https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2026-22809.htmlhttps://patchthecve.com/cve/CVE-2026-22809.htmlWed, 17 Jun 2026 10:20:28 +0000MEDIUM 4.4: tarteaucitron.js is a compliant and accessible cookie banner. Prior to 1.29.0, a Regular Expression Denial of Service (ReDoS) vulnerability was identified in tarteaucitron.js in the handling of the issuu_id parameter. This vulnerability is fixed in 1.29.0.https://patchthecve.com/cve/CVE-2025-48939.htmlhttps://patchthecve.com/cve/CVE-2025-48939.htmlWed, 17 Jun 2026 09:30:31 +0000MEDIUM 4.2: tarteaucitron.js is a compliant and accessible cookie banner. Prior to version 1.22.0, a vulnerability was identified in tarteaucitron.js where document.currentScript was accessed without verifying that it referenced an actual <script> element. If an attacker injected an HTML element, it could clobbhttps://patchthecve.com/cve/CVE-2025-31476.htmlhttps://patchthecve.com/cve/CVE-2025-31476.htmlWed, 17 Jun 2026 09:10:28 +0000MEDIUM 4.8: tarteaucitron.js is a compliant and accessible cookie banner. A vulnerability was identified in tarteaucitron.js, allowing a user with high privileges (access to the site's source code or a CMS plugin) to enter a URL containing an insecure scheme such as javascript:alert(). Before the fix, URL validhttps://patchthecve.com/cve/CVE-2025-31475.htmlhttps://patchthecve.com/cve/CVE-2025-31475.htmlWed, 17 Jun 2026 09:10:28 +0000MEDIUM 5.5: tarteaucitron.js is a compliant and accessible cookie banner. A vulnerability was identified in tarteaucitron.js prior to 1.20.1, where the addOrUpdate function, used for applying custom texts, did not properly validate input. This allowed an attacker with direct access to the site's source code or https://patchthecve.com/cve/CVE-2025-31138.htmlhttps://patchthecve.com/cve/CVE-2025-31138.htmlWed, 17 Jun 2026 09:09:55 +0000MEDIUM 5.5: tarteaucitron.js is a compliant and accessible cookie banner. A vulnerability was identified in tarteaucitron.js prior to 1.20.1, where user-controlled inputs for element dimensions (width and height) were not properly validated. This allowed an attacker with direct access to the site's source code