https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2026-27885.htmlhttps://patchthecve.com/cve/CVE-2026-27885.htmlFri, 24 Jul 2026 22:10:00 +0000HIGH 7.2: Piwigo is an open source photo gallery application for the web. Prior to version 16.3.0, a SQL Injection vulnerability was discovered in Piwigo affecting the Activity List API endpoint. This vulnerability allows an authenticated administrator to extract sensitive data from the database, including ushttps://patchthecve.com/cve/CVE-2026-27834.htmlhttps://patchthecve.com/cve/CVE-2026-27834.htmlFri, 24 Jul 2026 22:10:00 +0000HIGH 7.2: Piwigo is an open source photo gallery application for the web. Prior to version 16.3.0, a SQL Injection vulnerability exists in the pwg.users.getList Web Service API method. The filter parameter is directly concatenated into a SQL query without proper sanitization, allowing authenticated administrahttps://patchthecve.com/cve/CVE-2026-27833.htmlhttps://patchthecve.com/cve/CVE-2026-27833.htmlFri, 24 Jul 2026 22:10:00 +0000HIGH 7.5: Piwigo is an open source photo gallery application for the web. Prior to version 16.3.0, the pwg.history.search API method in Piwigo is registered without the admin_only option, allowing unauthenticated users to access the full browsing history of all gallery visitors. This issue has been patched inhttps://patchthecve.com/cve/CVE-2026-27634.htmlhttps://patchthecve.com/cve/CVE-2026-27634.htmlFri, 24 Jul 2026 22:10:00 +0000CRITICAL 9.8: Piwigo is an open source photo gallery application for the web. Prior to version 16.3.0, the four date filter parameters (f_min_date_available, f_max_date_available, f_min_date_created, f_max_date_created) in ws_std_image_sql_filter() are concatenated directly into SQL without any escaping or type v