https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2020-19586.htmlhttps://patchthecve.com/cve/CVE-2020-19586.htmlWed, 17 Jun 2026 02:59:50 +0000CRITICAL 9.0: Incorrect Access Control issue in Yellowfin Business Intelligence 7.3 allows remote attackers to escalate privilege via MIAdminStyles.i4 Admin UI.https://patchthecve.com/cve/CVE-2021-36389.htmlhttps://patchthecve.com/cve/CVE-2021-36389.htmlWed, 17 Jun 2026 03:58:47 +0000HIGH 7.5: In Yellowfin before 9.6.1 it is possible to enumerate and download uploaded images through an Insecure Direct Object Reference vulnerability exploitable by sending a specially crafted HTTP GET request to the page "MIImage.i4".https://patchthecve.com/cve/CVE-2021-36388.htmlhttps://patchthecve.com/cve/CVE-2021-36388.htmlWed, 17 Jun 2026 03:58:47 +0000HIGH 7.5: In Yellowfin before 9.6.1 it is possible to enumerate and download users profile pictures through an Insecure Direct Object Reference vulnerability exploitable by sending a specially crafted HTTP GET request to the page "MIIAvatarImage.i4".https://patchthecve.com/cve/CVE-2021-36387.htmlhttps://patchthecve.com/cve/CVE-2021-36387.htmlWed, 17 Jun 2026 03:58:47 +0000MEDIUM 5.4: In Yellowfin before 9.6.1 there is a Stored Cross-Site Scripting vulnerability in the video embed functionality exploitable through a specially crafted HTTP POST request to the page "ActivityStreamAjax.i4".