https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2023-38495.htmlhttps://patchthecve.com/cve/CVE-2023-38495.htmlWed, 17 Jun 2026 06:10:29 +0000HIGH 8.3: Crossplane is a framework for building cloud native control planes without needing to write code. In versions prior to 1.11.5, 1.12.3, and 1.13.0, Crossplane's image backend does not validate the byte contents of Crossplane packages. As such, Crossplane does not detect if an attacker has tampered wihttps://patchthecve.com/cve/CVE-2023-37900.htmlhttps://patchthecve.com/cve/CVE-2023-37900.htmlWed, 17 Jun 2026 06:08:51 +0000LOW 3.4: Crossplane is a framework for building cloud native control planes without needing to write code. In versions prior to 1.11.5, 1.12.3, and 1.13.0, a high-privileged user could create a Package referencing an arbitrarily large image containing that Crossplane would then parse, possibly resulting in ehttps://patchthecve.com/cve/CVE-2023-27484.htmlhttps://patchthecve.com/cve/CVE-2023-27484.htmlWed, 17 Jun 2026 05:45:18 +0000MEDIUM 6.2: crossplane-runtime is a set of go libraries used to build Kubernetes controllers in Crossplane and its related stacks. In affected versions an already highly privileged user able to create or update Compositions can specify an arbitrarily high index in a patch's `ToFieldPath`, which could lead to ex