https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2020-6937.htmlhttps://patchthecve.com/cve/CVE-2020-6937.htmlWed, 17 Jun 2026 03:23:59 +0000HIGH 7.5: A Denial of Service vulnerability in MuleSoft Mule CE/EE 3.8.x, 3.9.x, and 4.x released before April 7, 2020, could allow remote attackers to submit data which can lead to resource exhaustion.https://patchthecve.com/cve/CVE-2020-10991.htmlhttps://patchthecve.com/cve/CVE-2020-10991.htmlWed, 17 Jun 2026 02:48:49 +0000CRITICAL 9.8: Mulesoft APIkit through 1.3.0 allows XXE because of validation/RestXmlSchemaValidator.javahttps://patchthecve.com/cve/CVE-2019-15631.htmlhttps://patchthecve.com/cve/CVE-2019-15631.htmlWed, 17 Jun 2026 02:20:47 +0000CRITICAL 9.8: Remote Code Execution vulnerability in MuleSoft Mule CE/EE 3.x and API Gateway 2.x released before October 31, 2019 allows remote attackers to execute arbitrary code.https://patchthecve.com/cve/CVE-2019-13116.htmlhttps://patchthecve.com/cve/CVE-2019-13116.htmlWed, 17 Jun 2026 02:16:05 +0000CRITICAL 9.8: The MuleSoft Mule Community Edition runtime engine before 3.8 allows remote attackers to execute arbitrary code because of Java Deserialization, related to Apache Commons Collectionshttps://patchthecve.com/cve/CVE-2019-15630.htmlhttps://patchthecve.com/cve/CVE-2019-15630.htmlWed, 17 Jun 2026 02:20:46 +0000HIGH 7.5: Directory Traversal in APIkit, HTTP connector, and OAuth2 Provider components in MuleSoft Mule Runtime 3.2.0 and higher released before August 1 2019, MuleSoft Mule Runtime 4.1.0 and higher released before August 1 2019, and all versions of MuleSoft API Gateway released before August 1 2019 allow rehttps://patchthecve.com/cve/CVE-2014-9000.htmlhttps://patchthecve.com/cve/CVE-2014-9000.htmlWed, 17 Jun 2026 00:17:38 +0000MEDIUM 6.5: Mule Enterprise Management Console (MMC) does not properly restrict access to handler/securityService.rpc, which allows remote authenticated users to gain administrator privileges and execute arbitrary code via a crafted request that adds a new user. NOTE: this issue was originally reported for ESB