https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2026-33942.htmlhttps://patchthecve.com/cve/CVE-2026-33942.htmlWed, 17 Jun 2026 10:38:20 +0000CRITICAL 9.8: Saloon is a PHP library that gives users tools to build API integrations and SDKs. Versions prior to 4.0.0 used PHP's unserialize() in AccessTokenAuthenticator::unserialize() to restore OAuth token state from cache or storage, with allowed_classes => true. An attacker who can control the serialized https://patchthecve.com/cve/CVE-2026-33183.htmlhttps://patchthecve.com/cve/CVE-2026-33183.htmlWed, 17 Jun 2026 10:37:05 +0000CRITICAL 9.1: Saloon is a PHP library that gives users tools to build API integrations and SDKs. Prior to version 4.0.0, fixture names were used to build file paths under the configured fixture directory without validation. A name containing path segments (e.g. ../traversal or ../../etc/passwd) resulted in a pathhttps://patchthecve.com/cve/CVE-2026-33182.htmlhttps://patchthecve.com/cve/CVE-2026-33182.htmlWed, 17 Jun 2026 10:37:05 +0000HIGH 7.5: Saloon is a PHP library that gives users tools to build API integrations and SDKs. Prior to version 4.0.0, when building the request URL, Saloon combined the connector's base URL with the request endpoint. If the endpoint was a valid absolute URL, the code used that URL as-is and ignored the base UR