https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2014-8760.htmlhttps://patchthecve.com/cve/CVE-2014-8760.htmlWed, 17 Jun 2026 00:17:17 +0000MEDIUM 5.0: ejabberd before 2.1.13 does not enforce the starttls_required setting when compression is used, which causes clients to establish connections without encryption.https://patchthecve.com/cve/CVE-2013-6169.htmlhttps://patchthecve.com/cve/CVE-2013-6169.htmlWed, 17 Jun 2026 00:00:06 +0000MEDIUM 4.3: The TLS driver in ejabberd before 2.1.12 supports (1) SSLv2 and (2) weak SSL ciphers, which makes it easier for remote attackers to obtain sensitive information via a brute-force attack.https://patchthecve.com/cve/CVE-2011-4320.htmlhttps://patchthecve.com/cve/CVE-2011-4320.htmlTue, 16 Jun 2026 23:34:46 +0000MEDIUM 4.0: The mod_pubsub module (mod_pubsub.erl) in ejabberd 2.1.8 and 3.0.0-alpha-3 allows remote authenticated users to cause a denial of service (infinite loop) via a stanza with a publish tag that lacks a node attribute.