https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2026-25937.htmlhttps://patchthecve.com/cve/CVE-2026-25937.htmlWed, 17 Jun 2026 10:25:27 +0000MEDIUM 6.5: GLPI is a free Asset and IT management software package. Starting in version 11.0.0 and prior to version 11.0.6, a malicious actor with knowledge of a user's credentials can bypass MFA and steal their account. Version 11.0.6 fixes the issue.https://patchthecve.com/cve/CVE-2026-25936.htmlhttps://patchthecve.com/cve/CVE-2026-25936.htmlWed, 17 Jun 2026 10:25:27 +0000MEDIUM 6.5: GLPI is a free Asset and IT management software package. Starting in version 11.0.0 and prior to version 11.0.6, an authenticated user can perfom a SQL injection. Version 11.0.6 fixes the issue.https://patchthecve.com/cve/CVE-2026-23489.htmlhttps://patchthecve.com/cve/CVE-2026-23489.htmlWed, 17 Jun 2026 10:21:40 +0000CRITICAL 9.1: Fields is a GLPI plugin that allows users to add custom fields on GLPI items forms. Prior to version 1.23.3, it is possible to execute arbitrary PHP code from users that are allowed to create dropdowns. This issue has been patched in version 1.23.3.