https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2026-26266.htmlhttps://patchthecve.com/cve/CVE-2026-26266.htmlWed, 17 Jun 2026 10:26:00 +0000CRITICAL 9.3: AliasVault is a privacy-first password manager with built-in email aliasing. A stored cross-site scripting (XSS) vulnerability was identified in the email rendering feature of AliasVault Web Client versions 0.25.3 and lower. When viewing received emails on an alias, the HTML content is rendered in ahttps://patchthecve.com/cve/CVE-2026-2974.htmlhttps://patchthecve.com/cve/CVE-2026-2974.htmlWed, 17 Jun 2026 10:32:09 +0000LOW 2.5: A vulnerability was identified in AliasVault App up to 0.25.3 on Android/iOS. This vulnerability affects unknown code of the file shared_prefs/aliasvault.xml of the component Backup Handler. The manipulation of the argument accessToken/refreshToken/metadata/key_derivation_params/auth_methods leads thttps://patchthecve.com/cve/CVE-2026-22694.htmlhttps://patchthecve.com/cve/CVE-2026-22694.htmlWed, 17 Jun 2026 10:20:14 +0000MEDIUM 6.1: AliasVault is a privacy-first password manager with built-in email aliasing. AliasVault Android versions 0.24.0 through 0.25.2 contained an issue in how passkey requests from Android apps were validated. Under certain local conditions, a malicious app could attempt to obtain a passkey response for a