Additional ──
{
id:"CVE-2025-60251", model:"Go2 / G1 / H1 / B2", component:"SDK IPC",
cvss:7.5, severity:"HIGH", vector:"Network",
description:"Static IPC encryption key distributed in the Unitree SDK allows any SDK holder to decrypt all inter-module communication traffic on the robot's internal network, exposing control commands and sensor data.",
published:"2025-09-25", status:"In Progress",
cwe:"CWE-321",
references:["https://nvd.nist.gov/vuln/detail/CVE-2025-60251"]
},
];
// ═══════════════ STATE ═══════════════
let cves = [...REAL_CVES];
let pending = null;
let sort = {col:'cvss', dir:-1};
let charts = {};
// ═══════════════ ANIMATED BG ═══════════════
(function(){
const c = document.getElementById('bg'), ctx = c.getContext('2d');
let W,H,pts=[];
function resize(){W=c.width=innerWidth;H=c.height=innerHeight}
function init(){pts=Array.from({length:70},()=>({x:Math.random()*W,y:Math.random()*H,vx:(Math.random()-.5)*.35,vy:(Math.random()-.5)*.35,r:Math.random()*1.8+.4,a:Math.random()*.45+.08}))}
function draw(){
ctx.clearRect(0,0,W,H);
pts.forEach(p=>{
p.x=(p.x+p.vx+W)%W; p.y=(p.y+p.vy+H)%H;
ctx.beginPath();ctx.arc(p.x,p.y,p.r,0,6.28);
ctx.fillStyle=`rgba(0,255,136,${p.a})`;ctx.fill();
});
for(let i=0;i<pts.length;i++)for(let j=i+1;j<pts.length;j++){
const dx=pts[i].x-pts[j].x,dy=pts[i].y-pts[j].y,d=Math.sqrt(dx*dx+dy*dy);
if(d<115){ctx.beginPath();ctx.moveTo(pts[i].x,pts[i].y);ctx.lineTo(pts[j].x,pts[j].y);ctx.strokeStyle=`rgba(0,255,136,${.07*(1-d/115)})`;ctx.lineWidth=.5;ctx.stroke()}
}
requestAnimationFrame(draw);
}
resize();init();draw();
addEventListener('resize',()=>{resize();init()});
})();
// ═══════════════ UTILS ═══════════════
const PALETTE=['#ff3366','#ff8c42','#ffd166','#00b4d8','#00ff88','#7b2fff','#06d6a0','#ef476f'];
function sevColor(s){return{CRITICAL:'#ff3366',HIGH:'#ff8c42',MEDIUM:'#ffd166',LOW:'#00b4d8',INFO:'#8b949e'}[s]||'#8b949e'}
function cvssColor(v){if(v>=9)return'#ff3366';if(v>=7)return'#ff8c42';if(v>=4)return'#ffd166';return'#00b4d8'}
function sevRank(s){return{CRITICAL:0,HIGH:1,MEDIUM:2,LOW:3,INFO:4}[s]??5}
function robustness(model){
const m=cves.filter(c=>c.model===model||(c.model||'').split('/').map(x=>x.trim()).includes(model));
if(!m.length)return 100;
const avg=m.reduce((a,b)=>a+b.cvss,0)/m.length;
const crit=m.filter(c=>c.severity==='CRITICAL').length;
const hi=m.filter(c=>c.severity==='HIGH').length;
return Math.max(0,Math.min(100,Math.round(100-avg*5-crit*6-hi*2-m.length*.5)));
}
function robColor(s){return s>=70?'#00ff88':s>=40?'#ffd166':'#ff3366'}
function toast(msg){const el=document.getElementById('toast');el.textContent=msg;el.classList.add('show');setTimeout(()=>el.classList.remove('show'),3000)}
function countAnim(id,n){const el=document.getElementById(id);if(!el)return;let i=0;const s=Math.max(1,Math.ceil(n/28));const t=setInterval(()=>{i=Math.min(i+s,n);el.textContent=Number.isInteger(n)?i:i.toFixed(1);if(i>=n)clearInterval(t)},30)}
function kill(k){if(charts[k]){try{charts[k].destroy()}catch(e){}delete charts[k]}}
function uniq(arr){return[...new Set(arr)]}
function esc(s){return String(s||'').replace(/[&<>"]/g,c=>({'&':'&amp;','<':'&lt;','>':'&gt;','"':'&quot;'}[c]))}
function getModels(){
const set=new Set();
cves.forEach(c=>{
(c.model||'').split('/').map(x=>x.trim()).filter(Boolean).forEach(m=>set.add(m));
});
return [...set].sort();
}
// ═══════════════ TAB + KB SHORTCUTS ═══════════════
function tab(id){
document.querySelectorAll('.tab').forEach(t=>t.classList.remove('active'));
document.querySelectorAll('.panel').forEach(p=>p.classList.remove('active'));
document.querySelector(`.tab[onclick="tab('${id}')"]`)?.classList.add('active');
document.getElementById('panel-'+id)?.classList.add('active');
if(id==='comparison')renderComparison();
if(id==='dashboard')renderDashboard();
if(id==='explorer')renderTable();
}
document.addEventListener('keydown',e=>{
if(e.target.tagName==='INPUT'||e.target.tagName==='TEXTAREA')return;
if(e.key==='1')tab('dashboard');
else if(e.key==='2')tab('explorer');
else if(e.key==='3')tab('comparison');
else if(e.key==='4')tab('loader');
else if(e.key==='Escape'){document.querySelectorAll('.detail.open').forEach(d=>d.classList.remove('open'));}
});
// ═══════════════ CHART DEFAULTS ═══════════════
Chart.defaults.color='#8b949e';
Chart.defaults.font.family='Courier New';
Chart.defaults.borderColor='#21262d';
Chart.defaults.plugins.tooltip.backgroundColor='#0d1117';
Chart.defaults.plugins.tooltip.borderColor='#21262d';
Chart.defaults.plugins.tooltip.borderWidth=1;
Chart.defaults.plugins.tooltip.titleColor='#fff';
Chart.defaults.plugins.tooltip.bodyColor='#c9d1d9';
Chart.defaults.plugins.tooltip.padding=10;
// ═══════════════ DASHBOARD ═══════════════
function renderDashboard(){
const n=cves.length,crit=cves.filter(c=>c.severity==='CRITICAL').length;
const avg=n?(cves.reduce((a,b)=>a+b.cvss,0)/n):0;
const models=getModels().length;
document.getElementById('src-lbl').textContent=`${n} CVEs · ${models} MODELS`;
countAnim('k-total',n);countAnim('k-crit',crit);
countAnim('k-cvss',+avg.toFixed(1));countAnim('k-models',models);
mkSev();mkTime();mkVec();mkMod();
}
function mkSev(){
kill('sev');
const cnt={};cves.forEach(c=>{cnt[c.severity]=(cnt[c.severity]||0)+1});
const lbls=['CRITICAL','HIGH','MEDIUM','LOW'];
const cols=lbls.map(l=>sevColor(l));
charts.sev=new Chart(document.getElementById('ch-sev'),{type:'doughnut',data:{labels:lbls,datasets:[{data:lbls.map(l=>cnt[l]||0),backgroundColor:cols.map(c=>c+'aa'),borderColor:cols,borderWidth:2}]},options:{responsive:true,maintainAspectRatio:false,plugins:{legend:{position:'bottom',labels:{color:'#8b949e',font:{size:9,family:'Courier New'},boxWidth:10}}},animation:{duration:700}}});
}
function mkTime(){
kill('time');
const yrs={};cves.forEach(c=>{const y=c.published?.substring(0,7)||'?';if(!yrs[y])yrs[y]={CRITICAL:0,HIGH:0,MEDIUM:0,LOW:0};yrs[y][c.severity]=(yrs[y][c.severity]||0)+1});
const lbls=Object.keys(yrs).sort();
const sevs=['CRITICAL','HIGH','MEDIUM','LOW'];
charts.time=new Chart(document.getElementById('ch-time'),{type:'bar',data:{labels:lbls,datasets:sevs.map(s=>({label:s,data:lbls.map(y=>yrs[y][s]||0),backgroundColor:sevColor(s)+'88',borderColor:sevColor(s),borderWidth:1,borderRadius:3}))},options:{responsive:true,maintainAspectRatio:false,plugins:{legend:{labels:{color:'#8b949e',font:{size:9,family:'Courier New'},boxWidth:10}}},scales:{x:{stacked:true,grid:{color:'#21262d'},ticks:{color:'#8b949e',font:{size:9}}},y:{stacked:true,grid:{color:'#21262d'},ticks:{color:'#8b949e',font:{size:9}}}},animation:{duration:700}}});
}
function mkVec(){
kill('vec');
const cnt={};cves.forEach(c=>{cnt[c.vector]=(cnt[c.vector]||0)+1});
const lbls=Object.keys(cnt);
charts.vec=new Chart(document.getElementById('ch-vec'),{type:'bar',data:{labels:lbls,datasets:[{data:Object.values(cnt),backgroundColor:lbls.map((_,i)=>PALETTE[i%PALETTE.length]+'88'),borderColor:lbls.map((_,i)=>PALETTE[i%PALETTE.length]),borderWidth:2,borderRadius:5}]},options:{indexAxis:'y',responsive:true,maintainAspectRatio:false,plugins:{legend:{display:false}},scales:{x:{grid:{color:'#21262d'},ticks:{color:'#8b949e',font:{size:9}}},y:{grid:{display:false},ticks:{color:'#8b949e',font:{size:9,family:'Courier New'}}}},animation:{duration:700}}});
}
function mkMod(){
kill('mod');
const cnt={};
cves.forEach(c=>{(c.model||'').split('/').map(x=>x.trim()).filter(Boolean).forEach(m=>{cnt[m]=(cnt[m]||0)+1})});
const lbls=Object.keys(cnt).sort((a,b)=>cnt[b]-cnt[a]);
charts.mod=new Chart(document.getElementById('ch-mod'),{type:'bar',data:{labels:lbls,datasets:[{data:lbls.map(l=>cnt[l]),backgroundColor:lbls.map((_,i)=>PALETTE[i%PALETTE.length]+'88'),borderColor:lbls.map((_,i)=>PALETTE[i%PALETTE.length]),borderWidth:2,borderRadius:5}]},options:{responsive:true,maintainAspectRatio:false,plugins:{legend:{display:false}},scales:{x:{grid:{display:false},ticks:{color:'#8b949e',font:{size:9,family:'Courier New'}}},y:{grid:{color:'#21262d'},ticks:{color:'#8b949e',font:{size:9}}}},animation:{duration:700}}});
}
// ═══════════════ EXPLORER ═══════════════
function sortBy(col){
if(sort.col===col){sort.dir*=-1}else{sort.col=col;sort.dir=(col==='cvss'||col==='published')?-1:1}
renderTable();
}
function filterCves(){
const q=document.getElementById('s-search').value.toLowerCase();
const fm=document.getElementById('s-model').value;
const fs=document.getElementById('s-sev').value;
const fv=document.getElementById('s-vec').value;
return cves.filter(c=>{
const haystack=[c.id,c.model,c.component,c.description,c.cwe,(c.references||[]).join(' ')].join(' ').toLowerCase();
const ms=!q||haystack.includes(q);
const models=(c.model||'').split('/').map(x=>x.trim());
return ms&&(!fm||models.includes(fm))&&(!fs||c.severity===fs)&&(!fv||c.vector===fv);
});
}
function renderTable(){
let rows=filterCves();
rows.sort((a,b)=>{
let va=a[sort.col],vb=b[sort.col];
if(sort.col==='severity'){va=sevRank(va);vb=sevRank(vb)}
if(va==null)va='';if(vb==null)vb='';
if(typeof va==='string')return sort.dir*va.localeCompare(vb);
return sort.dir*(vb-va);
});
document.getElementById('tbody').innerHTML=rows.map((c,i)=>{
const refs=(c.references||[]).map(r=>`<a href="${esc(r)}" target="_blank" rel="noopener" onclick="event.stopPropagation()">${esc(r)}</a>`).join('<br>')||'—';
return `<tr class="data-row" onclick="tog('d${i}')">
<td style="color:#fff;font-weight:bold">${esc(c.id)}</td>
<td>${esc(c.model)}</td><td>${esc(c.component)}</td>
<td><div class="cbar"><span style="color:${cvssColor(c.cvss)};font-weight:bold">${c.cvss}</span><div class="ctrack"><div class="cfill" style="width:${c.cvss*10}%;background:${cvssColor(c.cvss)}"></div></div></div></td>
<td><span class="sev s-${c.severity}">${esc(c.severity)}</span></td>
<td style="color:var(--dim)">${esc(c.vector)}</td>
<td style="color:var(--dim)">${esc(c.published)||'—'}</td>
</tr>
<tr class="detail-row"><td colspan="7"><div class="detail" id="d${i}">
<div class="dg">
<div class="di"><div class="dl">CWE</div><div class="dv">${esc(c.cwe)||'—'}</div></div>
<div class="di"><div class="dl">Status</div><div class="dv">${esc(c.status)||'—'}</div></div>
<div class="di"><div class="dl">References</div><div class="dv">${refs}</div></div>
</div>
${c.description?`<div class="desc">📋 ${esc(c.description)}</div>`:''}
</div></td></tr>`;
}).join('');
document.getElementById('tcount-txt').textContent=`Showing ${rows.length} of ${cves.length} CVEs`;
}
function tog(id){const el=document.getElementById(id);if(el)el.classList.toggle('open')}
function populateFilters(){
const sel=document.getElementById('s-model');
const cur=sel.value;
const models=getModels();
sel.innerHTML='<option value="">All Models</option>'+models.map(m=>`<option ${m===cur?'selected':''}>${esc(m)}</option>`).join('');
}
// ═══════════════ EXPORT ═══════════════
function exportCSV(){
const rows=filterCves();
const cols=['id','model','component','cvss','severity','vector','published','cwe','status','description','references'];
const csv=[cols.join(',')].concat(rows.map(r=>cols.map(c=>{
let v=r[c]??'';if(Array.isArray(v))v=v.join(';');
v=String(v).replace(/"/g,'""');
return /[",\n]/.test(v)?`"${v}"`:v;
}).join(','))).join('\n');
download(csv,'unitree-cves.csv','text/csv');
toast(`✓ Exported ${rows.length} rows as CSV`);
}
function exportJSON(){
const rows=filterCves();
download(JSON.stringify(rows,null,2),'unitree-cves.json','application/json');
toast(`✓ Exported ${rows.length} rows as JSON`);
}
function download(content,name,type){
const blob=new Blob([content],{type});
const url=URL.createObjectURL(blob);
const a=document.createElement('a');a.href=url;a.download=name;a.click();
setTimeout(()=>URL.revokeObjectURL(url),1000);
}
// ═══════════════ COMPARISON ═══════════════
function renderComparison(){
const models=getModels();
document.getElementById('scores').innerHTML=models.map(m=>{
const sc=robustness(m),col=robColor(sc);
const n=cves.filter(c=>(c.model||'').split('/').map(x=>x.trim()).includes(m)).length;
const cr=cves.filter(c=>(c.model||'').split('/').map(x=>x.trim()).includes(m)&&c.severity==='CRITICAL').length;
return `<div class="mrow"><div class="mrh"><span class="mname">Unitree ${esc(m)}</span><span class="mscore" style="color:${col}">${sc}<small style="font-size:12px">/100</small></span></div><div class="sbar"><div class="sfill" style="width:${sc}%;background:${col}"></div></div><div class="msub">${n} CVE${n!==1?'s':''} · ${cr} critical</div></div>`;
}).join('');
kill('radar');
const dims=['Network','Adjacent','Local','Physical'];
charts.radar=new Chart(document.getElementById('ch-radar'),{type:'radar',data:{labels:dims,datasets:models.map((m,i)=>{
const mc=cves.filter(c=>(c.model||'').split('/').map(x=>x.trim()).includes(m));
return{label:m,data:dims.map(d=>mc.filter(c=>c.vector===d).reduce((a,b)=>a+b.cvss,0)),borderColor:PALETTE[i%PALETTE.length],backgroundColor:PALETTE[i%PALETTE.length]+'20',borderWidth:2,pointBackgroundColor:PALETTE[i%PALETTE.length],pointRadius:3};
})},options:{responsive:true,maintainAspectRatio:false,plugins:{legend:{labels:{color:'#8b949e',font:{size:9,family:'Courier New'},boxWidth:10}}},scales:{r:{grid:{color:'#21262d'},ticks:{display:false},pointLabels:{color:'#8b949e',font:{size:10,family:'Courier New'}},angleLines:{color:'#21262d'}}},animation:{duration:700}}});
kill('box');
const md=models.map(m=>{const mc=cves.filter(c=>(c.model||'').split('/').map(x=>x.trim()).includes(m));return{m,avg:mc.reduce((a,b)=>a+b.cvss,0)/mc.length,max:Math.max(...mc.map(c=>c.cvss))};}).sort((a,b)=>b.avg-a.avg);
charts.box=new Chart(document.getElementById('ch-box'),{type:'bar',data:{labels:md.map(d=>d.m),datasets:[{label:'Avg CVSS',data:md.map(d=>+d.avg.toFixed(2)),backgroundColor:md.map(d=>cvssColor(d.avg)+'99'),borderColor:md.map(d=>cvssColor(d.avg)),borderWidth:2,borderRadius:4},{label:'Max CVSS',data:md.map(d=>d.max),type:'line',backgroundColor:'transparent',borderColor:md.map(d=>cvssColor(d.max)),borderWidth:1.5,pointBackgroundColor:md.map(d=>cvssColor(d.max)),pointRadius:4,tension:.3}]},options:{responsive:true,maintainAspectRatio:false,plugins:{legend:{labels:{color:'#8b949e',font:{size:9,family:'Courier New'},boxWidth:10}}},scales:{x:{grid:{display:false},ticks:{color:'#8b949e',font:{size:9,family:'Courier New'}}},y:{min:0,max:10,grid:{color:'#21262d'},ticks:{color:'#8b949e',font:{size:9}}}},animation:{duration:700}}});
}
// ═══════════════ FILE LOADER ═══════════════
const drop=document.getElementById('drop');
drop.addEventListener('dragover',e=>{e.preventDefault();drop.classList.add('over')});
drop.addEventListener('dragleave',()=>drop.classList.remove('over'));
drop.addEventListener('drop',e=>{e.preventDefault();drop.classList.remove('over');onFile({target:{files:e.dataTransfer.files}})});
async function onFile(ev){
const file=ev.target.files[0];if(!file)return;
const ext=file.name.split('.').pop().toLowerCase();
document.getElementById('p-label').textContent=`📄 ${file.name} (${(file.size/1024).toFixed(1)} KB)`;
document.getElementById('preview').innerHTML='<span style="color:var(--dim)">Parsing…</span>';
document.getElementById('preview-wrap').style.display='block';
pending=null;
try{
let raw;
if(ext==='json'){raw=normalise(JSON.parse(await file.text()))}
else if(ext==='jsonl'){raw=normalise((await file.text()).trim().split('\n').filter(Boolean).map(l=>JSON.parse(l)))}
else if(ext==='csv'){raw=normalise(parseCSV(await file.text()))}
else if(ext==='parquet'){
try{
const {parquetRead}=await import('https://esm.sh/hyparquet@1');
const rows=[];
const buf={byteLength:file.size,slice:async(s,e)=>(await file.slice(s,e).arrayBuffer())};
await parquetRead({file:buf,onComplete:d=>rows.push(...d)});
raw=normalise(rows);
}catch(e){
document.getElementById('preview').innerHTML=`<span style="color:var(--red)">⚠ Parquet read error: ${e.message}<br>Try converting to JSON/CSV first.</span>`;
return;
}
}else{
document.getElementById('preview').innerHTML='<span style="color:var(--red)">⚠ Unsupported format</span>';return;
}
pending=raw;
document.getElementById('p-count').textContent=`${raw.length} records`;
document.getElementById('preview').innerHTML=`<pre>${esc(JSON.stringify(raw.slice(0,3),null,2))}${raw.length>3?`\n…and ${raw.length-3} more`:''}</pre>`;
}catch(e){
document.getElementById('preview').innerHTML=`<span style="color:var(--red)">⚠ Parse error: ${esc(e.message)}</span>`;
}
}
function normalise(arr){
if(!Array.isArray(arr))arr=arr.data||arr.cves||Object.values(arr);
return arr.map(r=>({
id:r.id||r.cve_id||r.CVE_ID||r.cve||'CVE-UNKNOWN',
model:r.model||r.robot||r.target||r.product||'Unknown',
component:r.component||r.module||r.service||'Unknown',
cvss:parseFloat(r.cvss||r.cvss_score||r.score||0),
severity:(r.severity||r.rating||cvssToSev(parseFloat(r.cvss||0))).toUpperCase(),
vector:r.vector||r.attack_vector||r.av||'Network',
description:r.description||r.desc||r.summary||'',
published:r.published||r.date||r.publish_date||'',
status:r.status||r.fix_status||'',
cwe:r.cwe||r.cwe_id||'',
references:Array.isArray(r.references)?r.references:(r.references?[r.references]:[]),
}));
}
function cvssToSev(v){if(v>=9)return'CRITICAL';if(v>=7)return'HIGH';if(v>=4)return'MEDIUM';if(v>0)return'LOW';return'INFO'}
function parseCSV(txt){
const lines=txt.trim().split('\n');
const hdrs=lines[0].split(',').map(h=>h.trim().replace(/"/g,''));
return lines.slice(1).filter(Boolean).map(l=>{
const v=l.split(',').map(x=>x.trim().replace(/"/g,''));
const o={};hdrs.forEach((h,i)=>o[h]=v[i]||'');return o;
});
}
function applyData(mode){
if(!pending?.length){toast('No data to load');return}
cves=mode==='replace'?[...pending]:[...cves,...pending];
pending=null;
document.getElementById('preview-wrap').style.display='none';
populateFilters();renderDashboard();renderTable();
toast(`✓ ${mode==='replace'?'Replaced':'Merged'} → ${cves.length} total CVEs`);
tab('dashboard');
}
// ═══════════════ INIT ═══════════════
populateFilters();
renderDashboard();
renderTable();
</script>
</body>
</html>