agentprime: roxy-wiEvery new CVE for roxy-wi.https://agentprime.io/CVE-2026-45569: Roxy-WI: Path-traversal patch in commit d4d10006 is a no-op (tuple-membership bug)https://agentprime.io/advisories/CVE-2026-45569/https://agentprime.io/advisories/CVE-2026-45569/CVSS 8.1 (High). Published by the CVE Program. Not analysed by agentprime yet.Wed, 10 Jun 2026 15:38:17 GMTCVECVE-2026-45567: Roxy-WI: Authentication bypass via 'api' substring in URL + unauthenticated /api/gpthttps://agentprime.io/advisories/CVE-2026-45567/https://agentprime.io/advisories/CVE-2026-45567/CVSS 8.3 (High). Published by the CVE Program. Not analysed by agentprime yet.Wed, 10 Jun 2026 15:37:35 GMTCVECVE-2026-45566: Roxy-WI: Open redirect on /login?next= via basic-auth userinfo syntax bypasshttps://agentprime.io/advisories/CVE-2026-45566/https://agentprime.io/advisories/CVE-2026-45566/CVSS 6.1 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Wed, 10 Jun 2026 15:36:10 GMTCVECVE-2026-45565: Roxy-WI: EscapedString validator skips its '..' block when stripping (root cause for several path-traversal/RCE vectors)https://agentprime.io/advisories/CVE-2026-45565/https://agentprime.io/advisories/CVE-2026-45565/CVSS 8.1 (High). Published by the CVE Program. Not analysed by agentprime yet.Wed, 10 Jun 2026 15:34:15 GMTCVECVE-2026-45564: Roxy-WI: Authenticated RCE via 'configver' URL parameter (os.system sink in /config/versions/.../save)https://agentprime.io/advisories/CVE-2026-45564/https://agentprime.io/advisories/CVE-2026-45564/CVSS 8.8 (High). Published by the CVE Program. Not analysed by agentprime yet.Wed, 10 Jun 2026 14:04:05 GMTCVECVE-2026-45563: Roxy-WI: IDOR — any authenticated user can read another user's full action historyhttps://agentprime.io/advisories/CVE-2026-45563/https://agentprime.io/advisories/CVE-2026-45563/CVSS 4.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Wed, 10 Jun 2026 14:03:43 GMTCVECVE-2026-45561: Roxy-WI: SSRF in /smon/agent/<endpoint>/<server_ip> reachable to cloud metadata IPshttps://agentprime.io/advisories/CVE-2026-45561/https://agentprime.io/advisories/CVE-2026-45561/CVSS 6.5 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Wed, 10 Jun 2026 14:03:03 GMTCVECVE-2026-45560: Roxy-WI: Stored XSS in log viewer (wrap_line/highlight_word produce unescaped HTML)https://agentprime.io/advisories/CVE-2026-45560/https://agentprime.io/advisories/CVE-2026-45560/CVSS 6.1 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Wed, 10 Jun 2026 14:02:31 GMTCVECVE-2026-45559: Roxy-WI: LDAP injection in /user/ldap/<username> (admin-only)https://agentprime.io/advisories/CVE-2026-45559/https://agentprime.io/advisories/CVE-2026-45559/CVSS 4.9 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Wed, 10 Jun 2026 14:02:09 GMTCVECVE-2026-45558: Roxy-WI: Authenticated RCE on every managed HAProxy load balancer via `option` field config injection in section savehttps://agentprime.io/advisories/CVE-2026-45558/https://agentprime.io/advisories/CVE-2026-45558/CVSS 9.9 (Critical). Critical: CVSS score 9.9: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Wed, 10 Jun 2026 14:01:42 GMTCVEcriticalCVE-2026-45556: Roxy-WI: Authenticated arbitrary file write on every managed load balancer (and downstream RCE) via WAF rule save `config_file_name`https://agentprime.io/advisories/CVE-2026-45556/https://agentprime.io/advisories/CVE-2026-45556/CVSS 9.9 (Critical). Critical: CVSS score 9.9: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Wed, 10 Jun 2026 14:00:54 GMTCVEcriticalCVE-2026-45550: Roxy-WI: IDOR on PUT /smon/check — any user can rewrite any tenant's monitoring URL/IP/bodyhttps://agentprime.io/advisories/CVE-2026-45550/https://agentprime.io/advisories/CVE-2026-45550/CVSS 9.1 (Critical). Critical: CVSS score 9.1: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Wed, 10 Jun 2026 14:00:06 GMTCVEcriticalCVE-2026-45549: Roxy-WI: Authorization bypass on POST /smon/agent/action/<action> — guest can stop or restart smon-agent on any hosthttps://agentprime.io/advisories/CVE-2026-45549/https://agentprime.io/advisories/CVE-2026-45549/CVSS 8.5 (High). Published by the CVE Program. Not analysed by agentprime yet.Wed, 10 Jun 2026 13:59:41 GMTCVECVE-2026-45552: Roxy-WI: Cross-tenant authorization bypass on /install/* — guest can run Ansible / SSH on every registered serverhttps://agentprime.io/advisories/CVE-2026-45552/https://agentprime.io/advisories/CVE-2026-45552/CVSS 9.9 (Critical). Critical: CVSS score 9.9: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Wed, 10 Jun 2026 13:59:24 GMTCVEcriticalCVE-2026-33208: Roxy-WI Vulnerable to Authenticated Remote Code Execution via OS Command Injection in find-in-config Endpointhttps://agentprime.io/advisories/CVE-2026-33208/https://agentprime.io/advisories/CVE-2026-33208/CVSS 7.4 (High). Published by the CVE Program. Not analysed by agentprime yet.Fri, 24 Apr 2026 02:10:13 GMTCVECVE-2026-33078: Roxy-WI has SQL Injection in haproxy_section_save Endpoint via Unsanitized server_ip Parameterhttps://agentprime.io/advisories/CVE-2026-33078/https://agentprime.io/advisories/CVE-2026-33078/CVSS 8.9 (High). Published by the CVE Program. Not analysed by agentprime yet.Fri, 24 Apr 2026 02:05:02 GMTCVECVE-2026-33077: Roxy-WI has an arbitrary file read vulnerabilityhttps://agentprime.io/advisories/CVE-2026-33077/https://agentprime.io/advisories/CVE-2026-33077/CVSS 7.7 (High). Published by the CVE Program. Not analysed by agentprime yet.Fri, 24 Apr 2026 01:55:43 GMTCVECVE-2026-33076: Roxy-WI vulnerable to path traversal and arbitrary file writinghttps://agentprime.io/advisories/CVE-2026-33076/https://agentprime.io/advisories/CVE-2026-33076/CVSS 8.9 (High). Published by the CVE Program. Not analysed by agentprime yet.Fri, 24 Apr 2026 01:52:47 GMTCVECVE-2026-33432: Roxy-WI has Pre-Authentication LDAP Injection that Leads to Authentication Bypasshttps://agentprime.io/advisories/CVE-2026-33432/https://agentprime.io/advisories/CVE-2026-33432/CVSS 7.7 (High). Published by the CVE Program. Not analysed by agentprime yet.Mon, 20 Apr 2026 20:26:52 GMTCVECVE-2026-33431: Roxy-WI Vulnerable to Authenticated Arbitrary File Read via Path Traversal in Config Version Viewerhttps://agentprime.io/advisories/CVE-2026-33431/https://agentprime.io/advisories/CVE-2026-33431/CVSS 5.7 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Mon, 20 Apr 2026 20:24:15 GMTCVECVE-2026-27811: Roxy-WI has a Command Injection via diff parameter in config comparison allows authenticated RCEhttps://agentprime.io/advisories/CVE-2026-27811/https://agentprime.io/advisories/CVE-2026-27811/CVSS 8.8 (High). Published by the CVE Program. Not analysed by agentprime yet.Tue, 17 Mar 2026 23:43:05 GMTCVECVE-2026-22265: Roxy-WI has a Command Injection via grep parameter in logs.py allows authenticated RCEhttps://agentprime.io/advisories/CVE-2026-22265/https://agentprime.io/advisories/CVE-2026-22265/CVSS 7.5 (High). Published by the CVE Program. Not analysed by agentprime yet.Thu, 15 Jan 2026 16:27:52 GMTCVECVE-2024-13129: Roxy-WI roxy.py action_service os command injectionhttps://agentprime.io/advisories/CVE-2024-13129/https://agentprime.io/advisories/CVE-2024-13129/CVSS 8.7 (High). Critical: CVSS score 8.7 (7.0 or more) and EPSS 0.18 (0.1 or more): a high score and a real chance of exploitation in the next 30 days. Published by the CVE Program. Not analysed by agentprime yet.Fri, 03 Jan 2025 21:31:06 GMTCVEcriticalCVE-2024-43804: OS Command Injection via Port Scan Functionality in Roxy-WIhttps://agentprime.io/advisories/CVE-2024-43804/https://agentprime.io/advisories/CVE-2024-43804/CVSS 8.8 (High). Published by the CVE Program. Not analysed by agentprime yet.Thu, 29 Aug 2024 16:45:05 GMTCVE