By weakness (CWE)

CWE-697: related vulnerabilities

CVEs classified under CWE-697. Understanding the weakness class helps prioritize systemic fixes over one-off patches.

3 published vulnerabilities

• CVE-2026-45567HIGH 8.3

  Roxy-WI, a popular web management interface for load balancers and web servers (HAProxy, Nginx, Apache, and Keepalived), contains an authentication bypass flaw in version 8.2.6.4 and earlier. An attacker can reach the unauthenticated /api/gpt endpoint by crafting a URL containing the 'api' substring, bypassing login requirements. This allows unauthorized access to administrative functions without valid credentials.

• CVE-2026-44249HIGH 8.1

  Netty is a widely-used Java networking framework that powers many protocol servers and clients. A flaw in how it filters IPv6 traffic has been discovered: the masking logic in the IPv6 subnet filtering rules is broken, allowing attackers to craft IP addresses that appear to bypass intended network access controls. If your application relies on Netty to restrict traffic to specific IPv6 subnets, an attacker could send requests from addresses that should have been blocked, potentially gaining unauthorized access to protected services.

• CVE-2026-45569HIGH 8.1

  Roxy-WI, a web-based control panel for managing HAProxy, Nginx, Apache, and Keepalived servers, contains a path-traversal vulnerability in versions 8.2.6.4 and earlier. A security patch was attempted but contained a critical logic error: it checks whether the string '..' appears as an exact match in a list of values, rather than checking whether '..' appears anywhere within a file path. This means attackers can still bypass the check using common path-traversal payloads like '../../etc/passwd' or '..\..\/etc/passwd'. An authenticated user can exploit this to read, modify, or delete arbitrary configuration files on the server.