https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2022-25512.htmlhttps://patchthecve.com/cve/CVE-2022-25512.htmlWed, 17 Jun 2026 04:33:39 +0000HIGH 7.5: FreeTAKServer-UI v1.9.8 was discovered to leak sensitive API and Websocket keys.https://patchthecve.com/cve/CVE-2022-25511.htmlhttps://patchthecve.com/cve/CVE-2022-25511.htmlWed, 17 Jun 2026 04:33:39 +0000MEDIUM 6.5: An issue in the ?filename= argument of the route /DataPackageTable in FreeTAKServer-UI v1.9.8 allows attackers to place arbitrary files anywhere on the system.https://patchthecve.com/cve/CVE-2022-25510.htmlhttps://patchthecve.com/cve/CVE-2022-25510.htmlWed, 17 Jun 2026 04:33:39 +0000HIGH 8.8: FreeTAKServer 1.9.8 contains a hardcoded Flask secret key which allows attackers to create crafted cookies to bypass authentication or escalate privileges.https://patchthecve.com/cve/CVE-2022-25508.htmlhttps://patchthecve.com/cve/CVE-2022-25508.htmlWed, 17 Jun 2026 04:33:38 +0000HIGH 7.5: An access control issue in the component /ManageRoute/postRoute of FreeTAKServer v1.9.8 allows unauthenticated attackers to cause a Denial of Service (DoS) via an unusually large amount of created routes, or create unsafe or false routes for legitimate users.https://patchthecve.com/cve/CVE-2022-25507.htmlhttps://patchthecve.com/cve/CVE-2022-25507.htmlWed, 17 Jun 2026 04:33:38 +0000MEDIUM 5.4: FreeTAKServer-UI v1.9.8 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the Callsign parameter.https://patchthecve.com/cve/CVE-2022-25506.htmlhttps://patchthecve.com/cve/CVE-2022-25506.htmlWed, 17 Jun 2026 04:33:38 +0000MEDIUM 6.5: FreeTAKServer-UI v1.9.8 was discovered to contain a SQL injection vulnerability via the API endpoint /AuthenticateUser.