https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2026-33470.htmlhttps://patchthecve.com/cve/CVE-2026-33470.htmlWed, 17 Jun 2026 10:37:33 +0000MEDIUM 6.5: Frigate is a network video recorder (NVR) with realtime local object detection for IP cameras. In version 0.17.0, a low-privilege authenticated user restricted to one camera can access snapshots from other cameras. This is possible through a chain of two authorization problems: `/api/timeline` returhttps://patchthecve.com/cve/CVE-2026-33469.htmlhttps://patchthecve.com/cve/CVE-2026-33469.htmlWed, 17 Jun 2026 10:37:33 +0000MEDIUM 6.5: Frigate is a network video recorder (NVR) with realtime local object detection for IP cameras. In version 0.17.0, an authenticated non-admin user can retrieve the full raw Frigate configuration through `/api/config/raw`. This exposes sensitive values that are intentionally redacted from `/api/confighttps://patchthecve.com/cve/CVE-2026-33126.htmlhttps://patchthecve.com/cve/CVE-2026-33126.htmlWed, 17 Jun 2026 10:36:59 +0000MEDIUM 5.0: Frigate is a network video recorder (NVR) with realtime local object detection for IP cameras. Prior to version 0.16.3, the /ffprobe endpoint accepts arbitrary user-controlled URLs without proper validation, allowing Server-Side Request Forgery (SSRF) attacks. An attacker can use the Frigate server https://patchthecve.com/cve/CVE-2026-33125.htmlhttps://patchthecve.com/cve/CVE-2026-33125.htmlWed, 17 Jun 2026 10:36:59 +0000HIGH 7.1: Frigate is a network video recorder (NVR) with realtime local object detection for IP cameras. In versions 0.16.2 and below, users with the viewer role can delete admin and low-privileged user accounts. Exploitation can lead to DoS and affect data integrity. This issue has been patched in version 0.https://patchthecve.com/cve/CVE-2026-33124.htmlhttps://patchthecve.com/cve/CVE-2026-33124.htmlWed, 17 Jun 2026 10:36:59 +0000HIGH 8.8: Frigate is a network video recorder (NVR) with realtime local object detection for IP cameras. Versions prior to 0.17.0-beta1 allow any authenticated user to change their own password without verifying the current password through the /users/{username}/password endpoint. Changing a password does not