https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2026-27736.htmlhttps://patchthecve.com/cve/CVE-2026-27736.htmlWed, 17 Jun 2026 10:27:34 +0000MEDIUM 6.1: BigBlueButton is an open-source virtual classroom. In versions on the 3.x branch prior to 3.0.20, the string received with errorRedirectUrl lacks validation, using it directly in the respondWithRedirect function leads to an Open Redirect vulnerability. BigBlueButton 3.0.20 patches the issue. No knowhttps://patchthecve.com/cve/CVE-2026-27467.htmlhttps://patchthecve.com/cve/CVE-2026-27467.htmlWed, 17 Jun 2026 10:27:12 +0000LOW 2.0: BigBlueButton is an open-source virtual classroom. In versions 3.0.19 and below, when first joining a session with the microphone muted, the client sends audio to the server regardless of mute state. Media is discarded at the server side, so it isn't audible to any participants, but this may allow fhttps://patchthecve.com/cve/CVE-2026-27466.htmlhttps://patchthecve.com/cve/CVE-2026-27466.htmlWed, 17 Jun 2026 10:27:11 +0000HIGH 7.2: BigBlueButton is an open-source virtual classroom. In versions 3.0.21 and below, the official documentation for "Server Customization" on Support for ClamAV as presentation file scanner contains instructions that leave a BBB server vulnerable for Denial of Service. The flawed command exposes both pohttps://patchthecve.com/cve/CVE-2025-61602.htmlhttps://patchthecve.com/cve/CVE-2025-61602.htmlMon, 19 Oct 2026 16:10:00 +0000HIGH 7.5: BigBlueButton is an open-source virtual classroom. A denial-of-service (DoS) vulnerability in versions prior to 3.0.13 allows any authenticated user to crash the chat functionality for all participants in a meeting by sending a malformed `reactionEmojiId` in the GraphQL mutation `chatSendMessageReachttps://patchthecve.com/cve/CVE-2025-61601.htmlhttps://patchthecve.com/cve/CVE-2025-61601.htmlMon, 19 Oct 2026 16:10:00 +0000HIGH 7.5: BigBlueButton is an open-source virtual classroom. A Denial of Service (DoS) vulnerability in versions prior to 3.0.13 allows any authenticated user to freeze or crash the entire server by abusing the polling feature's `Choices` response type. By submitting a malicious payload with a massive array ihttps://patchthecve.com/cve/CVE-2025-55200.htmlhttps://patchthecve.com/cve/CVE-2025-55200.htmlMon, 19 Oct 2026 16:10:00 +0000HIGH 7.1: BigBlueButton is an open-source virtual classroom. In versions prior to 3.0.13, the "Shared Notes" feature contains a Stored Cross-Site Scripting (XSS) vulnerability with the input location being the "Username" field and the output location on the "Shared Notes" page, when a user with a malicious us