https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2026-35516.htmlhttps://patchthecve.com/cve/CVE-2026-35516.htmlMon, 26 Oct 2026 21:10:00 +0000MEDIUM 5.0: LinkAce is a self-hosted archive to collect website links. Prior to 2.5.4, LinkRepository::update and CheckLinksCommand::checkLink do not check for private IPs. An authenticated user can read responses from internal services (AWS IMDSv1, cloud metadata, internal APIs) by creating a link with a publihttps://patchthecve.com/cve/CVE-2026-33954.htmlhttps://patchthecve.com/cve/CVE-2026-33954.htmlMon, 26 Oct 2026 21:10:00 +0000MEDIUM 6.5: LinkAce is a self-hosted archive to collect website links. In versions prior to 2.5.3, a private note attached to a non-private link can be disclosed to a different authenticated user via the web interface. The API appears to correctly enforce note visibility, but the web link detail page renders nohttps://patchthecve.com/cve/CVE-2026-33953.htmlhttps://patchthecve.com/cve/CVE-2026-33953.htmlMon, 26 Oct 2026 21:10:00 +0000HIGH 8.5: LinkAce is a self-hosted archive to collect website links. Versions prior to 2.5.3 block direct requests to private IP literals, but still performs server-side requests to internal-only resources when those resources are referenced through an internal hostname. This allows an authenticated user to t