https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2023-39069.htmlhttps://patchthecve.com/cve/CVE-2023-39069.htmlWed, 17 Jun 2026 06:11:33 +0000CRITICAL 9.8: An issue in StrangeBee TheHive v.5.0.8, v.4.1.21 and Cortex v.3.1.6 allows a remote attacker to gain privileges via Active Directory authentication mechanism.https://patchthecve.com/cve/CVE-2022-23536.htmlhttps://patchthecve.com/cve/CVE-2022-23536.htmlWed, 17 Jun 2026 04:30:18 +0000MEDIUM 6.5: Cortex provides multi-tenant, long term storage for Prometheus. A local file inclusion vulnerability exists in Cortex versions 1.13.0, 1.13.1 and 1.14.0, where a malicious actor could remotely read local files as a result of parsing maliciously crafted Alertmanager configurations when submitted to thttps://patchthecve.com/cve/CVE-2021-36157.htmlhttps://patchthecve.com/cve/CVE-2021-36157.htmlWed, 17 Jun 2026 03:58:25 +0000MEDIUM 5.3: An issue was discovered in Grafana Cortex through 1.9.0. The header value X-Scope-OrgID is used to construct file paths for rules files, and if crafted to conduct directory traversal such as ae ../../sensitive/path/in/deployment pathname, then Cortex will attempt to parse a rules file at that locatihttps://patchthecve.com/cve/CVE-2021-31232.htmlhttps://patchthecve.com/cve/CVE-2021-31232.htmlWed, 17 Jun 2026 03:51:29 +0000MEDIUM 5.5: The Alertmanager in CNCF Cortex before 1.8.1 has a local file disclosure vulnerability when -experimental.alertmanager.enable-api is used. The HTTP basic auth password_file can be used as an attack vector to send any file content via a webhook. The alertmanager templates can be used as an attack vechttps://patchthecve.com/cve/CVE-2018-20226.htmlhttps://patchthecve.com/cve/CVE-2018-20226.htmlWed, 17 Jun 2026 01:52:29 +0000HIGH 7.2: An organization administrator can add a super administrator in THEHIVE PROJECT Cortex before 2.1.3 due to the lack of overriding the Role.toString method.