https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2026-53450.htmlhttps://patchthecve.com/cve/CVE-2026-53450.htmlThu, 16 Jul 2026 19:29:44 +0000HIGH 7.4: Coturn is a free open source implementation of TURN and STUN Server. Prior to 4.13.0, coturn rejects loopback peers by default unless allow-loopback-peers is enabled, but the default loopback guard can be bypassed by using the IPv4-mapped IPv6 peer address ::ffff:127.0.0.1 in a TURN XOR-PEER-ADDRESShttps://patchthecve.com/cve/CVE-2026-53449.htmlhttps://patchthecve.com/cve/CVE-2026-53449.htmlThu, 16 Jul 2026 13:30:39 +0000MEDIUM 6.0: Coturn is a free open source implementation of TURN and STUN Server. Prior to 4.13.0, the psd print sessions dump CLI command in coturn takes a filename argument and directly passes it to fopen with no path validation. An authenticated admin with CLI access can overwrite arbitrary files writable by https://patchthecve.com/cve/CVE-2026-53448.htmlhttps://patchthecve.com/cve/CVE-2026-53448.htmlThu, 16 Jul 2026 13:35:10 +0000HIGH 7.2: Coturn is a free open source implementation of TURN and STUN Server. Prior to 4.12.0, the coturn HTTPS admin panel passes HTTP query parameters directly into SQL queries via snprintf string interpolation without sanitization. The is_secure_string filter that protects the STUN protocol path is not aphttps://patchthecve.com/cve/CVE-2026-43994.htmlhttps://patchthecve.com/cve/CVE-2026-43994.htmlFri, 26 Jun 2026 02:30:37 +0000HIGH 8.1: Coturn is a free open source implementation of TURN and STUN Server. Versions prior to 4.10.0 contain a stack buffer overflow in decode_oauth_token_gcm(). A uint16_t nonce_len field read from an attacker-supplied OAuth access token (0-65535) is passed directly to memcpy() as the copy length into a 2https://patchthecve.com/cve/CVE-2026-43915.htmlhttps://patchthecve.com/cve/CVE-2026-43915.htmlFri, 26 Jun 2026 02:35:52 +0000MEDIUM 5.4: Coturn is a free open source implementation of TURN and STUN Server. Versions prior to 4.11.0 contain a stored cross-site scripting (XSS) vulnerability in the web-admin HTTPS interface. An attacker who can create a TURN allocation with a crafted USERNAME value can inject HTML/JavaScript that execute