https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2026-24907.htmlhttps://patchthecve.com/cve/CVE-2026-24907.htmlMon, 26 Oct 2026 21:10:00 +0000MEDIUM 5.4: October is a Content Management System (CMS) and web platform. Versions prior to 3.7.14 and 4.1.10 contain a stored cross-site scripting (XSS) vulnerability in the Event Log mail preview feature. When viewing logged mail messages, HTML content was rendered in an iframe without proper sandboxing, allhttps://patchthecve.com/cve/CVE-2026-24906.htmlhttps://patchthecve.com/cve/CVE-2026-24906.htmlMon, 26 Oct 2026 21:10:00 +0000MEDIUM 5.4: October is a Content Management System (CMS) and web platform. Versions prior to 3.7.14 and 4.1.10 contain a Stored Cross-Site Scripting (XSS) vulnerability in the Backend Editor Settings. The Markup Classes fields (used for paragraph styles, inline styles, table styles, etc.) did not sanitize inputhttps://patchthecve.com/cve/CVE-2026-22692.htmlhttps://patchthecve.com/cve/CVE-2026-22692.htmlMon, 26 Oct 2026 22:10:00 +0000MEDIUM 4.9: October is a Content Management System (CMS) and web platform. Versions prior to 3.7.13 and versions 4.0.0 through 4.1.4 contain a sandbox bypass vulnerability in the optional Twig safe mode feature (CMS_SAFE_MODE). Certain methods on the collect() helper were not properly restricted, allowing authe