https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2016-2049.htmlhttps://patchthecve.com/cve/CVE-2016-2049.htmlWed, 17 Jun 2026 00:43:19 +0000HIGH 8.8: examples/consumer/common.php in JanRain PHP OpenID library (aka php-openid) improperly checks the openid.realm parameter against the SERVER_NAME element in the SERVER superglobal array, which might allow remote attackers to hijack the authentication of arbitrary users via vectors involving a craftedhttps://patchthecve.com/cve/CVE-2013-1812.htmlhttps://patchthecve.com/cve/CVE-2013-1812.htmlTue, 16 Jun 2026 23:52:10 +0000MEDIUM 4.3: The ruby-openid gem before 2.2.2 for Ruby allows remote OpenID providers to cause a denial of service (CPU consumption) via (1) a large XRDS document or (2) an XML Entity Expansion (XEE) attack.https://patchthecve.com/cve/CVE-2013-4701.htmlhttps://patchthecve.com/cve/CVE-2013-4701.htmlTue, 16 Jun 2026 23:57:44 +0000HIGH 7.5: Auth/Yadis/XML.php in PHP OpenID Library 2.2.2 and earlier allows remote attackers to read arbitrary files, send HTTP requests to intranet servers, or cause a denial of service (CPU and memory consumption) via XRDS data containing an external entity declaration in conjunction with an entity referenchttps://patchthecve.com/cve/CVE-2012-2296.htmlhttps://patchthecve.com/cve/CVE-2012-2296.htmlTue, 16 Jun 2026 23:41:18 +0000MEDIUM 5.0: The Janrain Engage (formerly RPX) module for Drupal 6.x-1.x. 6.x-2.x before 6.x-2.2, and 7.x-2.x before 7.x-2.2 stores user profile data from Engage in session tables, which might allow remote attackers to obtain sensitive information by leveraging a separate vulnerability.