https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2026-59883.htmlhttps://patchthecve.com/cve/CVE-2026-59883.htmlMon, 13 Jul 2026 14:01:39 +0000MEDIUM 4.7: Guzzle is an extensible PHP HTTP client. Prior to 7.12.3, CookieJar did not restrict cookies scoped to IP-address or bare-numeric Domain values to the exact host that set them, because SetCookie::matchesDomain() applied ordinary suffix matching to domains such as 192.168.0.1, [::1], or 1, allowing chttps://patchthecve.com/cve/CVE-2026-55767.htmlhttps://patchthecve.com/cve/CVE-2026-55767.htmlWed, 05 Aug 2026 22:17:07 +0000MEDIUM 5.8: Guzzle is an extensible PHP HTTP client. Prior to 7.12.1, CookieJar incorrectly accepts cookies with a dot-only Domain attribute and whitespace-padded variants. SetCookie::matchesDomain() removes leading dots from the cookie domain, normalizing dot-only values to the empty string; SetCookie::validathttps://patchthecve.com/cve/CVE-2026-55568.htmlhttps://patchthecve.com/cve/CVE-2026-55568.htmlFri, 26 Jun 2026 19:34:13 +0000MEDIUM 5.9: Guzzle is an extensible PHP HTTP client. Prior to 7.12.1, in certain configurations, traffic expected to be protected by TLS on the hop to the proxy is transmitted in cleartext. Proxy authentication credentials (the Proxy-Authorization header, proxy userinfo in the proxy URL, or CURLOPT_PROXYUSERPWD