https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2026-40927.htmlhttps://patchthecve.com/cve/CVE-2026-40927.htmlWed, 17 Jun 2026 10:45:53 +0000MEDIUM 5.4: Docmost is open-source collaborative wiki and documentation software. Prior to 0.80.0, when leaving a comment on a page, it is possible to include a JavaScript URI as the link. When a user clicks on the link the JavaScript executes. This vulnerability is fixed in 0.80.0.https://patchthecve.com/cve/CVE-2026-34213.htmlhttps://patchthecve.com/cve/CVE-2026-34213.htmlFri, 24 Jul 2026 22:10:00 +0000MEDIUM 5.4: Docmost is open-source collaborative wiki and documentation software. Starting in version 0.3.0 and prior to version 0.71.0, improper authorization in Docmost allows a low-privileged authenticated user to overwrite another page's attachment within the same workspace by supplying a victim `attachmenthttps://patchthecve.com/cve/CVE-2026-34212.htmlhttps://patchthecve.com/cve/CVE-2026-34212.htmlFri, 24 Jul 2026 22:10:00 +0000MEDIUM 5.4: Docmost is open-source collaborative wiki and documentation software. In versions prior to 0.71.0, improper neutralization of attachment URLs in Docmost allows a low-privileged authenticated user to store a malicious `javascript:` URL inside an attachment node in page content. When another user viewhttps://patchthecve.com/cve/CVE-2026-33193.htmlhttps://patchthecve.com/cve/CVE-2026-33193.htmlFri, 24 Jul 2026 23:10:00 +0000MEDIUM 4.6: Docmost is open-source collaborative wiki and documentation software. Versions prior to 0.70.0 are vulnerable to a stored cross-site scripting (XSS) attack due to improper handling of MIME type spoofing (GHSL-2026-052). An attacker could exploit this flaw to inject malicious scripts, potentially comhttps://patchthecve.com/cve/CVE-2026-33146.htmlhttps://patchthecve.com/cve/CVE-2026-33146.htmlFri, 24 Jul 2026 23:10:00 +0000MEDIUM 4.3: Docmost is open-source collaborative wiki and documentation software. An authorization bypass vulnerability in versions 0.70.0 through 0.70.2 exposes restricted child page titles and text snippets through the public search endpoint (`POST /api/search/share-search`) for publicly shared content. This