https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2025-63785.htmlhttps://patchthecve.com/cve/CVE-2025-63785.htmlWed, 17 Jun 2026 09:53:30 +0000MEDIUM 6.1: A DOM-based Cross-Site Scripting (XSS) vulnerability exists in the text editor feature of the Onlook web application 0.2.32. This vulnerability occurs because user-supplied input is not properly sanitized before being directly injected into the DOM via innerHTML when editing a text element. An attachttps://patchthecve.com/cve/CVE-2025-63784.htmlhttps://patchthecve.com/cve/CVE-2025-63784.htmlWed, 17 Jun 2026 09:53:29 +0000MEDIUM 6.5: An Open Redirect vulnerability exists in the OAuth callback handler in file onlook/apps/web/client/src/app/auth/callback/route.ts in Onlook web application 0.2.32. The vulnerability occurs because the application trusts the X-Forwarded-Host header value without proper validation when constructing a https://patchthecve.com/cve/CVE-2025-63783.htmlhttps://patchthecve.com/cve/CVE-2025-63783.htmlWed, 17 Jun 2026 09:53:29 +0000HIGH 7.6: A Broken Object Level Authorization (BOLA) vulnerability was discovered in the tRPC project mutation APIs (update, delete, add/remove tag) of the Onlook web application 0.2.32. The vulnerability exists because the API fails to verify the ownership or membership of the currently authenticated user fo