https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2026-3067.htmlhttps://patchthecve.com/cve/CVE-2026-3067.htmlWed, 17 Jun 2026 10:42:59 +0000MEDIUM 6.3: A vulnerability has been found in HummerRisk up to 1.5.0. This issue affects the function extractTarGZ/extractZip of the file hummer-common/hummer-common-core/src/main/java/com/hummer/common/core/utils/CommandUtils.java of the component Archive Extraction. The manipulation leads to path traversal. Thttps://patchthecve.com/cve/CVE-2026-3066.htmlhttps://patchthecve.com/cve/CVE-2026-3066.htmlWed, 17 Jun 2026 10:42:59 +0000MEDIUM 6.3: A flaw has been found in HummerRisk up to 1.5.0. This vulnerability affects the function fixedCommand of the file hummer-common/hummer-common-core/src/main/java/com/hummer/common/core/utils/PlatformUtils.java of the component Cloud Compliance Scanning. Executing a manipulation can lead to command inhttps://patchthecve.com/cve/CVE-2026-3065.htmlhttps://patchthecve.com/cve/CVE-2026-3065.htmlWed, 17 Jun 2026 10:42:59 +0000MEDIUM 6.3: A vulnerability was detected in HummerRisk up to 1.5.0. This affects the function CommandUtils.commonExecCmdWithResult of the file CloudTaskService.java of the component Cloud Task Dry-run. Performing a manipulation of the argument fileName results in command injection. Remote exploitation of the athttps://patchthecve.com/cve/CVE-2026-3064.htmlhttps://patchthecve.com/cve/CVE-2026-3064.htmlWed, 17 Jun 2026 10:42:59 +0000MEDIUM 6.3: A security vulnerability has been detected in HummerRisk up to 1.5.0. Affected by this issue is some unknown functionality of the file ResourceCreateService.java of the component Cloud Task Scheduler. Such manipulation of the argument regionId leads to command injection. The attack may be launched rhttps://patchthecve.com/cve/CVE-2025-63721.htmlhttps://patchthecve.com/cve/CVE-2025-63721.htmlThu, 15 Oct 2026 20:10:00 +0000HIGH 8.8: HummerRisk thru v1.5.0 is using a vulnerable Snakeyaml component, allowing attackers with normal user privileges to hit the /rule/add API and thereby achieve RCE and take over the server.