https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2026-33548.htmlhttps://patchthecve.com/cve/CVE-2026-33548.htmlWed, 17 Jun 2026 10:37:41 +0000MEDIUM 6.1: Mantis Bug Tracker (MantisBT) is an open source issue tracker. In version 2.28.0, improper escaping of tag names retrieved from History in Timeline (my_view_page.php) allows an attacker to inject HTML and, if CSP settings permit, achieve execution of arbitrary JavaScript, when displaying a tag that https://patchthecve.com/cve/CVE-2026-33517.htmlhttps://patchthecve.com/cve/CVE-2026-33517.htmlWed, 17 Jun 2026 10:37:38 +0000MEDIUM 6.1: Mantis Bug Tracker (MantisBT) is an open source issue tracker. In version 2.28.0, when deleting a Tag (tag_delete.php), improper escaping of its name when displaying the confirmation message allows an attacker to inject HTML and, if CSP settings permit, achieve execution of arbitrary JavaScript. Verhttps://patchthecve.com/cve/CVE-2026-30849.htmlhttps://patchthecve.com/cve/CVE-2026-30849.htmlWed, 17 Jun 2026 10:33:01 +0000CRITICAL 9.8: Mantis Bug Tracker (MantisBT) is an open source issue tracker. Versions prior to 2.28.1 running on MySQL family databases are affected by an authentication bypass vulnerability in the SOAP API, as a result of an improper type checking on the password parameter. Other database backends are not affect