PatchTheCVE: untanglehttps://patchthecve.com/CVEs with upgrade or downgrade fix stepsCVE-2020-17494: Untangle Firewall NG before 16.0 uses MD5 for passwords.https://patchthecve.com/cve/CVE-2020-17494.htmlhttps://patchthecve.com/cve/CVE-2020-17494.htmlWed, 17 Jun 2026 02:59:00 +0000MEDIUM 5.3: Untangle Firewall NG before 16.0 uses MD5 for passwords.CVE-2019-18649: When logged in as an admin user, the Title input field (under Reports) within Untangle NG firewall 14.2.0 is vhttps://patchthecve.com/cve/CVE-2019-18649.htmlhttps://patchthecve.com/cve/CVE-2019-18649.htmlWed, 17 Jun 2026 02:25:13 +0000MEDIUM 4.8: When logged in as an admin user, the Title input field (under Reports) within Untangle NG firewall 14.2.0 is vulnerable to stored XSS.CVE-2019-18648: When logged in as an admin user, the Untangle NG firewall 14.2.0 is vulnerable to reflected XSS at multiple plhttps://patchthecve.com/cve/CVE-2019-18648.htmlhttps://patchthecve.com/cve/CVE-2019-18648.htmlWed, 17 Jun 2026 02:25:13 +0000MEDIUM 4.8: When logged in as an admin user, the Untangle NG firewall 14.2.0 is vulnerable to reflected XSS at multiple places and specific user input fields.CVE-2019-18647: The Untangle NG firewall 14.2.0 is vulnerable to an authenticated command injection when logged in as an adminhttps://patchthecve.com/cve/CVE-2019-18647.htmlhttps://patchthecve.com/cve/CVE-2019-18647.htmlWed, 17 Jun 2026 02:25:13 +0000HIGH 7.2: The Untangle NG firewall 14.2.0 is vulnerable to an authenticated command injection when logged in as an admin user.CVE-2019-18646: The Untangle NG firewall 14.2.0 is vulnerable to authenticated inline-query SQL injection within the timeDataDhttps://patchthecve.com/cve/CVE-2019-18646.htmlhttps://patchthecve.com/cve/CVE-2019-18646.htmlWed, 17 Jun 2026 02:25:13 +0000HIGH 7.2: The Untangle NG firewall 14.2.0 is vulnerable to authenticated inline-query SQL injection within the timeDataDynamicColumn parameter when logged in as an admin user.