https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2025-64177.htmlhttps://patchthecve.com/cve/CVE-2025-64177.htmlWed, 17 Jun 2026 09:53:57 +0000MEDIUM 5.4: ThinkDashboard is a self-hosted bookmark dashboard built with Go and vanilla JavaScript. In versions 0.6.7 and below, there is a stored Cross-Site Scripting (XSS) vulnerability in the dashboard, which can exploited when a user clicks on a malicious bookmark, made vulnerable by the lack of scheme filhttps://patchthecve.com/cve/CVE-2025-64176.htmlhttps://patchthecve.com/cve/CVE-2025-64176.htmlWed, 17 Jun 2026 09:53:57 +0000MEDIUM 5.3: ThinkDashboard is a self-hosted bookmark dashboard built with Go and vanilla JavaScript. In versions 0.6.7 and below, an attacker can upload any file they wish to the /data directory of the web application via the backup import feature. When importing a backup, an attacker can first choose a .zip fihttps://patchthecve.com/cve/CVE-2025-64327.htmlhttps://patchthecve.com/cve/CVE-2025-64327.htmlWed, 17 Jun 2026 09:54:13 +0000MEDIUM 5.3: ThinkDashboard is a self-hosted bookmark dashboard built with Go and vanilla JavaScript. Versions 0.6.7 and below contain a Blind Server-Side Request Forgery (SSRF) vulnerability, in its `/api/ping?url= endpoint`. This allows an attacker to make arbitrary requests to internal or external hosts. This