https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2026-33208.htmlhttps://patchthecve.com/cve/CVE-2026-33208.htmlWed, 17 Jun 2026 10:37:07 +0000HIGH 8.8: Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers. Prior to version 8.2.6.4, the /config/ < service > /find-in-config endpoint in Roxy-WI fails to sanitize the user-supplied words parameter before embedding it into a shell command string that is subsequently execuhttps://patchthecve.com/cve/CVE-2026-33078.htmlhttps://patchthecve.com/cve/CVE-2026-33078.htmlWed, 17 Jun 2026 10:36:54 +0000CRITICAL 9.8: Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers. Versions prior to 8.2.6.4 have a SQL injection vulnerability in the haproxy_section_save function in app/routes/config/routes.py. The server_ip parameter, sourced from the URL path, is passed unsanitized through mhttps://patchthecve.com/cve/CVE-2026-33077.htmlhttps://patchthecve.com/cve/CVE-2026-33077.htmlWed, 17 Jun 2026 10:36:54 +0000HIGH 7.5: Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers. Prior to version 8.2.6.4, the oldconfig parameter in the haproxy_section_save interface has an arbitrary file read vulnerability. Version 8.2.6.4 fixes the issue.https://patchthecve.com/cve/CVE-2026-33076.htmlhttps://patchthecve.com/cve/CVE-2026-33076.htmlWed, 17 Jun 2026 10:36:54 +0000CRITICAL 9.8: Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers. Prior to version 8.2.6.4, the haproxy_section_save interface presents a vulnerability that could lead to remote code execution due to path traversal and writing into scheduled tasks. Version 8.2.6.4 fixes the issu