https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2026-45750.htmlhttps://patchthecve.com/cve/CVE-2026-45750.htmlMon, 26 Oct 2026 11:10:00 +0000CRITICAL 9.0: Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. Prior to version 2.3.2, the GET /ssh/file_manager/ssh/resolvePath endpoint in the Termix File Manager component unsafely processes the path parameter and embeds it into a shell command execuhttps://patchthecve.com/cve/CVE-2026-45749.htmlhttps://patchthecve.com/cve/CVE-2026-45749.htmlMon, 26 Oct 2026 11:10:00 +0000HIGH 8.1: Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. The `POST /users/totp/disable` and `POST /users/totp/backup-codes` endpoints in Termix prior to version 2.3.2 accept the account password as a sole authentication factor for MFA-critical opehttps://patchthecve.com/cve/CVE-2026-45748.htmlhttps://patchthecve.com/cve/CVE-2026-45748.htmlMon, 26 Oct 2026 11:10:00 +0000CRITICAL 9.8: Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. The `POST /ssh/tunnel/connect` endpoint in Termix prior to version 2.3.2 builds an SSH tunnel command by interpolating user-controlled host record fields (`endpointIP`, `endpointUsername`, `https://patchthecve.com/cve/CVE-2026-45746.htmlhttps://patchthecve.com/cve/CVE-2026-45746.htmlMon, 26 Oct 2026 11:10:00 +0000CRITICAL 9.0: Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. Prior to version 2.3.2, the File Manager functionality in Termix contains a critical Broken Access Control vulnerability due to improper validation of the sessionId parameter. The backend trhttps://patchthecve.com/cve/CVE-2026-45745.htmlhttps://patchthecve.com/cve/CVE-2026-45745.htmlMon, 26 Oct 2026 11:10:00 +0000HIGH 8.0: Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. Starting in version 1.7.0, Termix Desktop (Electron) disables TLS certificate validation, allowing a machine-in-the-middle attacker to intercept and modify HTTPS traffic to the configured Tehttps://patchthecve.com/cve/CVE-2026-45744.htmlhttps://patchthecve.com/cve/CVE-2026-45744.htmlMon, 26 Oct 2026 11:10:00 +0000CRITICAL 9.9: Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. Prior to version 2.3.2, the GET /ssh/file_manager/ssh/resolvePath endpoint in Termix is vulnerable to OS command injection. The endpoint uses double-quote escaping for shell command construchttps://patchthecve.com/cve/CVE-2026-45743.htmlhttps://patchthecve.com/cve/CVE-2026-45743.htmlMon, 26 Oct 2026 11:10:00 +0000HIGH 8.1: Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. 16 file-manager endpoints in Termix prior to version 2.3.2 do not verify that the requesting user owns the SSH session identified by `sessionId`. An authenticated attacker who knows or guess