https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2025-54769.htmlhttps://patchthecve.com/cve/CVE-2025-54769.htmlWed, 17 Jun 2026 09:40:40 +0000HIGH 8.8: An authenticated, read-only user can upload a file and perform a directory traversal to have the uploaded file placed in a location of their choosing. This can be used to overwrite existing PERL modules within the application to achieve remote code execution (RCE) by an attacker.https://patchthecve.com/cve/CVE-2025-54768.htmlhttps://patchthecve.com/cve/CVE-2025-54768.htmlWed, 17 Jun 2026 09:40:40 +0000MEDIUM 5.3: An API endpoint that should be limited to web application administrators is hidden from, but accessible by, lower-level read only web application users. The endpoint can be used to download logs from the appliance configuration, exposing sensitive information.https://patchthecve.com/cve/CVE-2025-54767.htmlhttps://patchthecve.com/cve/CVE-2025-54767.htmlWed, 17 Jun 2026 09:40:40 +0000MEDIUM 6.5: An authenticated, read-only user can kill any processes running on the Xormon Original virtual appliance as the lpar2rrd user.