https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2026-114401.htmlhttps://patchthecve.com/cve/CVE-2026-114401.htmlThu, 29 Oct 2026 15:18:38 +0000MEDIUM 5.3: Trudesk through 1.2.11 contains a regular expression injection vulnerability that allows unauthenticated attackers to enumerate usernames by submitting regex patterns to POST /api/v1/login. Attackers can send alternations or prefixes like (admin|root) or a.* and distinguish 'Invalid User' from 'Invahttps://patchthecve.com/cve/CVE-2026-114400.htmlhttps://patchthecve.com/cve/CVE-2026-114400.htmlThu, 29 Oct 2026 15:31:05 +0000MEDIUM 5.9: Trudesk through 1.2.11 contains a missing authentication vulnerability that allows unauthenticated attackers to download private ticket attachments under /uploads. Because express.static serves the public/ directory before the hasAuth-guarded /uploads mount, attackers who know or guess a ticket Objehttps://patchthecve.com/cve/CVE-2026-114399.htmlhttps://patchthecve.com/cve/CVE-2026-114399.htmlThu, 29 Oct 2026 15:50:47 +0000MEDIUM 6.5: Trudesk through 1.2.11 contains a path traversal vulnerability that allows administrators to delete arbitrary files by supplying encoded traversal sequences to DELETE /api/v1/backup/:backup. Attackers can also pass unvalidated file values to POST /api/v1/backup/restore to restore archives from, or ehttps://patchthecve.com/cve/CVE-2026-114398.htmlhttps://patchthecve.com/cve/CVE-2026-114398.htmlThu, 29 Oct 2026 15:57:52 +0000MEDIUM 5.4: Trudesk through 1.2.11 contains an unrestricted file upload vulnerability that allows any authenticated user to place HTML or SVG files in the public webroot via the uploadlogo, uploadpagelogo and uploadfavicon endpoints. Attackers can spoof an image MIME type to upload script-bearing files served u