Log in Start free

@apostrophecms

Products

ProductCVEsExploitedLatest
apostrophe50–Oct 20, 2026
import-export8–Oct 20, 2026
sanitize-html7–Oct 20, 2026
uploadfs2–Oct 20, 2026
form2–Oct 20, 2026
db-connect1–Oct 20, 2026
ai-helper1–Oct 20, 2026
@apostrophecms/cli1–Jun 12, 2026
login-hcaptcha1–Oct 20, 2026
login-recaptcha1–Oct 20, 2026
mport-export1–Oct 20, 2026
passport-bridge1–Oct 20, 2026
ApostropheCMS1–Oct 15, 2026
@apostrophecms/seo1–Jun 12, 2026

Exploited and recent CVEs

  • CVE-2026-113711 High 7.5 ApostropheCMS: Unauthenticated resource exhaustion via pre-auth aposBigUpload processing in @apostrophecms/import-export 0.6%
  • CVE-2026-113711 High 7.5 ApostropheCMS: Unauthenticated resource exhaustion via pre-auth aposBigUpload processing in @apostrophecms/import-export 0.6%
  • CVE-2026-113710 Medium 5.9 ApostropheCMS: No Attempt Throttling on Authenticated Password-Change Endpoint Enables Unlimited Current-Password Guessing 0.3%
  • CVE-2026-113671 Medium 4.3 ApostropheCMS: Host header controls server-side image fetch origin in @apostrophecms/ai-helper, enabling authenticated SSRF 0.3%
  • CVE-2026-113671 Medium 4.3 ApostropheCMS: Host header controls server-side image fetch origin in @apostrophecms/ai-helper, enabling authenticated SSRF 0.3%
  • CVE-2026-113669 Medium 5.3 ApostropheCMS: Cross-domain session token in URL confers session takeover 0.4%
  • CVE-2026-113669 Medium 5.3 ApostropheCMS: Cross-domain session token in URL confers session takeover 0.4%
  • CVE-2026-113667 Medium 5.3 ApostropheCMS: CAPTCHA response token not URL-encoded 0.4%
  • CVE-2026-113667 Medium 5.3 ApostropheCMS: CAPTCHA response token not URL-encoded 0.4%
  • CVE-2026-113667 Medium 5.3 ApostropheCMS: CAPTCHA response token not URL-encoded 0.4%
  • CVE-2026-113667 Medium 5.3 ApostropheCMS: CAPTCHA response token not URL-encoded 0.4%
  • CVE-2026-113668 Medium 5.3 ApostropheCMS: :_id/locales REST route omits the public-API authorization gate its sibling read routes enforce (unauthenticated doc-existence + locale metadata disclosure) 0.3%
  • CVE-2026-113666 High 7.1 ApostropheCMS: Authenticated projection-exclusion prototype-member deletion in @apostrophecms/db-connect causes process-wide denial of service 0.4%
  • CVE-2026-113666 High 7.1 ApostropheCMS: Authenticated projection-exclusion prototype-member deletion in @apostrophecms/db-connect causes process-wide denial of service 0.4%
  • CVE-2026-113665 Low 3.7 ApostropheCMS: Missing Authorization on Notification PATCH/DELETE Endpoints 0.3%
  • CVE-2026-113664 Medium 5.3 ApostropheCMS import-export tar guard misses './..' because it is a literal '../' substring test 0.5%
  • CVE-2026-113664 Medium 5.3 ApostropheCMS import-export tar guard misses './..' because it is a literal '../' substring test 0.5%
  • CVE-2026-113662 Medium 5.4 ApostropheCMS import-export: NoSQL injection via update-key value lets a crafted import match and overwrite an unidentified document 0.3%
  • CVE-2026-113662 Medium 5.4 ApostropheCMS import-export: NoSQL injection via update-key value lets a crafted import match and overwrite an unidentified document 0.3%
  • CVE-2026-113661 Medium 5.4 ApostropheCMS: Incomplete CVE-2026-53606: `meta http-equiv=refresh` `content` still ships `javascript:` / `data:` URLs 0.3%
  • CVE-2026-113661 Medium 5.4 ApostropheCMS: Incomplete CVE-2026-53606: `meta http-equiv=refresh` `content` still ships `javascript:` / `data:` URLs 0.3%
  • CVE-2026-113660 Medium 4.3 ApostropheCMS: Authenticated Object-Level Authorization Bypass in exist-in-locale Reveals Restricted Localized Draft Identifiers 0.4%
  • CVE-2026-113659 Medium 6.1 ApostropheCMS: Client-side Prototype Pollution in apos.http.parseQuery leading to DOM-based XSS against authenticated users 0.3%
  • CVE-2026-113658 High 7.5 ApostropheCMS: Unauthenticated CSV import requests leave rejected uploads in the system temporary directory 0.6%
  • CVE-2026-113657 Low 3.7 ApostropheCMS sanitize-html: SMIL animation namespace-prefix bypass allows javascript: URI injection (XSS) 0.3%
  • CVE-2026-113657 Low 3.7 ApostropheCMS sanitize-html: SMIL animation namespace-prefix bypass allows javascript: URI injection (XSS) 0.3%
  • CVE-2026-113656 Medium 5.3 ApostropheCMS: Unauthenticated unbounded multipart upload → disk-exhaustion DoS 0.5%
  • CVE-2026-113656 Medium 5.3 ApostropheCMS: Unauthenticated unbounded multipart upload → disk-exhaustion DoS 0.5%
  • CVE-2026-113649 Medium 6.5 ApostropheCMS: Import API bypasses publication roles for protected content 0.3%
  • CVE-2026-113649 Medium 6.5 ApostropheCMS: Import API bypasses publication roles for protected content 0.3%