https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2026-39349.htmlhttps://patchthecve.com/cve/CVE-2026-39349.htmlFri, 24 Jul 2026 21:10:00 +0000LOW 2.7: OrangeHRM is a comprehensive human resource management (HRM) system. From 5.0 to 5.8, OrangeHRM Open Source encrypts certain sensitive fields with AES in ECB mode, which preserves block-aligned plaintext patterns in ciphertext and enables pattern disclosure against stored data. This vulnerability ishttps://patchthecve.com/cve/CVE-2026-39348.htmlhttps://patchthecve.com/cve/CVE-2026-39348.htmlFri, 24 Jul 2026 21:10:00 +0000MEDIUM 4.3: OrangeHRM is a comprehensive human resource management (HRM) system. From 5.0 to 5.8, OrangeHRM Open Source omits authorization on job specification and vacancy attachment download handlers, allowing authenticated low-privilege users to read attachments via direct reference to attachment identifiershttps://patchthecve.com/cve/CVE-2026-39347.htmlhttps://patchthecve.com/cve/CVE-2026-39347.htmlFri, 24 Jul 2026 21:10:00 +0000LOW 2.7: OrangeHRM is a comprehensive human resource management (HRM) system. From 5.0 to 5.8, OrangeHRM Open Source accepts changes to self-appraisal submissions for administrator users after those submissions have been marked completed, breaking integrity of finalized appraisal records. This vulnerability https://patchthecve.com/cve/CVE-2026-39346.htmlhttps://patchthecve.com/cve/CVE-2026-39346.htmlFri, 24 Jul 2026 21:10:00 +0000MEDIUM 5.4: OrangeHRM is a comprehensive human resource management (HRM) system. From 5.0 to 5.8, OrangeHRM Open Source allowed authenticated users to bypass disabled-module access controls via URL-encoded request paths and access functionality of modules disabled by an administrator. This vulnerability is fixehttps://patchthecve.com/cve/CVE-2026-39345.htmlhttps://patchthecve.com/cve/CVE-2026-39345.htmlFri, 24 Jul 2026 21:10:00 +0000MEDIUM 4.9: OrangeHRM is a comprehensive human resource management (HRM) system. From 5.0 to 5.8, OrangeHRM Open Source fails to restrict email template file resolution to the intended plugins directory, allowing an authenticated actor who can influence the template path to read arbitrary local files. This vuln