https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2023-46131.htmlhttps://patchthecve.com/cve/CVE-2023-46131.htmlWed, 17 Jun 2026 06:30:13 +0000MEDIUM 6.5: Grails is a framework used to build web applications with the Groovy programming language. A specially crafted web request can lead to a JVM crash or denial of service. Any Grails framework application using Grails data binding is vulnerable. This issue has been patched in version 3.3.17, 4.1.3, 5.3https://patchthecve.com/cve/CVE-2022-41923.htmlhttps://patchthecve.com/cve/CVE-2022-41923.htmlWed, 17 Jun 2026 05:04:04 +0000CRITICAL 9.1: Grails Spring Security Core plugin is vulnerable to privilege escalation. The vulnerability allows an attacker access to one endpoint (i.e. the targeted endpoint) using the authorization requirements of a different endpoint (i.e. the donor endpoint). In some Grails framework applications, access to https://patchthecve.com/cve/CVE-2022-35912.htmlhttps://patchthecve.com/cve/CVE-2022-35912.htmlWed, 17 Jun 2026 04:52:30 +0000CRITICAL 9.8: In grails-databinding in Grails before 3.3.15, 4.x before 4.1.1, 5.x before 5.1.9, and 5.2.x before 5.2.1 (at least when certain Java 8 configurations are used), data binding allows a remote attacker to execute code by gaining access to the class loader.https://patchthecve.com/cve/CVE-2019-12728.htmlhttps://patchthecve.com/cve/CVE-2019-12728.htmlWed, 17 Jun 2026 02:15:19 +0000HIGH 8.1: Grails before 3.3.10 used cleartext HTTP to resolve the SDKMan notification service. NOTE: users' apps were not resolving dependencies over cleartext HTTP.https://patchthecve.com/cve/CVE-2018-1000529.htmlhttps://patchthecve.com/cve/CVE-2018-1000529.htmlWed, 17 Jun 2026 01:32:51 +0000MEDIUM 6.1: Grails Fields plugin version 2.2.7 contains a Cross Site Scripting (XSS) vulnerability in Using the display tag that can result in XSS . This vulnerability appears to have been fixed in 2.2.8.https://patchthecve.com/cve/CVE-2014-3626.htmlhttps://patchthecve.com/cve/CVE-2014-3626.htmlWed, 17 Jun 2026 00:08:38 +0000HIGH 7.5: The Grails Resource Plugin often has to exchange URIs for resources with other internal components. Those other components will decode any URI passed to them. To protect against directory traversal the Grails Resource Plugin did the following: normalized the URI, checked the normalized URI did not shttps://patchthecve.com/cve/CVE-2017-6344.htmlhttps://patchthecve.com/cve/CVE-2017-6344.htmlWed, 17 Jun 2026 01:22:11 +0000MEDIUM 5.9: XML External Entity (XXE) vulnerability in Grails PDF Plugin 0.6 allows remote attackers to read arbitrary files via a crafted XML document.