Loading story…
Two high-severity vulnerabilities were disclosed in Roxy-WI, the web interface used to manage HAProxy, Nginx, Apache, and Keepalived. The issues affect versions prior to 8.2.6.4 and were published as CVE-2026-33076 and CVE-2026-33078. The first flaw is a path traversal issue in the haproxy_section_save interface that can let an attacker write arbitrary files, including into scheduled task locations, creating a path to remote code execution.
The second flaw is a SQL injection vulnerability in the same haproxy_section_save functionality, where the server_ip parameter is passed unsanitized through multiple calls and inserted into a database query using Python string formatting. Both bugs are remotely exploitable with low attack complexity and can severely affect confidentiality, integrity, and availability. The vendor addressed both issues in Roxy-WI 8.2.6.4, with a patch commit and security advisory published alongside the disclosures.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
2 events from the most recent confirmed update back to the earliest known activity.
Two high-severity vulnerabilities affecting Roxy-WI versions prior to 8.2.6.4 were published: CVE-2026-33076, a path traversal that can enable arbitrary file writing and remote code execution, and CVE-2026-33078, a SQL injection vulnerability in haproxy_section_save. Both disclosures describe network-exploitable flaws with low attack complexity and high impact.
Roxy-WI version 8.2.6.4 was released to remediate a path traversal/arbitrary file write issue in haproxy_section_save and a SQL injection flaw involving the unsanitized server_ip parameter. The fixes were accompanied by a patch commit and security advisory references.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
cvefeed.io
Open sourcecvefeed.io
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Two newly disclosed vulnerabilities affect **HAProxy through version 3.4.0**, including **`CVE-2026-55203`**, a critical integer overflow in FastCGI handling that can be triggered by a malicious FastCGI backend. The bug resides in the `fcgi_conn` structure’s `drl` field: when `contentLength` is `65535` and `paddingLength` is `1` or greater, the value wraps to `0`, causing the parser to treat buffered data as new FastCGI record headers. That desynchronization can lead to request routing errors, **response smuggling**, and possible memory-safety impacts. The issue is described as remotely exploitable and was fixed in commit `5985276`. A second flaw, **`CVE-2026-55204`**, is a high-severity **NULL pointer dereference** in `hpack_dht_insert()` within `src/hpack-tbl.c`. The vulnerability occurs when HAProxy fails to validate the return value of `hpack_dht_defrag()` after memory-pool exhaustion, allowing a remote attacker to trigger HPACK dynamic table insertions under memory pressure and crash HAProxy worker processes, resulting in denial of service. The bug is fixed in commit `9a6d1fe`, and affected organizations should update HAProxy to a release containing both fixes.
Jun 29, 2026
Public disclosures highlighted multiple high-severity vulnerabilities across industrial control systems, open-source software, and consumer networking gear, with several issues enabling **unauthenticated remote compromise**. Johnson Controls disclosed **CVE-2025-26385** (CVSS 10.0), a critical SQL injection affecting multiple building/ICS management products (including *ADS/ADX, LCS8500, NAE8500, SCT, CCT*) that can allow remote, unauthenticated attackers to execute arbitrary SQL to alter/delete/exfiltrate data; CISA guidance emphasized isolating control system networks from the internet, segmentation, and controlled remote access (e.g., VPNs). Additional unauthenticated remote issues include **CVE-2026-25069** in *SunFounder Pironman Dashboard* (path traversal in log API endpoints enabling arbitrary file read/deletion) and **CVE-2025-51958** in the *DokuWiki* `runcommand` plugin (unauthenticated command execution via `lib/plugins/runcommand/postaction.php`). Other disclosures include developer-tooling and application-layer injection flaws and multiple router memory-corruption bugs with public exploit references. *Orval* fixed **CVE-2026-25141**, a code-injection issue where incomplete escaping can be bypassed using **JSFuck**-style payloads, and *Cybersecurity AI (CAI)* addressed **CVE-2026-25130**, where `subprocess.Popen(..., shell=True)` enables argument/command injection leading to RCE (notably via the `find_file()` tool). Data-layer issues include **CVE-2025-69662** in *geopandas* (`to_postgis()` SQL injection) and **CVE-2026-24854** in *ChurchCRM* (authenticated SQL injection via `PerID` in `/PaddleNumEditor.php`, patched in 6.7.2), while **CVE-2025-36384** affects *IBM Db2 for Windows* (local privilege escalation via unquoted search path). SOHO router flaws **CVE-2026-1686** (*Totolink A3600R*) and **CVE-2026-1637** (*Tenda AC21*) describe remotely reachable buffer/stack overflows with publicly available exploit material, increasing the likelihood of opportunistic exploitation where exposed management interfaces exist.
Jun 29, 2026
A critical vulnerability in ProxySQL, tracked as **CVE-2026-48772**, allows remote attackers to spoof client source IP addresses by abusing improper parsing of HAProxy PROXY protocol v1 `UNKNOWN` headers. A crafted frame with appended address fields can cause ProxySQL to trust a forged IP and use it in `mysql_query_rules.client_addr`, `stats_mysql_processlist.cli_host`, and `event_log`, enabling access-control and routing bypass as well as misleading audit trails. The issue affects ProxySQL versions **2.0.0 through 3.0.8** and is especially dangerous because `mysql-proxy_protocol_networks = '*'` is the default, exposing any reachable MySQL frontend to attempted exploitation. The flaw was reproduced in testing by sending a forged address that triggered query rules intended for a different client, demonstrating the ability to influence schema pinning, query filtering, and other IP-based controls. ProxySQL addressed the issue in **version 3.0.9**, which also fixed another critical pre-authentication memory-corruption bug, **CVE-2026-48773**. Security advisories rate CVE-2026-48772 as remotely exploitable and severe, with published scores ranging from **CVSS 9.1 to 10.0**, and urge organizations running **3.0.8 or earlier** to upgrade immediately.
Jun 29, 2026