https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2026-22800.htmlhttps://patchthecve.com/cve/CVE-2026-22800.htmlWed, 17 Jun 2026 10:20:27 +0000LOW 2.4: PILOS (Platform for Interactive Live-Online Seminars) is a frontend for BigBlueButton. Prior to 4.10.0, Cross-Site Request Forgery (CSRF) vulnerability exists in an administrative API endpoint responsible for terminating all active video conferences on a single server. The affected endpoint performshttps://patchthecve.com/cve/CVE-2025-62781.htmlhttps://patchthecve.com/cve/CVE-2025-62781.htmlThu, 08 Oct 2026 11:10:00 +0000MEDIUM 5.0: PILOS (Platform for Interactive Live-Online Seminars) is a frontend for BigBlueButton. Prior to 4.8.0, users with a local account can change their password while logged in. When doing so, all other active sessions are terminated, except for the currently active one. However, the current session’s tohttps://patchthecve.com/cve/CVE-2025-62524.htmlhttps://patchthecve.com/cve/CVE-2025-62524.htmlThu, 08 Oct 2026 11:10:00 +0000MEDIUM 5.3: PILOS (Platform for Interactive Live-Online Seminars) is a frontend for BigBlueButton. PILOS before 4.8.0 exposes the PHP version via the X-Powered-By header, enabling attackers to fingerprint the server and assess potential exploits. This information disclosure vulnerability originates from PHP’s bhttps://patchthecve.com/cve/CVE-2025-62523.htmlhttps://patchthecve.com/cve/CVE-2025-62523.htmlThu, 08 Oct 2026 11:10:00 +0000MEDIUM 6.3: PILOS (Platform for Interactive Live-Online Seminars) is a frontend for BigBlueButton. PILOS before 4.8.0 includes a Cross-Origin Resource Sharing (CORS) misconfiguration in its middleware: it reflects the Origin request header back in the Access-Control-Allow-Origin response header without proper v