https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2026-33344.htmlhttps://patchthecve.com/cve/CVE-2026-33344.htmlWed, 17 Jun 2026 10:37:20 +0000HIGH 8.1: Dagu is a workflow engine with a built-in Web user interface. From version 2.0.0 to before version 2.3.1, the fix for CVE-2026-27598 added ValidateDAGName to CreateNewDAG and rewrote generateFilePath to use filepath.Base. This patched the CREATE path. The remaining API endpoints - GET, DELETE, RENAMhttps://patchthecve.com/cve/CVE-2026-31886.htmlhttps://patchthecve.com/cve/CVE-2026-31886.htmlWed, 17 Jun 2026 10:34:41 +0000CRITICAL 9.1: Dagu is a workflow engine with a built-in Web user interface. Prior to 2.2.4, the dagRunId request field accepted by the inline DAG execution endpoints is passed directly into filepath.Join to construct a temporary directory path without any format validation. Go's filepath.Join resolves .. segmentshttps://patchthecve.com/cve/CVE-2026-31882.htmlhttps://patchthecve.com/cve/CVE-2026-31882.htmlWed, 17 Jun 2026 10:34:41 +0000HIGH 7.5: Dagu is a workflow engine with a built-in Web user interface. Prior to 2.2.4, when Dagu is configured with HTTP Basic authentication (DAGU_AUTH_MODE=basic), all Server-Sent Events (SSE) endpoints are accessible without any credentials. This allows unauthenticated attackers to access real-time DAG ex