https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2022-45307.htmlhttps://patchthecve.com/cve/CVE-2022-45307.htmlWed, 17 Jun 2026 05:09:46 +0000MEDIUM 4.3: Insecure permissions in Chocolatey PHP package v8.1.12 and below grants all users in the Authenticated Users group write privileges for the subfolder C:\tools\php81 and all files located in that folder.https://patchthecve.com/cve/CVE-2022-45306.htmlhttps://patchthecve.com/cve/CVE-2022-45306.htmlWed, 17 Jun 2026 05:09:46 +0000MEDIUM 4.3: Insecure permissions in Chocolatey Azure-Pipelines-Agent package v2.211.1 and below grants all users in the Authenticated Users group write privileges for the subfolder C:\agent and all files located in that folder.https://patchthecve.com/cve/CVE-2022-45305.htmlhttps://patchthecve.com/cve/CVE-2022-45305.htmlWed, 17 Jun 2026 05:09:46 +0000MEDIUM 4.3: Insecure permissions in Chocolatey Python3 package v3.11.0 and below grants all users in the Authenticated Users group write privileges for the subfolder C:\Python311 and all files located in that folder.https://patchthecve.com/cve/CVE-2022-45304.htmlhttps://patchthecve.com/cve/CVE-2022-45304.htmlWed, 17 Jun 2026 05:09:45 +0000MEDIUM 4.3: Insecure permissions in Chocolatey Cmder package v1.3.20 and below grants all users in the Authenticated Users group write privileges for the path C:\tools\Cmder and all files located in that folder.https://patchthecve.com/cve/CVE-2022-45301.htmlhttps://patchthecve.com/cve/CVE-2022-45301.htmlWed, 17 Jun 2026 05:09:45 +0000MEDIUM 4.3: Insecure permissions in Chocolatey Ruby package v3.1.2.1 and below grants all users in the Authenticated Users group write privileges for the path C:\tools\ruby31 and all files located in that folder.https://patchthecve.com/cve/CVE-2020-15264.htmlhttps://patchthecve.com/cve/CVE-2020-15264.htmlWed, 17 Jun 2026 02:56:23 +0000HIGH 8.0: The Boxstarter installer before version 2.13.0 configures C:\ProgramData\Boxstarter to be in the system-wide PATH environment variable. However, this directory is writable by normal, unprivileged users. To exploit the vulnerability, place a DLL in this directory that a privileged service is looking