https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2026-48689.htmlhttps://patchthecve.com/cve/CVE-2026-48689.htmlFri, 24 Jul 2026 11:10:00 +0000CRITICAL 9.8: FastNetMon Community Edition through 1.2.9 contains an off-by-one heap-based buffer overflow in the dynamic_binary_buffer_t class (src/dynamic_binary_buffer.hpp). Five methods (append_dynamic_buffer, append_data_as_pointer, append_data_as_object_ptr, memcpy_from_ptr, memcpy_from_object_ptr) use an ihttps://patchthecve.com/cve/CVE-2026-48696.htmlhttps://patchthecve.com/cve/CVE-2026-48696.htmlFri, 24 Jul 2026 11:10:00 +0000MEDIUM 6.2: FastNetMon Community Edition through 1.2.9 has a buffer overflow, a different vulnerability than CVE-2026-48686 and CVE-2026-48689.https://patchthecve.com/cve/CVE-2026-48695.htmlhttps://patchthecve.com/cve/CVE-2026-48695.htmlTue, 21 Jul 2026 19:10:00 +0000HIGH 8.1: FastNetMon Community Edition through 1.2.9 contains an OS command injection vulnerability in the MikroTik router integration plugin. The _log() function in src/mikrotik_plugin/fastnetmon_mikrotik.php (lines 107-108) constructs shell commands by concatenating the $msg parameter directly into exec() chttps://patchthecve.com/cve/CVE-2026-48694.htmlhttps://patchthecve.com/cve/CVE-2026-48694.htmlFri, 24 Jul 2026 11:10:00 +0000HIGH 8.1: FastNetMon Community Edition through 1.2.9 contains a configuration injection vulnerability in the Juniper router integration plugin. In src/juniper_plugin/fastnetmon_juniper.php, the $IP_ATTACK variable (received from argv[1]) is directly interpolated into Juniper NETCONF set-configuration commandshttps://patchthecve.com/cve/CVE-2026-48697.htmlhttps://patchthecve.com/cve/CVE-2026-48697.htmlFri, 24 Jul 2026 11:10:00 +0000HIGH 7.4: FastNetMon Community Edition through 1.2.9 does not verify TLS certificates on outbound HTTPS connections. The execute_web_request_secure() function in src/fast_library.cpp creates a boost::asio::ssl::context with tls_client mode and calls set_default_verify_paths() to load CA certificates, but nevehttps://patchthecve.com/cve/CVE-2026-48693.htmlhttps://patchthecve.com/cve/CVE-2026-48693.htmlFri, 24 Jul 2026 11:10:00 +0000MEDIUM 5.5: FastNetMon Community Edition through 1.2.9 is vulnerable to a local symlink attack via predictable file paths in /tmp. The statistics file path defaults to '/tmp/fastnetmon.dat' (src/fastnetmon.cpp line 159). The print_screen_contents_into_file() function (src/fastnetmon_logic.cpp line 2186) opens thttps://patchthecve.com/cve/CVE-2026-48691.htmlhttps://patchthecve.com/cve/CVE-2026-48691.htmlFri, 24 Jul 2026 11:10:00 +0000CRITICAL 9.8: FastNetMon Community Edition through 1.2.9 contains an integer overflow in the BGP AS_PATH attribute encoder. In src/bgp_protocol.hpp, the IPv4UnicastAnnounce::get_attributes() function computes attribute_length as 'sizeof(bgp_as_path_segment_element_t) + this->as_path_asns.size() * sizeof(uint32_t)https://patchthecve.com/cve/CVE-2026-48690.htmlhttps://patchthecve.com/cve/CVE-2026-48690.htmlFri, 24 Jul 2026 11:10:00 +0000HIGH 7.1: FastNetMon Community Edition through 1.2.9 contains an integer overflow vulnerability in the packet capture buffer allocation. In src/packet_storage.hpp, the allocate_buffer() function computes memory_size_in_bytes as 'buffer_size_in_packets * (max_captured_packet_size + sizeof(fastnetmon_pcap_pkthdhttps://patchthecve.com/cve/CVE-2026-48692.htmlhttps://patchthecve.com/cve/CVE-2026-48692.htmlFri, 24 Jul 2026 11:10:00 +0000HIGH 8.1: FastNetMon Community Edition through 1.2.9 exposes a gRPC API server on port 50052 with no authentication mechanism. The server is initialized with grpc::InsecureServerCredentials() (src/fastnetmon.cpp line 477) and a source code comment explicitly acknowledges 'Listen on the given address without ahttps://patchthecve.com/cve/CVE-2026-48688.htmlhttps://patchthecve.com/cve/CVE-2026-48688.htmlFri, 24 Jul 2026 11:10:00 +0000HIGH 7.5: FastNetMon Community Edition through 1.2.9 contains multiple out-of-bounds reads in the BGP MP_REACH_NLRI IPv6 attribute decoder. The function decode_mp_reach_ipv6() in src/bgp_protocol.cpp contains a TODO comment at line 156 explicitly acknowledging 'we should add sanity checks to avoid reads afterhttps://patchthecve.com/cve/CVE-2026-48687.htmlhttps://patchthecve.com/cve/CVE-2026-48687.htmlTue, 21 Jul 2026 19:10:00 +0000CRITICAL 9.8: FastNetMon Community Edition through 1.2.9 contains an OS command injection vulnerability in the Juniper router integration plugin. The _log() function in src/juniper_plugin/fastnetmon_juniper.php (lines 117-118) constructs shell commands by concatenating the $msg parameter directly into exec() callhttps://patchthecve.com/cve/CVE-2026-48686.htmlhttps://patchthecve.com/cve/CVE-2026-48686.htmlFri, 24 Jul 2026 11:10:00 +0000CRITICAL 9.8: FastNetMon Community Edition through 1.2.9 contains a stack-based buffer overflow in the BGP NLRI (Network Layer Reachability Information) decoder. The function decode_bgp_subnet_encoding_ipv4_raw() in src/bgp_protocol.cpp reads prefix_bit_length directly from the BGP packet (line 99) without validahttps://patchthecve.com/cve/CVE-2026-48685.htmlhttps://patchthecve.com/cve/CVE-2026-48685.htmlFri, 24 Jul 2026 11:10:00 +0000MEDIUM 6.5: FastNetMon Community Edition through 1.2.9 has out-of-bounds memory access because it incorrectly parses BGP path attributes with the extended length flag set. In src/bgp_protocol.hpp, the parse_raw_bgp_attribute() function correctly identifies when extended_length_bit is set and sets length_of_lenghttps://patchthecve.com/cve/CVE-2026-48684.htmlhttps://patchthecve.com/cve/CVE-2026-48684.htmlFri, 24 Jul 2026 11:10:00 +0000MEDIUM 6.5: FastNetMon Community Edition through 1.2.9 contains an out-of-bounds read in the NetFlow v9 options template parser. In process_netflow_v9_options_template() (src/netflow_plugin/netflow_v9_collector.cpp), the scope parsing loop (lines 224-229) iterates until scopes_offset reaches the attacker-contro