https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2026-33496.htmlhttps://patchthecve.com/cve/CVE-2026-33496.htmlWed, 17 Jun 2026 10:37:36 +0000HIGH 8.1: ORY Oathkeeper is an Identity & Access Proxy (IAP) and Access Control Decision API that authorizes HTTP requests based on sets of Access Rules. Versions prior to 26.2.0 are vulnerable to authentication bypass due to cache key confusion. The `oauth2_introspection` authenticator cache does not distinhttps://patchthecve.com/cve/CVE-2026-33495.htmlhttps://patchthecve.com/cve/CVE-2026-33495.htmlWed, 17 Jun 2026 10:37:35 +0000MEDIUM 6.5: ORY Oathkeeper is an Identity & Access Proxy (IAP) and Access Control Decision API that authorizes HTTP requests based on sets of Access Rules. Ory Oathkeeper is often deployed behind other components like CDNs, WAFs, or reverse proxies. Depending on the setup, another component might forward the rehttps://patchthecve.com/cve/CVE-2026-33494.htmlhttps://patchthecve.com/cve/CVE-2026-33494.htmlWed, 17 Jun 2026 10:37:35 +0000CRITICAL 10.0: ORY Oathkeeper is an Identity & Access Proxy (IAP) and Access Control Decision API that authorizes HTTP requests based on sets of Access Rules. Versions prior to 26.2.0 are vulnerable to an authorization bypass via HTTP path traversal. An attacker can craft a URL containing path traversal sequences