https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2021-41551.htmlhttps://patchthecve.com/cve/CVE-2021-41551.htmlWed, 17 Jun 2026 04:08:37 +0000MEDIUM 4.9: Leostream Connection Broker 9.0.40.17 allows administrators to conduct directory traversal attacks by uploading z ZIP file that contains a symbolic link.https://patchthecve.com/cve/CVE-2021-41550.htmlhttps://patchthecve.com/cve/CVE-2021-41550.htmlWed, 17 Jun 2026 04:08:37 +0000HIGH 7.2: Leostream Connection Broker 9.0.40.17 allows administrator to upload and execute Perl code.https://patchthecve.com/cve/CVE-2021-38157.htmlhttps://patchthecve.com/cve/CVE-2021-38157.htmlWed, 17 Jun 2026 04:01:35 +0000MEDIUM 6.1: LeoStream Connection Broker 9.x before 9.0.34.3 allows Unauthenticated Reflected XSS via the /index.pl user parameter. NOTE: This vulnerability only affects products that are no longer supported by the maintainerhttps://patchthecve.com/cve/CVE-2020-26574.htmlhttps://patchthecve.com/cve/CVE-2020-26574.htmlWed, 17 Jun 2026 03:08:13 +0000CRITICAL 9.6: Leostream Connection Broker 8.2.x is affected by stored XSS. An unauthenticated attacker can inject arbitrary JavaScript code via the webquery.pl User-Agent HTTP header. It is rendered by the admins the next time they log in. The JavaScript injected can be used to force the admin to upload a malicio