https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2026-32985.htmlhttps://patchthecve.com/cve/CVE-2026-32985.htmlWed, 17 Jun 2026 10:36:41 +0000CRITICAL 9.8: Xerte Online Toolkits versions 3.14 and earlier contain an unauthenticated arbitrary file upload vulnerability in the template import functionality that allows remote attackers to execute arbitrary code by uploading a crafted ZIP archive containing malicious PHP payloads. Attackers can bypass authenhttps://patchthecve.com/cve/CVE-2025-61906.htmlhttps://patchthecve.com/cve/CVE-2025-61906.htmlMon, 19 Oct 2026 16:10:00 +0000MEDIUM 4.3: Opencast is a free, open-source platform to support the management of educational audio and video content. Prior to Opencast 17.8 and 18.2, in some situations, Opencast's editor may publish a video without notifying the user. This may lead to users accidentally publishing media not meant for publishhttps://patchthecve.com/cve/CVE-2025-61788.htmlhttps://patchthecve.com/cve/CVE-2025-61788.htmlMon, 19 Oct 2026 16:10:00 +0000MEDIUM 5.4: Opencast is a free, open-source platform to support the management of educational audio and video content. Prior to Opencast 17.8 and 18.2, the paella would include and render some user inputs (metadata like title, description, etc.) unfiltered and unmodified. The vulnerability allows attackers to ihttps://patchthecve.com/cve/CVE-2025-55202.htmlhttps://patchthecve.com/cve/CVE-2025-55202.htmlMon, 19 Oct 2026 17:10:00 +0000MEDIUM 5.3: Opencast is a free, open-source platform to support the management of educational audio and video content. In version 18.0 and versions before 17.7, the protections against path traversal attacks in the UI config module are insufficient, still partially allowing for attacks in very specific cases. Thttps://patchthecve.com/cve/CVE-2025-54380.htmlhttps://patchthecve.com/cve/CVE-2025-54380.htmlWed, 17 Jun 2026 09:39:57 +0000MEDIUM 6.5: Opencast is a free, open-source platform to support the management of educational audio and video content. Prior to version 17.6, Opencast would incorrectly send the hashed global system account credentials (ie: org.opencastproject.security.digest.user and org.opencastproject.security.digest.pass) whttps://patchthecve.com/cve/CVE-2025-3986.htmlhttps://patchthecve.com/cve/CVE-2025-3986.htmlWed, 17 Jun 2026 09:21:03 +0000MEDIUM 4.3: A vulnerability was found in Apereo CAS 5.2.6. It has been declared as problematic. This vulnerability affects unknown code of the file cas-5.2.6\core\cas-server-core-configuration-metadata-repository\src\main\java\org\apereo\cas\metadata\rest\CasConfigurationMetadataServerController.java. The maniphttps://patchthecve.com/cve/CVE-2025-3985.htmlhttps://patchthecve.com/cve/CVE-2025-3985.htmlWed, 17 Jun 2026 09:21:03 +0000LOW 2.7: A vulnerability was found in Apereo CAS 5.2.6. It has been classified as problematic. This affects the function ResponseEntity of the file cas-5.2.6\webapp-mgmt\cas-management-webapp-support\src\main\java\org\apereo\cas\mgmt\services\web\ManageRegisteredServicesMultiActionController.java. The manipuhttps://patchthecve.com/cve/CVE-2025-3984.htmlhttps://patchthecve.com/cve/CVE-2025-3984.htmlWed, 17 Jun 2026 09:21:03 +0000MEDIUM 5.0: A vulnerability was found in Apereo CAS 5.2.6 and classified as critical. Affected by this issue is the function saveService of the file cas-5.2.6\webapp-mgmt\cas-management-webapp-support\src\main\java\org\apereo\cas\mgmt\services\web\RegisteredServiceSimpleFormController.java of the component Groohttps://patchthecve.com/cve/CVE-2024-52797.htmlhttps://patchthecve.com/cve/CVE-2024-52797.htmlWed, 17 Jun 2026 08:07:38 +0000MEDIUM 6.5: Opencast is free and open source software for automated video capture and distribution. First noticed in Opencast 13 and 14, Opencast's Elasticsearch integration may generate syntactically invalid Elasticsearch queries in relation to previously acceptable search queries. From Opencast version 11.4 ahttps://patchthecve.com/cve/CVE-2024-11209.htmlhttps://patchthecve.com/cve/CVE-2024-11209.htmlWed, 17 Jun 2026 06:57:17 +0000MEDIUM 6.3: A vulnerability was found in Apereo CAS 6.6. It has been classified as critical. This affects an unknown part of the file /login?service of the component 2FA. The manipulation leads to improper authentication. It is possible to initiate the attack remotely. The exploit has been disclosed to the publhttps://patchthecve.com/cve/CVE-2024-11208.htmlhttps://patchthecve.com/cve/CVE-2024-11208.htmlWed, 17 Jun 2026 06:57:16 +0000LOW 3.7: A vulnerability was found in Apereo CAS 6.6 and classified as problematic. Affected by this issue is some unknown functionality of the file /login?service. The manipulation leads to session expiration. The attack may be launched remotely. The complexity of an attack is rather high. The exploitation https://patchthecve.com/cve/CVE-2024-11207.htmlhttps://patchthecve.com/cve/CVE-2024-11207.htmlWed, 17 Jun 2026 06:57:16 +0000MEDIUM 4.3: A vulnerability has been found in Apereo CAS 6.6 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file /login. The manipulation of the argument redirect_uri leads to open redirect. The attack can be launched remotely. The exploit has been disclosed to https://patchthecve.com/cve/CVE-2024-4399.htmlhttps://patchthecve.com/cve/CVE-2024-4399.htmlWed, 17 Jun 2026 08:01:49 +0000CRITICAL 9.1: The does not validate a parameter before making a request to it, which could allow unauthenticated users to perform SSRF attack