https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2026-1776.htmlhttps://patchthecve.com/cve/CVE-2026-1776.htmlThu, 08 Oct 2026 16:17:10 +0000MEDIUM 6.5: Camaleon CMS versions 2.4.5.0 through 2.9.0, prior to commit f54a77e, contain a path traversal vulnerability in the AWS S3 uploader implementation that allows authenticated users to read arbitrary files from the web server’s filesystem. The issue occurs in the download_private_file functionality whehttps://patchthecve.com/cve/CVE-2023-53936.htmlhttps://patchthecve.com/cve/CVE-2023-53936.htmlWed, 17 Jun 2026 06:46:22 +0000MEDIUM 4.8: Cameleon CMS 2.7.4 contains a persistent cross-site scripting vulnerability that allows authenticated administrators to inject malicious scripts into post titles. Attackers can create posts with embedded SVG scripts that execute when other users mouse over the post title, potentially stealing sessiohttps://patchthecve.com/cve/CVE-2024-46987.htmlhttps://patchthecve.com/cve/CVE-2024-46987.htmlWed, 17 Jun 2026 07:56:19 +0000HIGH 7.7: Camaleon CMS is a dynamic and advanced content management system based on Ruby on Rails. A path traversal vulnerability accessible via MediaController's download_private_file method allows authenticated users to download any file on the web server Camaleon CMS is running on (depending on the file pehttps://patchthecve.com/cve/CVE-2024-46986.htmlhttps://patchthecve.com/cve/CVE-2024-46986.htmlWed, 17 Jun 2026 07:56:19 +0000CRITICAL 9.9: Camaleon CMS is a dynamic and advanced content management system based on Ruby on Rails. An arbitrary file write vulnerability accessible via the upload method of the MediaController allows authenticated users to write arbitrary files to any location on the web server Camaleon CMS is running on (dep