https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2021-27940.htmlhttps://patchthecve.com/cve/CVE-2021-27940.htmlWed, 17 Jun 2026 03:45:38 +0000MEDIUM 6.1: resources/public/js/orchestrator.js in openark orchestrator before 3.2.4 allows XSS via the orchestrator-msg parameter.https://patchthecve.com/cve/CVE-2018-19855.htmlhttps://patchthecve.com/cve/CVE-2018-19855.htmlWed, 17 Jun 2026 01:50:00 +0000MEDIUM 5.5: UiPath Orchestrator before 2018.3.4 allows CSV Injection, related to the Audit export, Robot log export, and Transaction log export features.https://patchthecve.com/cve/CVE-2018-17305.htmlhttps://patchthecve.com/cve/CVE-2018-17305.htmlWed, 17 Jun 2026 01:45:38 +0000HIGH 8.8: UiPath Orchestrator through 2018.2.4 allows any authenticated user to change the information of arbitrary users (even administrators) leading to privilege escalation and remote code execution.