https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2025-66468.htmlhttps://patchthecve.com/cve/CVE-2025-66468.htmlSun, 18 Oct 2026 18:10:00 +0000HIGH 7.6: The Aimeos GrapesJS CMS extension provides page editor for creating content pages based on extensible components. Prior to 2021.10.8, 2022.10.8, 2023.10.8, 2024.10.8, and 2025.10.8, Javascript code can be injected by malicious editors for a stored XSS attack if the standard Content Security Policy ihttps://patchthecve.com/cve/CVE-2024-39319.htmlhttps://patchthecve.com/cve/CVE-2024-39319.htmlWed, 17 Jun 2026 07:41:42 +0000MEDIUM 5.3: aimeos/ai-controller-frontend is the Aimeos frontend controller package for e-commerce projects. Prior to versions 2024.4.2, 2023.10.9, 2022.10.8, 2021.10.8, and 2020.10.15, an insecure direct object reference allows an attacker to disable subscriptions and reviews of another customer. Versions 2024https://patchthecve.com/cve/CVE-2024-39325.htmlhttps://patchthecve.com/cve/CVE-2024-39325.htmlWed, 17 Jun 2026 07:41:43 +0000MEDIUM 5.3: aimeos/ai-controller-frontend is the Aimeos frontend controller. Prior to versions 2024.04.2, 2023.10.9, 2022.10.8, 2021.10.8, and 2020.10.15, aimeos/ai-controller-frontend doesn't reset the payment status of a user's basket after the user completes a purchase. Versions 2024.04.2, 2023.10.9, 2022.1https://patchthecve.com/cve/CVE-2024-39324.htmlhttps://patchthecve.com/cve/CVE-2024-39324.htmlWed, 17 Jun 2026 07:41:43 +0000LOW 3.8: aimeos/ai-admin-graphql is the Aimeos GraphQL API admin interface. Starting in version 2022.04.1 and prior to versions 2022.10.10, 2023.10.6, and 2024.4.2, improper access control allows a editors to manage own services via GraphQL API which isn't allowed in the JQAdm front end. Versions 2022.10.10,