https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2026-32828.htmlhttps://patchthecve.com/cve/CVE-2026-32828.htmlWed, 17 Jun 2026 10:36:24 +0000MEDIUM 4.9: Kargo manages and automates the promotion of software artifacts. In versions 1.4.0 through 1.6.3, 1.7.0-rc.1 through 1.7.8, 1.8.0-rc.1 through 1.8.11, and 1.9.0-rc.1 through 1.9.4, the http and http-download promotion steps allow Server-Side Request Forgery (SSRF) against link-local addresses, most https://patchthecve.com/cve/CVE-2026-27112.htmlhttps://patchthecve.com/cve/CVE-2026-27112.htmlWed, 17 Jun 2026 10:26:41 +0000CRITICAL 9.9: Kargo manages and automates the promotion of software artifacts. From 1.7.0 to before v1.7.8, v1.8.11, and v1.9.3, the batch resource creation endpoints of both Kargo's legacy gRPC API and newer REST API accept multi-document YAML payloads. Specially crafted payloads can manifest a bug present in thhttps://patchthecve.com/cve/CVE-2026-27111.htmlhttps://patchthecve.com/cve/CVE-2026-27111.htmlWed, 17 Jun 2026 10:26:41 +0000MEDIUM 5.0: Kargo manages and automates the promotion of software artifacts. From v1.9.0 to v1.9.2, Kargo's authorization model includes a promote verb -- a non-standard Kubernetes "dolphin verb" -- that gates the ability to advance Freight through a promotion pipeline. This verb exists to separate the ability https://patchthecve.com/cve/CVE-2026-24748.htmlhttps://patchthecve.com/cve/CVE-2026-24748.htmlWed, 17 Jun 2026 10:23:31 +0000HIGH 7.2: Kargo manages and automates the promotion of software artifacts. Prior to versions 1.8.7, 1.7.7, and 1.6.3, a bug was found with authentication checks on the `GetConfig()` API endpoint. This allowed unauthenticated users to access this endpoint by specifying an `Authorization` header with any non-em