roxy-wi vulnerabilities

CVEs per yearBy the year they were published

1. 20241
2. 202622

Newest CVEs

• CVE-2026-45569

  Roxy-WI: Path-traversal patch in commit d4d10006 is a no-op (tuple-membership bug)

  roxy-wi · roxy-wi

  High8.1
• CVE-2026-45567

  Roxy-WI: Authentication bypass via 'api' substring in URL + unauthenticated /api/gpt

  roxy-wi · roxy-wi

  High8.3
• CVE-2026-45566

  Roxy-WI: Open redirect on /login?next= via basic-auth userinfo syntax bypass

  roxy-wi · roxy-wi

  Medium6.1
• CVE-2026-45565

  Roxy-WI: EscapedString validator skips its '..' block when stripping (root cause for several path-traversal/RCE vectors)

  roxy-wi · roxy-wi

  High8.1
• CVE-2026-45564

  Roxy-WI: Authenticated RCE via 'configver' URL parameter (os.system sink in /config/versions/.../save)

  roxy-wi · roxy-wi

  High8.8
• CVE-2026-45563

  Roxy-WI: IDOR — any authenticated user can read another user's full action history

  roxy-wi · roxy-wi

  Medium4.3
• CVE-2026-45561

  Roxy-WI: SSRF in /smon/agent/<endpoint>/<server_ip> reachable to cloud metadata IPs

  roxy-wi · roxy-wi

  Medium6.5
• CVE-2026-45560

  Roxy-WI: Stored XSS in log viewer (wrap_line/highlight_word produce unescaped HTML)

  roxy-wi · roxy-wi

  Medium6.1
• CVE-2026-45559

  Roxy-WI: LDAP injection in /user/ldap/<username> (admin-only)

  roxy-wi · roxy-wi

  Medium4.9
• CVE-2026-45558

  Roxy-WI: Authenticated RCE on every managed HAProxy load balancer via `option` field config injection in section save

  roxy-wi · roxy-wi

  Critical9.9