https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2022-30899.htmlhttps://patchthecve.com/cve/CVE-2022-30899.htmlWed, 17 Jun 2026 04:44:26 +0000MEDIUM 4.8: A Cross Site Scripting vulnerabilty exists in PartKeepr 1.4.0 via the 'name' field in /api/part_categories.https://patchthecve.com/cve/CVE-2021-39390.htmlhttps://patchthecve.com/cve/CVE-2021-39390.htmlWed, 17 Jun 2026 04:03:39 +0000MEDIUM 5.4: Stored XSS in PartKeepr 1.4.0 Edit section in multiple api endpoints via name parameter.https://patchthecve.com/cve/CVE-2022-22702.htmlhttps://patchthecve.com/cve/CVE-2022-22702.htmlWed, 17 Jun 2026 04:28:49 +0000MEDIUM 4.3: PartKeepr versions up to v1.4.0, in the functionality to upload attachments using a URL when creating a part does not validate that requests can be made to local ports, allowing an authenticated user to carry out SSRF attacks and port enumeration.https://patchthecve.com/cve/CVE-2022-22701.htmlhttps://patchthecve.com/cve/CVE-2022-22701.htmlWed, 17 Jun 2026 04:28:49 +0000MEDIUM 6.5: PartKeepr versions up to v1.4.0, loads attachments using a URL while creating a part and allows the use of the 'file://' URI scheme, allowing an authenticated user to read local files.