PatchTheCVE: devexpresshttps://patchthecve.com/CVEs with upgrade or downgrade fix stepsCVE-2023-35817: DevExpress before 23.1.3 allows AsyncDownloader SSRF.https://patchthecve.com/cve/CVE-2023-35817.htmlhttps://patchthecve.com/cve/CVE-2023-35817.htmlWed, 17 Jun 2026 06:05:16 +0000MEDIUM 5.0: DevExpress before 23.1.3 allows AsyncDownloader SSRF.CVE-2023-35816: DevExpress before 23.1.3 allows arbitrary TypeConverter conversion.https://patchthecve.com/cve/CVE-2023-35816.htmlhttps://patchthecve.com/cve/CVE-2023-35816.htmlWed, 17 Jun 2026 06:05:16 +0000LOW 3.5: DevExpress before 23.1.3 allows arbitrary TypeConverter conversion.CVE-2023-35815: DevExpress before 23.1.3 has a data-source protection mechanism bypass during deserialization on XML data.https://patchthecve.com/cve/CVE-2023-35815.htmlhttps://patchthecve.com/cve/CVE-2023-35815.htmlWed, 17 Jun 2026 06:05:15 +0000LOW 3.5: DevExpress before 23.1.3 has a data-source protection mechanism bypass during deserialization on XML data.CVE-2023-35814: DevExpress before 23.1.3 does not properly protect XtraReport serialized data in ASP.NET web forms.https://patchthecve.com/cve/CVE-2023-35814.htmlhttps://patchthecve.com/cve/CVE-2023-35814.htmlWed, 17 Jun 2026 06:05:15 +0000LOW 3.5: DevExpress before 23.1.3 does not properly protect XtraReport serialized data in ASP.NET web forms.