https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2026-29048.htmlhttps://patchthecve.com/cve/CVE-2026-29048.htmlWed, 17 Jun 2026 10:29:30 +0000MEDIUM 6.1: HumHub is an Open Source Enterprise Social Network. In version 1.18.0, a cross-site scripting vulnerability was identified in the Button component of version 1.18.0. Due to inconsistent output encoding at several points within the software, malicious scripts could be injected and executed in the conhttps://patchthecve.com/cve/CVE-2026-29052.htmlhttps://patchthecve.com/cve/CVE-2026-29052.htmlWed, 02 Sep 2026 14:35:45 +0000MEDIUM 6.1: The Calendar module for HumHub enables users to create one-time or recurring events, manage attendee invitations, and efficiently track all scheduled activities. Prior to version 1.8.11, a Stored Cross-Site Scripting (XSS) vulnerability in the Event Types of the HumHub Calendar module impacts users https://patchthecve.com/cve/CVE-2025-64442.htmlhttps://patchthecve.com/cve/CVE-2025-64442.htmlWed, 17 Jun 2026 09:54:23 +0000MEDIUM 6.1: HumHub is an Open Source Enterprise Social Network. Versions below 1.17.4 have a XSS vulnerability in the Meta-Search feature which allows malicious input to be executed in search previews. This issue is fixed in version 1.17.4.https://patchthecve.com/cve/CVE-2025-54790.htmlhttps://patchthecve.com/cve/CVE-2025-54790.htmlWed, 02 Sep 2026 14:13:52 +0000MEDIUM 6.5: Files is a module for managing files inside spaces and user profiles. In versions 0.16.9 and below, Files does not have logic to prevent the exploitation of backend SQL queries without direct output, potentially allowing unauthorized data access. This is fixed in version 0.16.10.https://patchthecve.com/cve/CVE-2025-54789.htmlhttps://patchthecve.com/cve/CVE-2025-54789.htmlWed, 02 Sep 2026 14:14:05 +0000MEDIUM 6.1: Files is a module for managing files inside spaces and user profiles. In versions 0.16.9 and below, the File Move functionality does not contain logic that prevents injection of arbitrary JavaScript, which can lead to Browser JS code execution in the context of the user’s session. This is fixed in vhttps://patchthecve.com/cve/CVE-2024-52043.htmlhttps://patchthecve.com/cve/CVE-2024-52043.htmlWed, 17 Jun 2026 08:06:51 +0000MEDIUM 5.3: Generation of Error Message Containing Sensitive Information in HumHub GmbH & Co. KG - HumHub on Linux allows: Excavation (user enumeration).This issue affects all released HumHub versions: through 1.16.2.