Skip to content
Apostrophecms Apostrophe vulnerabilities
-
@apostrophecms import-export, apostrophecms apostrophe +1 more
ApostropheCMS: Unauthenticated resource exhaustion via pre-auth aposBigUpload processing in @apostrophecms/import-export
CVE-2026-113711
Fix available
7.5 High
-
apostrophecms apostrophe
ApostropheCMS: No Attempt Throttling on Authenticated Password-Change Endpoint Enables Unlimited Current-Password Guessing
CVE-2026-113710
Fix available
5.9 Medium
-
@apostrophecms ai-helper, apostrophecms apostrophe +1 more
ApostropheCMS: Host header controls server-side image fetch origin in @apostrophecms/ai-helper, enabling authenticated SSRF
CVE-2026-113671
Fix available
4.3 Medium
-
@apostrophecms passport-bridge, apostrophecms apostrophe +1 more
ApostropheCMS: Cross-domain session token in URL confers session takeover
CVE-2026-113669
Fix available
5.3 Medium
-
@apostrophecms form, login-hcaptcha, login-recaptcha +1 more +3 more
ApostropheCMS: CAPTCHA response token not URL-encoded
CVE-2026-113667
Fix available
5.3 Medium
-
apostrophecms apostrophe
ApostropheCMS: :_id/locales REST route omits the public-API authorization gate its sibling read routes enforce (unauthenticated doc-existence + locale metadata disclosure)
CVE-2026-113668
Fix available
5.3 Medium
-
@apostrophecms db-connect, apostrophecms apostrophe +1 more
ApostropheCMS: Authenticated projection-exclusion prototype-member deletion in @apostrophecms/db-connect causes process-wide denial of service
CVE-2026-113666
Fix available
7.1 High
-
apostrophecms apostrophe
ApostropheCMS: Missing Authorization on Notification PATCH/DELETE Endpoints
CVE-2026-113665
Fix available
3.7 Low
-
@apostrophecms import-export, apostrophecms apostrophe +1 more
ApostropheCMS import-export tar guard misses './..' because it is a literal '../' substring test
CVE-2026-113664
Fix available
5.3 Medium
-
@apostrophecms import-export, apostrophecms apostrophe +1 more
ApostropheCMS import-export: NoSQL injection via update-key value lets a crafted import match and overwrite an unidentified document
CVE-2026-113662
Fix available
5.4 Medium
-
apostrophecms apostrophe, sanitize-html +1 more
ApostropheCMS: Incomplete CVE-2026-53606: `meta http-equiv=refresh` `content` still ships `javascript:` / `data:` URLs
CVE-2026-113661
Fix available
5.4 Medium
-
apostrophecms apostrophe
ApostropheCMS: Authenticated Object-Level Authorization Bypass in exist-in-locale Reveals Restricted Localized Draft Identifiers
CVE-2026-113660
Fix available
4.3 Medium
-
apostrophecms apostrophe
ApostropheCMS: Client-side Prototype Pollution in apos.http.parseQuery leading to DOM-based XSS against authenticated users
CVE-2026-113659
Fix available
6.1 Medium
-
apostrophecms apostrophe
ApostropheCMS: Unauthenticated CSV import requests leave rejected uploads in the system temporary directory
CVE-2026-113658
Fix available
7.5 High
-
apostrophecms apostrophe, sanitize-html +1 more
ApostropheCMS sanitize-html: SMIL animation namespace-prefix bypass allows javascript: URI injection (XSS)
CVE-2026-113657
Fix available
3.7 Low
-
@apostrophecms form, apostrophecms apostrophe +1 more
ApostropheCMS: Unauthenticated unbounded multipart upload → disk-exhaustion DoS
CVE-2026-113656
Fix available
5.3 Medium
-
@apostrophecms import-export, apostrophecms apostrophe +1 more
ApostropheCMS: Import API bypasses publication roles for protected content
CVE-2026-113649
Fix available
6.5 Medium
-
apostrophecms apostrophe
ApostropheCMS: Same-parent page reorder in @apostrophecms/page move() re-ranks a restricted parent's children without create authorization
CVE-2026-113655
Fix available
4.3 Medium
-
apostrophecms apostrophe, sanitize-html +1 more
ApostropheCMS sanitize-html: nonTextTags discard region ends early on an implied close, letting <noscript> content render
CVE-2026-113654
Fix available
5.3 Medium
-
apostrophecms apostrophe
ApostropheCMS: The general public can access @apostrophecms/user objects via a relationship (viewRole is not applied to the general public)
CVE-2026-113653
Fix available
6.9 Medium
-
apostrophecms apostrophe, uploadfs +1 more
ApostropheCMS uploadfs Azure backend leaks account-level SAS token into every public attachment URL (sas: true)
CVE-2026-113652
Fix available
5.6 Medium
-
apostrophecms apostrophe, uploadfs +1 more
ApostropheCMS: Path traversal in uploadfs
CVE-2026-113651
Fix available
3.3 Low
-
apostrophecms apostrophe, sanitize-html +1 more
ApostropheCMS sanitize-html: unbounded recursion when re-sanitizing the fallback of a discarded iframe (stack overflow, nestingLimit not enforced)
CVE-2026-113650
Fix available
5.3 Medium
-
@apostrophecms import-export, apostrophecms apostrophe +1 more
ApostropheCMS: Missing Authentication in `cleanExport` Route
CVE-2026-113648
Fix available
3.1 Low
-
apostrophecms apostrophe
ApostropheCMS: Stored XSS via Unescaped Widget Style Attribute Serialization
CVE-2026-112958
Fix available
5.4 Medium
-
apostrophecms apostrophe
ApostropheCMS: GET /api/v1/@apostrophecms/page/:id bypasses viewRole restriction and exposes viewPermission-gated fields to lower-privileged users
CVE-2026-112957
Fix available
4.3 Medium
-
@apostrophecms mport-export, apostrophecms apostrophe +1 more
ApostropheCMS: Archive duplicate continuation lets contributors overwrite published content
CVE-2026-112956
Fix available
6.5 Medium
-
@apostrophecms import-export, apostrophecms apostrophe +1 more
ApostropheCMS: Import archives can exhaust server storage and deny service
CVE-2026-112955
Fix available
6.5 Medium
-
apostrophecms apostrophe
ApostropheCMS: Unauthenticated publicApiProjection bypass via search and sort query builders in the public REST API
CVE-2026-112954
Fix available
5.3 Medium
-
@apostrophecms import-export, apostrophecms apostrophe +1 more
ApostropheCMS: Exposure of Sensitive Information via predictable export filenames
CVE-2026-112953
Fix available
6.0 Medium
-
apostrophecms apostrophe
ApostropheCMS: POST /api/v1/@apostrophecms/doc/slugTaken discloses existence of private/admin-only content to any authenticated user
CVE-2026-112952
Fix available
4.3 Medium
-
apostrophecms apostrophe
ApostropheCMS: Color field validation bypass allows stored XSS via HTML appended after rgb()/hsl() prefix
CVE-2026-112951
Fix available
5.4 Medium
-
apostrophecms
ApostropheCMS before 4.33.0 allows authentication bypass for REST API page reading, as...
CVE-2026-110904
5.3 Medium
-
apostrophecms apostrophe
ApostropheCMS: Stored XSS via SVG SMIL URI-list scheme-policy bypass
CVE-2026-84371
Fix available
5.4 Medium
-
apostrophecms apostrophe
ApostropheCMS: 2nd-order prototype pollution via PATCH leading to single-request persistent DoS
CVE-2026-71553
Fix available
7.1 High
-
apostrophecms apostrophe
ApostropheCMS: Arbitrary file read via import-export attachment-name path traversal
CVE-2026-63667
Fix available
6.5 Medium
-
apostrophecms apostrophe
ApostropheCMS: Mutation-XSS / allowedTags bypass via literal `</textarea/>` solidus close
CVE-2026-63670
Fix available
6.1 Medium
-
apostrophecms apostrophe
ApostropheCMS: Missing destination-parent authorization in page `move()` allows a low-privileged editor to move and re-rank pages inside a restricted subtree
CVE-2026-63669
Fix available
6.5 Medium
-
apostrophecms apostrophe
Apostrophe has Server-Side Prototype Pollution in apos.util.set via patch operators that leads to process-wide authorization bypass
CVE-2026-53609
Fix available
9.1 Critical
-
apostrophecms @apostrophecms/seo
@apostrophecms/seo Vulnerable to Stored XSS via Unsanitized Google Analytics / GTM ID Injected into Script Tag
CVE-2026-53608
Fix available
8.7 High
-
apostrophecms apostrophe
@apostrophecms/file pretty-URL Vulnerable to Unauthenticated SSRF via Host header
CVE-2026-53607
Fix available
3.7 Low
-
apostrophecms apostrophe
Apostrophe Vulnerable to Stored Cross-Site Scripting via Unsanitized User Display Name in Draft Version Tooltip
CVE-2026-45014
5.3 Medium
-
apostrophecms apostrophe
Apostrophe has stored XSS via javascript: URL in Image Widget Link
CVE-2026-45011
7.3 High
-
apostrophecms apostrophe
Apostrophe has a Weak Password Recovery Mechanism for Forgotten Password and Improper Input Validation
CVE-2026-45013
8.1 High
-
apostrophecms apostrophe
Apostrophe has authenticated SSRF in rich-text widget import via @apostrophecms/area/validate-widget
CVE-2026-45012
7.6 High
-
apostrophecms @apostrophecms/cli
@apostrophecms/cli: Command Injection in apos create via Unsanitized Password Input
CVE-2026-42853
6.5 Medium
-
apostrophecms apostrophe, apostrophecms, apostrophecms sanitize-html +2 more
ApostropheCMS: sanitize-html allowedTags Bypass via Entity-Decoded Text in nonTextTags Elements
CVE-2026-40186
Fix available
6.1 Medium
-
apostrophecms apostrophe, apostrophecms +1 more
Information Disclosure via `choices`/`counts` Query Parameters Bypassing publicApiProjection Field Restrictions
CVE-2026-39857
Fix available
5.3 Medium
-
apostrophecms apostrophe, apostrophecms +1 more
ApostropheCMS: Stored XSS in SEO Fields Leads to Authenticated API Data Exposure in ApostropheCMS
CVE-2026-35569
Fix available
8.7 High
-
apostrophecms apostrophe, apostrophecms +1 more
ApostropheCMS: Stored XSS via CSS Custom Property Injection in `@apostrophecms/color-field` Escaping Style Tag Context
CVE-2026-33889
Fix available
5.4 Medium
- Show olderLoading…