https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2025-26378.htmlhttps://patchthecve.com/cve/CVE-2025-26378.htmlWed, 17 Jun 2026 09:01:40 +0000HIGH 8.8: A CWE-862 "Missing Authorization" in maxprofile/users/routes.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows an authenticated (low-privileged) attacker to reset passwords, including the ones of administrator accounts, via crafted HTTP requests.https://patchthecve.com/cve/CVE-2025-26377.htmlhttps://patchthecve.com/cve/CVE-2025-26377.htmlWed, 17 Jun 2026 09:01:40 +0000HIGH 8.1: A CWE-862 "Missing Authorization" in maxprofile/users/routes.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows an authenticated (low-privileged) attacker to remove users via crafted HTTP requests.https://patchthecve.com/cve/CVE-2025-26376.htmlhttps://patchthecve.com/cve/CVE-2025-26376.htmlWed, 17 Jun 2026 09:01:40 +0000MEDIUM 6.5: A CWE-862 "Missing Authorization" in maxprofile/users/routes.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows an authenticated (low-privileged) attacker to modify user data via crafted HTTP requests.https://patchthecve.com/cve/CVE-2025-26375.htmlhttps://patchthecve.com/cve/CVE-2025-26375.htmlWed, 17 Jun 2026 09:01:39 +0000HIGH 8.8: A CWE-862 "Missing Authorization" in maxprofile/users/routes.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows an authenticated (low-privileged) attacker to create users with arbitrary privileges via crafted HTTP requests.https://patchthecve.com/cve/CVE-2025-26374.htmlhttps://patchthecve.com/cve/CVE-2025-26374.htmlWed, 17 Jun 2026 09:01:39 +0000MEDIUM 6.5: A CWE-862 "Missing Authorization" in maxprofile/users/routes.lua (users endpoint) in Q-Free MaxTime less than or equal to version 2.11.0 allows an authenticated (low-privileged) attacker to enumerate users via crafted HTTP requests.https://patchthecve.com/cve/CVE-2025-26373.htmlhttps://patchthecve.com/cve/CVE-2025-26373.htmlWed, 17 Jun 2026 09:01:39 +0000MEDIUM 6.5: A CWE-862 "Missing Authorization" in maxprofile/users/routes.lua (user endpoint) in Q-Free MaxTime less than or equal to version 2.11.0 allows an authenticated (low-privileged) attacker to enumerate users via crafted HTTP requests.https://patchthecve.com/cve/CVE-2025-26372.htmlhttps://patchthecve.com/cve/CVE-2025-26372.htmlWed, 17 Jun 2026 09:01:39 +0000HIGH 7.1: A CWE-862 "Missing Authorization" in maxprofile/user-groups/routes.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows an authenticated (low-privileged) attacker to remove users from groups via crafted HTTP requests.https://patchthecve.com/cve/CVE-2025-26371.htmlhttps://patchthecve.com/cve/CVE-2025-26371.htmlWed, 17 Jun 2026 09:01:39 +0000HIGH 8.8: A CWE-862 "Missing Authorization" in maxprofile/user-groups/routes.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows an authenticated (low-privileged) attacker to add users to groups via crafted HTTP requests.https://patchthecve.com/cve/CVE-2025-26370.htmlhttps://patchthecve.com/cve/CVE-2025-26370.htmlWed, 17 Jun 2026 09:01:39 +0000HIGH 7.1: A CWE-862 "Missing Authorization" in maxprofile/user-groups/routes.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows an authenticated (low-privileged) attacker to remove privileges from user groups via crafted HTTP requests.https://patchthecve.com/cve/CVE-2025-26369.htmlhttps://patchthecve.com/cve/CVE-2025-26369.htmlWed, 17 Jun 2026 09:01:39 +0000HIGH 8.8: A CWE-862 "Missing Authorization" in maxprofile/user-groups/routes.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows an authenticated (low-privileged) attacker to add privileges to user groups via crafted HTTP requests.https://patchthecve.com/cve/CVE-2025-26368.htmlhttps://patchthecve.com/cve/CVE-2025-26368.htmlWed, 17 Jun 2026 09:01:39 +0000HIGH 8.1: A CWE-862 "Missing Authorization" in maxprofile/user-groups/routes.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows an authenticated (low-privileged) attacker to remove user groups via crafted HTTP requests.https://patchthecve.com/cve/CVE-2025-26367.htmlhttps://patchthecve.com/cve/CVE-2025-26367.htmlWed, 17 Jun 2026 09:01:39 +0000MEDIUM 4.3: A CWE-862 "Missing Authorization" in maxprofile/user-groups/routes.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows an authenticated (low-privileged) attacker to create arbitrary user groups via crafted HTTP requests.https://patchthecve.com/cve/CVE-2025-26366.htmlhttps://patchthecve.com/cve/CVE-2025-26366.htmlWed, 17 Jun 2026 09:01:39 +0000HIGH 7.5: A CWE-306 "Missing Authentication for Critical Function" in maxprofile/setup/routes.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows an unauthenticated remote attacker to disable front panel authentication via crafted HTTP requests.https://patchthecve.com/cve/CVE-2025-26365.htmlhttps://patchthecve.com/cve/CVE-2025-26365.htmlWed, 17 Jun 2026 09:01:38 +0000HIGH 7.5: A CWE-306 "Missing Authentication for Critical Function" in maxprofile/setup/routes.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows an unauthenticated remote attacker to enable front panel authentication via crafted HTTP requests.https://patchthecve.com/cve/CVE-2025-26364.htmlhttps://patchthecve.com/cve/CVE-2025-26364.htmlWed, 17 Jun 2026 09:01:38 +0000HIGH 7.5: A CWE-306 "Missing Authentication for Critical Function" in maxprofile/setup/routes.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows an unauthenticated remote attacker to disable an authentication profile server via crafted HTTP requests.https://patchthecve.com/cve/CVE-2025-26363.htmlhttps://patchthecve.com/cve/CVE-2025-26363.htmlWed, 17 Jun 2026 09:01:38 +0000HIGH 7.5: A CWE-306 "Missing Authentication for Critical Function" in maxprofile/setup/routes.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows an unauthenticated remote attacker to enable an authentication profile server via crafted HTTP requests.https://patchthecve.com/cve/CVE-2025-26362.htmlhttps://patchthecve.com/cve/CVE-2025-26362.htmlWed, 17 Jun 2026 09:01:38 +0000HIGH 7.5: A CWE-306 "Missing Authentication for Critical Function" in maxprofile/setup/routes.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows an unauthenticated remote attacker to set an arbitrary authentication profile server via crafted HTTP requests.https://patchthecve.com/cve/CVE-2025-26361.htmlhttps://patchthecve.com/cve/CVE-2025-26361.htmlWed, 17 Jun 2026 09:01:38 +0000CRITICAL 9.1: A CWE-306 "Missing Authentication for Critical Function" in maxprofile/setup/routes.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows an unauthenticated remote attacker to factory reset the device via crafted HTTP requests.https://patchthecve.com/cve/CVE-2025-26360.htmlhttps://patchthecve.com/cve/CVE-2025-26360.htmlWed, 17 Jun 2026 09:01:38 +0000MEDIUM 5.3: A CWE-306 "Missing Authentication for Critical Function" in maxprofile/persistance/routes.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows an unauthenticated remote attacker to delete dashboards via crafted HTTP requests.https://patchthecve.com/cve/CVE-2025-26359.htmlhttps://patchthecve.com/cve/CVE-2025-26359.htmlWed, 17 Jun 2026 09:01:38 +0000CRITICAL 9.8: A CWE-306 "Missing Authentication for Critical Function" in maxprofile/accounts/routes.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows an unauthenticated remote attacker to reset user PINs via crafted HTTP requests.https://patchthecve.com/cve/CVE-2025-26358.htmlhttps://patchthecve.com/cve/CVE-2025-26358.htmlWed, 17 Jun 2026 09:01:38 +0000MEDIUM 5.5: A CWE-15 "External Control of System or Configuration Setting" in ldbMT.so in Q-Free MaxTime less than or equal to version 2.11.0 allows an authenticated remote attacker to modify system configuration via crafted HTTP requests.https://patchthecve.com/cve/CVE-2025-26357.htmlhttps://patchthecve.com/cve/CVE-2025-26357.htmlWed, 17 Jun 2026 09:01:38 +0000MEDIUM 4.9: A CWE-35 "Path Traversal" in maxtime/api/database/database.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows an authenticated remote attacker to read sensitive files via crafted HTTP requests.https://patchthecve.com/cve/CVE-2025-26356.htmlhttps://patchthecve.com/cve/CVE-2025-26356.htmlWed, 17 Jun 2026 09:01:37 +0000HIGH 7.2: A CWE-35 "Path Traversal" in maxtime/api/database/database.lua (setActive endpoint) in Q-Free MaxTime less than or equal to version 2.11.0 allows an authenticated remote attacker to overwrite sensitive files via crafted HTTP requests.https://patchthecve.com/cve/CVE-2025-26355.htmlhttps://patchthecve.com/cve/CVE-2025-26355.htmlWed, 17 Jun 2026 09:01:37 +0000MEDIUM 6.5: A CWE-35 "Path Traversal" in maxtime/api/database/database.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows an authenticated remote attacker to delete sensitive files via crafted HTTP requests.https://patchthecve.com/cve/CVE-2025-26354.htmlhttps://patchthecve.com/cve/CVE-2025-26354.htmlWed, 17 Jun 2026 09:01:37 +0000HIGH 7.2: A CWE-35 "Path Traversal" in maxtime/api/database/database.lua (copy endpoint) in Q-Free MaxTime less than or equal to version 2.11.0 allows an authenticated remote attacker to overwrite sensitive files via crafted HTTP requests.https://patchthecve.com/cve/CVE-2025-26353.htmlhttps://patchthecve.com/cve/CVE-2025-26353.htmlWed, 17 Jun 2026 09:01:37 +0000MEDIUM 4.9: A CWE-35 "Path Traversal" in maxtime/api/sql/sql.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows an authenticated remote attacker to read sensitive files via crafted HTTP requests.https://patchthecve.com/cve/CVE-2025-26352.htmlhttps://patchthecve.com/cve/CVE-2025-26352.htmlWed, 17 Jun 2026 09:01:37 +0000MEDIUM 6.5: A CWE-35 "Path Traversal" in the template deletion mechanism in Q-Free MaxTime less than or equal to version 2.11.0 allows an authenticated remote attacker to delete sensitive files via crafted HTTP requests.https://patchthecve.com/cve/CVE-2025-26351.htmlhttps://patchthecve.com/cve/CVE-2025-26351.htmlWed, 17 Jun 2026 09:01:37 +0000MEDIUM 4.9: A CWE-35 "Path Traversal" in the template download mechanism in Q-Free MaxTime less than or equal to version 2.11.0 allows an authenticated remote attacker to read sensitive files via crafted HTTP requests.https://patchthecve.com/cve/CVE-2025-26350.htmlhttps://patchthecve.com/cve/CVE-2025-26350.htmlWed, 17 Jun 2026 09:01:37 +0000MEDIUM 4.9: A CWE-434 "Unrestricted Upload of File with Dangerous Type" in the template file uploads in Q-Free MaxTime less than or equal to version 2.11.0 allows an authenticated remote attacker to upload malicious files via crafted HTTP requests.https://patchthecve.com/cve/CVE-2025-26349.htmlhttps://patchthecve.com/cve/CVE-2025-26349.htmlWed, 17 Jun 2026 09:01:37 +0000HIGH 7.2: A CWE-23 "Relative Path Traversal" in the file upload mechanism in Q-Free MaxTime less than or equal to version 2.11.0 allows an authenticated remote attacker to overwrite arbitrary files via crafted HTTP requests.https://patchthecve.com/cve/CVE-2025-26348.htmlhttps://patchthecve.com/cve/CVE-2025-26348.htmlWed, 17 Jun 2026 09:01:37 +0000MEDIUM 5.5: A CWE-89 "Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')" in maxprofile/menu/model.lua (editUserMenu endpoint) in Q-Free MaxTime less than or equal to version 2.11.0 allows an authenticated remote attacker to execute arbitrary SQL commands via crafted HTTP requehttps://patchthecve.com/cve/CVE-2025-26347.htmlhttps://patchthecve.com/cve/CVE-2025-26347.htmlWed, 17 Jun 2026 09:01:36 +0000CRITICAL 9.8: A CWE-306 "Missing Authentication for Critical Function" in maxprofile/menu/routes.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows an unauthenticated remote attacker to edit user permissions via crafted HTTP requests.https://patchthecve.com/cve/CVE-2025-26346.htmlhttps://patchthecve.com/cve/CVE-2025-26346.htmlWed, 17 Jun 2026 09:01:36 +0000MEDIUM 5.5: A CWE-89 "Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')" in maxprofile/menu/model.lua (editUserGroupMenu endpoint) in Q-Free MaxTime less than or equal to version 2.11.0 allows an authenticated remote attacker to execute arbitrary SQL commands via crafted HTTP https://patchthecve.com/cve/CVE-2025-26345.htmlhttps://patchthecve.com/cve/CVE-2025-26345.htmlWed, 17 Jun 2026 09:01:36 +0000CRITICAL 9.8: A CWE-306 "Missing Authentication for Critical Function" in maxprofile/menu/routes.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows an unauthenticated remote attacker to edit user group permissions via crafted HTTP requests.https://patchthecve.com/cve/CVE-2025-26344.htmlhttps://patchthecve.com/cve/CVE-2025-26344.htmlWed, 17 Jun 2026 09:01:36 +0000CRITICAL 9.8: A CWE-306 "Missing Authentication for Critical Function" in maxprofile/guest-mode/routes.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows an unauthenticated remote attacker to enable passwordless guest mode via crafted HTTP requests.https://patchthecve.com/cve/CVE-2025-26343.htmlhttps://patchthecve.com/cve/CVE-2025-26343.htmlWed, 17 Jun 2026 09:01:36 +0000HIGH 8.1: A CWE-1390 "Weak Authentication" in the PIN authentication mechanism in Q-Free MaxTime less than or equal to version 2.11.0 allows an unauthenticated remote attacker to brute-force user PINs via multiple crafted HTTP requests.https://patchthecve.com/cve/CVE-2025-26342.htmlhttps://patchthecve.com/cve/CVE-2025-26342.htmlWed, 17 Jun 2026 09:01:36 +0000CRITICAL 9.8: A CWE-306 "Missing Authentication for Critical Function" in maxprofile/accounts/routes.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows an unauthenticated remote attacker to create arbitrary users, including administrators, via crafted HTTP requests.https://patchthecve.com/cve/CVE-2025-26341.htmlhttps://patchthecve.com/cve/CVE-2025-26341.htmlWed, 17 Jun 2026 09:01:36 +0000CRITICAL 9.8: A CWE-306 "Missing Authentication for Critical Function" in maxprofile/accounts/routes.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows an unauthenticated remote attacker to reset arbitrary user passwords via crafted HTTP requests.https://patchthecve.com/cve/CVE-2025-26340.htmlhttps://patchthecve.com/cve/CVE-2025-26340.htmlWed, 17 Jun 2026 09:01:36 +0000HIGH 8.8: A CWE-321 "Use of Hard-coded Cryptographic Key" in the JWT signing in Q-Free MaxTime less than or equal to version 2.11.0 allows an unauthenticated remote attacker to bypass the authentication via crafted HTTP requests.https://patchthecve.com/cve/CVE-2025-26339.htmlhttps://patchthecve.com/cve/CVE-2025-26339.htmlWed, 17 Jun 2026 09:01:36 +0000CRITICAL 9.8: A CWE-306 "Missing Authentication for Critical Function" in maxtime/handleRoute.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows an unauthenticated remote attacker to affect the device confidentiality, integrity, or availability in multiple unspecified ways via crafted HTTP requestshttps://patchthecve.com/cve/CVE-2025-1102.htmlhttps://patchthecve.com/cve/CVE-2025-1102.htmlWed, 17 Jun 2026 08:38:23 +0000MEDIUM 5.5: A CWE-346 "Origin Validation Error" in the CORS configuration in Q-Free MaxTime less than or equal to version 2.11.0 allows an unauthenticated remote attacker to affect the device confidentiality, integrity, or availability via crafted URLs or HTTP requests.https://patchthecve.com/cve/CVE-2025-1101.htmlhttps://patchthecve.com/cve/CVE-2025-1101.htmlWed, 17 Jun 2026 08:38:23 +0000MEDIUM 5.3: A CWE-204 "Observable Response Discrepancy" in the login page in Q-Free MaxTime less than or equal to version 2.11.0 allows an unauthenticated remote attacker to enumerate valid usernames via crafted HTTP requests.https://patchthecve.com/cve/CVE-2025-1100.htmlhttps://patchthecve.com/cve/CVE-2025-1100.htmlWed, 17 Jun 2026 08:38:23 +0000CRITICAL 9.8: A CWE-259 "Use of Hard-coded Password" for the root account in Q-Free MaxTime less than or equal to version 2.11.0 allows an unauthenticated remote attacker to execute arbitrary code with root privileges via SSH.