https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2026-2947.htmlhttps://patchthecve.com/cve/CVE-2026-2947.htmlWed, 17 Jun 2026 10:32:05 +0000LOW 3.5: A vulnerability was detected in rymcu forest up to 0.0.5. This affects the function updateUserInfo of the file - src/main/java/com/rymcu/forest/web/api/user/UserInfoController.java of the component User Profile Handler. The manipulation results in cross site scripting. The attack can be executed remhttps://patchthecve.com/cve/CVE-2026-2946.htmlhttps://patchthecve.com/cve/CVE-2026-2946.htmlWed, 17 Jun 2026 10:32:05 +0000LOW 3.5: A security vulnerability has been detected in rymcu forest up to 0.0.5. Affected by this issue is the function XssUtils.replaceHtmlCode of the file src/main/java/com/rymcu/forest/util/XssUtils.java of the component Article Content/Comments/Portfolio. The manipulation leads to cross site scripting. Rhttps://patchthecve.com/cve/CVE-2025-12925.htmlhttps://patchthecve.com/cve/CVE-2025-12925.htmlWed, 07 Oct 2026 21:10:00 +0000HIGH 7.3: A security flaw has been discovered in rymcu forest up to de53ce79db9faa2efc4e79ce1077a302c42a1224. Impacted is the function getAll/addDic/getAllDic/deleteDic of the file src/main/java/com/rymcu/forest/lucene/api/UserDicController.java. The manipulation results in missing authorization. The attack mhttps://patchthecve.com/cve/CVE-2025-12924.htmlhttps://patchthecve.com/cve/CVE-2025-12924.htmlWed, 07 Oct 2026 21:10:00 +0000MEDIUM 4.3: A vulnerability was identified in rymcu forest up to de53ce79db9faa2efc4e79ce1077a302c42a1224. This issue affects the function GlobalResult of the file src/main/java/com/rymcu/forest/web/api/bank/BankController.java. The manipulation leads to missing authorization. The attack may be initiated remotehttps://patchthecve.com/cve/CVE-2025-63687.htmlhttps://patchthecve.com/cve/CVE-2025-63687.htmlWed, 17 Jun 2026 09:53:22 +0000MEDIUM 6.5: An issue was discovered in rymcu forest thru commit f782e85 (2025-09-04) in function doBefore in file src/main/java/com/rymcu/forest/core/service/security/AuthorshipAspect.java, allowing authorized attackers to delete arbitrary users posts.