https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2025-13980.htmlhttps://patchthecve.com/cve/CVE-2025-13980.htmlWed, 17 Jun 2026 08:35:06 +0000MEDIUM 5.3: Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal CKEditor 5 Premium Features allows Functionality Bypass.This issue affects CKEditor 5 Premium Features: from 0.0.0 before 1.2.10, from 1.3.0 before 1.3.6, from 1.4.0 before 1.4.3, from 1.5.0 before 1.5.1, from 1.6.0 befhttps://patchthecve.com/cve/CVE-2016-20023.htmlhttps://patchthecve.com/cve/CVE-2016-20023.htmlWed, 17 Jun 2026 00:43:06 +0000MEDIUM 5.0: In CKSource CKFinder before 2.5.0.1 for ASP.NET, authenticated users could download any file from the server if the correct path to a file was provided.https://patchthecve.com/cve/CVE-2025-63830.htmlhttps://patchthecve.com/cve/CVE-2025-63830.htmlWed, 17 Jun 2026 09:53:31 +0000MEDIUM 6.1: CKFinder 1.4.3 is vulnerable to Cross Site Scripting (XSS) in the File Upload function. An attacker can upload a crafted SVG containing active content.https://patchthecve.com/cve/CVE-2024-13245.htmlhttps://patchthecve.com/cve/CVE-2024-13245.htmlWed, 17 Jun 2026 07:01:34 +0000MEDIUM 5.4: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal CKEditor 4 LTS - WYSIWYG HTML editor allows Cross-Site Scripting (XSS).This issue affects CKEditor 4 LTS - WYSIWYG HTML editor: from 1.0.0 before 1.0.1.