https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2026-25073.htmlhttps://patchthecve.com/cve/CVE-2026-25073.htmlWed, 17 Jun 2026 10:24:04 +0000MEDIUM 5.4: XikeStor SKS8310-8X Network Switch firmware versions 1.04.B07 and prior contain a stored cross-site scripting vulnerability that allows authenticated attackers to inject arbitrary script content through the System Name field. Attackers can inject malicious scripts that execute in a victim's browser https://patchthecve.com/cve/CVE-2026-25072.htmlhttps://patchthecve.com/cve/CVE-2026-25072.htmlWed, 17 Jun 2026 10:24:04 +0000CRITICAL 9.8: XikeStor SKS8310-8X Network Switch firmware versions 1.04.B07 and prior contain a predictable session identifier vulnerability in the /goform/SetLogin endpoint that allows remote attackers to hijack authenticated sessions. Attackers can predict session identifiers using insufficiently random cookie https://patchthecve.com/cve/CVE-2026-25071.htmlhttps://patchthecve.com/cve/CVE-2026-25071.htmlWed, 17 Jun 2026 10:24:04 +0000HIGH 7.5: XikeStor SKS8310-8X Network Switch firmware versions 1.04.B07 and prior contain a missing authentication vulnerability in the /switch_config.src endpoint that allows unauthenticated remote attackers to download device configuration files. Attackers can access this endpoint without credentials to rethttps://patchthecve.com/cve/CVE-2026-25070.htmlhttps://patchthecve.com/cve/CVE-2026-25070.htmlWed, 17 Jun 2026 10:24:04 +0000CRITICAL 9.8: XikeStor SKS8310-8X Network Switch firmware versions 1.04.B07 and prior contain an OS command injection vulnerability in the /goform/PingTestSet endpoint that allows unauthenticated remote attackers to execute arbitrary operating system commands. Attackers can inject malicious commands through the d