https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2026-40096.htmlhttps://patchthecve.com/cve/CVE-2026-40096.htmlWed, 17 Jun 2026 10:44:42 +0000MEDIUM 5.4: immich is a high performance self-hosted photo and video management solution. Versions prior to 2.7.3 contain an open redirect vulnerability in the shared album functionality, where the album name is inserted unsanitized into a <meta> tag in api.service.ts. A registered attacker can create a shared https://patchthecve.com/cve/CVE-2026-35455.htmlhttps://patchthecve.com/cve/CVE-2026-35455.htmlFri, 24 Jul 2026 21:10:00 +0000HIGH 7.3: immich is a high performance self-hosted photo and video management solution. Prior to 2.7.0, sStored Cross-Site Scripting (XSS) in the 360° panorama viewer allows any authenticated user to execute arbitrary JavaScript in the browser of any other user who views the malicious panorama with the OCR ovhttps://patchthecve.com/cve/CVE-2026-25118.htmlhttps://patchthecve.com/cve/CVE-2026-25118.htmlFri, 24 Jul 2026 22:10:00 +0000HIGH 7.5: immich is a high performance self-hosted photo and video management solution. Prior to version 2.6.0, the Immich application is vulnerable to credential disclosure when a user authenticates to a shared album. During the authentication process, the application transmits the album password within the