PatchTheCVE: roundup-trackerhttps://patchthecve.com/CVEs with upgrade or downgrade fix stepsCVE-2024-39126: Roundup before 2.4.0 allows XSS via JavaScript in PDF, XML, and SVG documents.https://patchthecve.com/cve/CVE-2024-39126.htmlhttps://patchthecve.com/cve/CVE-2024-39126.htmlWed, 17 Jun 2026 07:41:27 +0000MEDIUM 5.4: Roundup before 2.4.0 allows XSS via JavaScript in PDF, XML, and SVG documents.CVE-2024-39125: Roundup before 2.4.0 allows XSS via a SCRIPT element in an HTTP Referer header.https://patchthecve.com/cve/CVE-2024-39125.htmlhttps://patchthecve.com/cve/CVE-2024-39125.htmlWed, 17 Jun 2026 07:41:26 +0000MEDIUM 5.4: Roundup before 2.4.0 allows XSS via a SCRIPT element in an HTTP Referer header.CVE-2024-39124: In Roundup before 2.4.0, classhelpers (_generic.help.html) allow XSS.https://patchthecve.com/cve/CVE-2024-39124.htmlhttps://patchthecve.com/cve/CVE-2024-39124.htmlWed, 17 Jun 2026 07:41:26 +0000MEDIUM 5.4: In Roundup before 2.4.0, classhelpers (_generic.help.html) allow XSS.