https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2025-53639.htmlhttps://patchthecve.com/cve/CVE-2025-53639.htmlWed, 17 Jun 2026 09:38:37 +0000CRITICAL 9.8: MeterSphere is an open source continuous testing platform. Prior to version 3.6.5-lts, the sortField parameter in certain API endpoints is not properly validated or sanitized. An attacker can supply crafted input to inject and execute arbitrary SQL statements through the sorting functionality. This https://patchthecve.com/cve/CVE-2024-37161.htmlhttps://patchthecve.com/cve/CVE-2024-37161.htmlWed, 17 Jun 2026 07:37:52 +0000MEDIUM 4.0: MeterSphere is an open source continuous testing platform. Prior to version 1.10.1-lts, the system's step editor stores cross-site scripting vulnerabilities. Version 1.10.1-lts fixes this issue.https://patchthecve.com/cve/CVE-2024-36118.htmlhttps://patchthecve.com/cve/CVE-2024-36118.htmlWed, 17 Jun 2026 07:36:08 +0000LOW 3.5: MeterSphere is a test management and interface testing tool. In affected versions users without workspace permissions can view functional test cases of other workspaces beyond their authority. This issue has been addressed in version 2.10.15-lts. Users of MeterSphere are advised to upgrade. There arhttps://patchthecve.com/cve/CVE-2023-50267.htmlhttps://patchthecve.com/cve/CVE-2023-50267.htmlWed, 17 Jun 2026 06:39:25 +0000MEDIUM 4.3: MeterSphere is a one-stop open source continuous testing platform. Prior to 2.10.10-lts, the authenticated attackers can update resources which don't belong to him if the resource ID is known. This issue if fixed in 2.10.10-lts. There are no known workarounds.