https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2026-26369.htmlhttps://patchthecve.com/cve/CVE-2026-26369.htmlMon, 24 Aug 2026 11:16:38 +0000HIGH 8.8: eNet SMART HOME server 2.2.1 and 2.3.1 contains a privilege escalation vulnerability due to insufficient authorization checks in the setUserGroup JSON-RPC method. A low-privileged user (UG_USER) can send a crafted POST request to /jsonrpc/management specifying their own username to elevate their acchttps://patchthecve.com/cve/CVE-2026-26368.htmlhttps://patchthecve.com/cve/CVE-2026-26368.htmlWed, 17 Jun 2026 10:26:09 +0000HIGH 8.8: eNet SMART HOME server 2.2.1 and 2.3.1 contains a missing authorization vulnerability in the resetUserPassword JSON-RPC method that allows any authenticated low-privileged user (UG_USER) to reset the password of arbitrary accounts, including those in the UG_ADMIN and UG_SUPER_ADMIN groups, without shttps://patchthecve.com/cve/CVE-2026-26367.htmlhttps://patchthecve.com/cve/CVE-2026-26367.htmlWed, 17 Jun 2026 10:26:09 +0000HIGH 8.1: eNet SMART HOME server 2.2.1 and 2.3.1 contains a missing authorization vulnerability in the deleteUserAccount JSON-RPC method that permits any authenticated low-privileged user (UG_USER) to delete arbitrary user accounts, except for the built-in admin account. The application does not enforce role-https://patchthecve.com/cve/CVE-2026-26366.htmlhttps://patchthecve.com/cve/CVE-2026-26366.htmlWed, 17 Jun 2026 10:26:09 +0000CRITICAL 9.8: eNet SMART HOME server 2.2.1 and 2.3.1 ships with default credentials (user:user, admin:admin) that remain active after installation and commissioning without enforcing a mandatory password change. Unauthenticated attackers can use these default credentials to gain administrative access to sensitivehttps://patchthecve.com/cve/CVE-2026-26235.htmlhttps://patchthecve.com/cve/CVE-2026-26235.htmlWed, 17 Jun 2026 10:25:59 +0000HIGH 7.5: JUNG Smart Visu Server 1.1.1050 contains a denial of service vulnerability that allows unauthenticated attackers to remotely shutdown or reboot the server. Attackers can send a single POST request to trigger the server reboot without requiring any authentication.https://patchthecve.com/cve/CVE-2026-26234.htmlhttps://patchthecve.com/cve/CVE-2026-26234.htmlWed, 17 Jun 2026 10:25:59 +0000HIGH 8.8: JUNG Smart Visu Server 1.1.1050 contains a request header manipulation vulnerability that allows unauthenticated attackers to override request URLs by injecting arbitrary values in the X-Forwarded-Host header. Attackers can manipulate proxied requests to generate tainted responses, enabling cache po