https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2026-32251.htmlhttps://patchthecve.com/cve/CVE-2026-32251.htmlWed, 17 Jun 2026 10:35:25 +0000MEDIUM 6.5: Tolgee is an open-source localization platform. Prior to 3.166.3, the XML parsers used for importing Android XML resources (.xml) and .resx files don't disable external entity processing. An authenticated user who can import translation files into a project can exploit this to read arbitrary files fhttps://patchthecve.com/cve/CVE-2024-52297.htmlhttps://patchthecve.com/cve/CVE-2024-52297.htmlWed, 17 Jun 2026 08:06:57 +0000CRITICAL 9.8: Tolgee is an open-source localization platform. Tolgee 3.81.1 included the all configuration properties in the PublicConfiguratioDTO publicly exposed to users. This vulnerability is fixed in v3.81.2.https://patchthecve.com/cve/CVE-2024-32470.htmlhttps://patchthecve.com/cve/CVE-2024-32470.htmlWed, 17 Jun 2026 07:29:41 +0000MEDIUM 6.5: Tolgee is an open-source localization platform. When API key created by admin user is used it bypasses the permission check at all. This error was introduced in v3.57.2 and immediately fixed in v3.57.4. https://patchthecve.com/cve/CVE-2024-32466.htmlhttps://patchthecve.com/cve/CVE-2024-32466.htmlWed, 17 Jun 2026 07:29:41 +0000LOW 2.7: Tolgee is an open-source localization platform. For the `/v2/projects/translations` and `/v2/projects/{projectId}/translations` endpoints, translation data was returned even when API key was missing `translation.view` scope. However, it was impossible to fetch the data when user was missing this sco