https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2026-29925.htmlhttps://patchthecve.com/cve/CVE-2026-29925.htmlWed, 17 Jun 2026 10:29:56 +0000HIGH 7.7: Invoice Ninja v5.12.46 and v5.12.48 is vulnerable to Server-Side Request Forgery (SSRF) in CheckDatabaseRequest.php.https://patchthecve.com/cve/CVE-2026-33742.htmlhttps://patchthecve.com/cve/CVE-2026-33742.htmlWed, 17 Jun 2026 10:38:01 +0000MEDIUM 5.4: Invoice Ninja is a source-available invoice, quote, project and time-tracking app built with Laravel. Product notes fields in Invoice Ninja v5.13.0 allow raw HTML via Markdown rendering, enabling stored XSS. The Markdown parser output was not sanitized with `purify::clean()` before being included inhttps://patchthecve.com/cve/CVE-2026-33628.htmlhttps://patchthecve.com/cve/CVE-2026-33628.htmlWed, 17 Jun 2026 10:37:48 +0000MEDIUM 5.4: Invoice Ninja is a source-available invoice, quote, project and time-tracking app built with Laravel. Invoice line item descriptions in Invoice Ninja v5.13.0 bypass the XSS denylist filter, allowing stored XSS payloads to execute when invoices are rendered in the PDF preview or client portal. The li