https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2026-53474.htmlhttps://patchthecve.com/cve/CVE-2026-53474.htmlWed, 17 Jun 2026 10:57:57 +0000CRITICAL 9.6: A flaw was found in migration-planner. A remote authenticated attacker could exploit this vulnerability by uploading a specially crafted RVTools .xlsx file. Due to improper input sanitization, malicious SQL embedded within a spreadsheet cell is executed when cluster names are processed. This SQL Injhttps://patchthecve.com/cve/CVE-2026-53471.htmlhttps://patchthecve.com/cve/CVE-2026-53471.htmlWed, 17 Jun 2026 14:45:23 +0000CRITICAL 9.6: A flaw was found in migration-planner. The agent-API middleware processes JSON Web Tokens (JWTs) for authentication, but its UpdateSourceInventory and UpdateAgentStatus handlers fail to validate the source_id claim within these tokens against the requested source ID. This oversight allows an authenthttps://patchthecve.com/cve/CVE-2026-53470.htmlhttps://patchthecve.com/cve/CVE-2026-53470.htmlWed, 17 Jun 2026 14:28:59 +0000CRITICAL 9.6: A flaw was found in migration-planner. An authenticated attacker could exploit an improper access control vulnerability in the `/api/v1/sources/{id}/image-url` endpoint. This flaw allows the attacker to bypass an ownership check and obtain presigned S3 URLs for Open Virtual Appliance (OVA) images behttps://patchthecve.com/cve/CVE-2026-53469.htmlhttps://patchthecve.com/cve/CVE-2026-53469.htmlWed, 17 Jun 2026 14:09:32 +0000CRITICAL 9.1: A flaw was found in migration-planner. An authenticated user can exploit this vulnerability by sending a DELETE request to the /api/v1/sources route, which lacks proper authorization and filtering. This allows for the destruction of all customer data, including sources, agents, and assessments, lead