https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2026-21868.htmlhttps://patchthecve.com/cve/CVE-2026-21868.htmlWed, 17 Jun 2026 10:19:03 +0000HIGH 7.5: Flag Forge is a Capture The Flag (CTF) platform. Versions 2.3.2 and below have a Regular Expression Denial of Service (ReDoS) vulnerability in the user profile API endpoint (/api/user/[username]). The application constructs a regular expression dynamically using unescaped user input (the username pahttps://patchthecve.com/cve/CVE-2025-61777.htmlhttps://patchthecve.com/cve/CVE-2025-61777.htmlFri, 09 Oct 2026 10:10:00 +0000CRITICAL 9.4: Flag Forge is a Capture The Flag (CTF) platform. Starting in version 2.0.0 and prior to version 2.3.2, the `/api/admin/badge-templates` (GET) and `/api/admin/badge-templates/create` (POST) endpoints previously allowed access without authentication or authorization. This could have enabled unauthorizhttps://patchthecve.com/cve/CVE-2025-59932.htmlhttps://patchthecve.com/cve/CVE-2025-59932.htmlFri, 09 Oct 2026 10:10:00 +0000HIGH 8.6: Flag Forge is a Capture The Flag (CTF) platform. From versions 2.0.0 to before 2.3.1, the /api/resources endpoint previously allowed POST and DELETE requests without proper authentication or authorization. This could have enabled unauthorized users to create, modify, or delete resources on the platfhttps://patchthecve.com/cve/CVE-2025-59843.htmlhttps://patchthecve.com/cve/CVE-2025-59843.htmlFri, 09 Oct 2026 10:10:00 +0000MEDIUM 5.3: Flag Forge is a Capture The Flag (CTF) platform. From versions 2.0.0 to before 2.3.2, the public endpoint /api/user/[username] returns user email addresses in its JSON response. The fix, intended for release in 2.3.1 but only available starting in version 2.3.2, removes email addresses from public Ahttps://patchthecve.com/cve/CVE-2025-59841.htmlhttps://patchthecve.com/cve/CVE-2025-59841.htmlSun, 11 Oct 2026 20:10:00 +0000CRITICAL 9.8: Flag Forge is a Capture The Flag (CTF) platform. In versions from 2.2.0 to before 2.3.1, the FlagForge web application improperly handles session invalidation. Authenticated users can continue to access protected endpoints, such as /api/profile, even after logging out. CSRF tokens are also still valhttps://patchthecve.com/cve/CVE-2025-59833.htmlhttps://patchthecve.com/cve/CVE-2025-59833.htmlWed, 17 Jun 2026 09:46:47 +0000HIGH 7.5: Flag Forge is a Capture The Flag (CTF) platform. In versions from 2.1.0 to before 2.3.0, the API endpoint GET /api/problems/:id returns challenge hints in plaintext within the question object, regardless of whether the user has unlocked them via point deduction. Users can view all hints for free, unhttps://patchthecve.com/cve/CVE-2025-59827.htmlhttps://patchthecve.com/cve/CVE-2025-59827.htmlWed, 17 Jun 2026 09:46:46 +0000CRITICAL 9.8: Flag Forge is a Capture The Flag (CTF) platform. In version 2.1.0, the /api/admin/assign-badge endpoint lacks proper access control, allowing any authenticated user to assign high-privilege badges (e.g., Staff) to themselves. This could lead to privilege escalation and impersonation of administrativhttps://patchthecve.com/cve/CVE-2025-59826.htmlhttps://patchthecve.com/cve/CVE-2025-59826.htmlSun, 11 Oct 2026 20:10:00 +0000HIGH 7.6: Flag Forge is a Capture The Flag (CTF) platform. In version 2.1.0, non-admin users can create arbitrary challenges, potentially introducing malicious, incorrect, or misleading content. This issue has been patched in version 2.2.0.