PatchTheCVE: favahttps://patchthecve.com/CVEs with upgrade or downgrade fix stepsCVE-2022-2589: Cross-site Scripting (XSS) - Reflected in GitHub repository beancount/fava prior to 1.22.3.https://patchthecve.com/cve/CVE-2022-2589.htmlhttps://patchthecve.com/cve/CVE-2022-2589.htmlWed, 17 Jun 2026 04:42:10 +0000MEDIUM 6.1: Cross-site Scripting (XSS) - Reflected in GitHub repository beancount/fava prior to 1.22.3.CVE-2022-2523: Cross-site Scripting (XSS) - Reflected in GitHub repository beancount/fava prior to 1.22.2.https://patchthecve.com/cve/CVE-2022-2523.htmlhttps://patchthecve.com/cve/CVE-2022-2523.htmlWed, 17 Jun 2026 04:42:03 +0000MEDIUM 6.1: Cross-site Scripting (XSS) - Reflected in GitHub repository beancount/fava prior to 1.22.2.CVE-2022-2514: The time and filter parameters in Fava prior to v1.22 are vulnerable to reflected XSS due to the lack of escaphttps://patchthecve.com/cve/CVE-2022-2514.htmlhttps://patchthecve.com/cve/CVE-2022-2514.htmlWed, 17 Jun 2026 04:42:02 +0000MEDIUM 6.1: The time and filter parameters in Fava prior to v1.22 are vulnerable to reflected XSS due to the lack of escaping of error messages which contained the parameters in verbatim.