https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2026-28276.htmlhttps://patchthecve.com/cve/CVE-2026-28276.htmlWed, 17 Jun 2026 10:28:25 +0000HIGH 7.5: Initiative is a self-hosted project management platform. An access control vulnerability exists in Initiative versions prior to 0.32.2 where uploaded documents are served from a publicly accessible /uploads/ directory without any authentication or authorization checks. Any uploaded file can be acceshttps://patchthecve.com/cve/CVE-2026-28275.htmlhttps://patchthecve.com/cve/CVE-2026-28275.htmlWed, 17 Jun 2026 10:28:24 +0000HIGH 8.1: Initiative is a self-hosted project management platform. Versions of the application prior to 0.32.4 do not invalidate previously issued JWT access tokens after a user changes their password. As a result, older tokens remain valid until expiration and can still be used to access protected API endpoihttps://patchthecve.com/cve/CVE-2026-28274.htmlhttps://patchthecve.com/cve/CVE-2026-28274.htmlWed, 17 Jun 2026 10:28:24 +0000HIGH 8.7: Initiative is a self-hosted project management platform. Versions of the application prior to 0.32.4 are vulnerable to Stored Cross-Site Scripting (XSS) in the document upload functionality. Any user with upload permissions within the "Initiatives" section can upload a malicious `.html` or `.htm` fi