https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2026-32729.htmlhttps://patchthecve.com/cve/CVE-2026-32729.htmlWed, 17 Jun 2026 10:36:17 +0000HIGH 8.1: Runtipi is a personal homeserver orchestrator. Prior to 4.8.1, The Runtipi /api/auth/verify-totp endpoint does not enforce any rate limiting, attempt counting, or account lockout mechanism. An attacker who has obtained a user's valid credentials (via phishing, credential stuffing, or data breach) cahttps://patchthecve.com/cve/CVE-2026-25116.htmlhttps://patchthecve.com/cve/CVE-2026-25116.htmlWed, 17 Jun 2026 10:24:08 +0000HIGH 7.6: Runtipi is a personal homeserver orchestrator. Starting in version 4.5.0 and prior to version 4.7.2, an unauthenticated Path Traversal vulnerability in the `UserConfigController` allows any remote user to overwrite the system's `docker-compose.yml` configuration file. By exploiting insecure URN parshttps://patchthecve.com/cve/CVE-2026-24129.htmlhttps://patchthecve.com/cve/CVE-2026-24129.htmlWed, 17 Jun 2026 10:22:40 +0000HIGH 8.0: Runtipi is a Docker-based, personal homeserver orchestrator that facilitates multiple services on a single server. Versions 3.7.0 and above allow an authenticated user to execute arbitrary system commands on the host server by injecting shell metacharacters into backup filenames. The BackupManager f