https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 06 Oct 2026 09:49:07 +0000 https://cve.radiocsirt.org/vuln/cve-2026-45563 <p><strong>Affected:</strong> roxy-wi</p> <p>Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers. In versions 8.2.6.4 and prior, GET /history/&lt;service&gt;/&lt;server_ip&gt; re-uses the server_ip path parameter as a user-id when service == &#39;user&#39;, with no authorization check. Any authenticated user — even a guest in an unrelated group — can list any other user&#39;s full action audit trail (server IPs touched, configs deployed, services restarted). At time of publication, there are no publicly available patches.</p> <p><strong>Affected:</strong> roxy-wi</p> <p>Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers. In versions 8.2.6.4 and prior, GET /history/&lt;service&gt;/&lt;server_ip&gt; re-uses the server_ip path parameter as a user-id when service == &#39;user&#39;, with no authorization check. Any authenticated user — even a guest in an unrelated group — can list any other user&#39;s full action audit trail (server IPs touched, configs deployed, services restarted). At time of publication, there are no publicly available patches.</p> https://cve.radiocsirt.org/vuln/cve-2026-45563