@apostrophecms apostrophe

• CVE-2026-113711 High 7.5 ApostropheCMS: Unauthenticated resource exhaustion via pre-auth aposBigUpload processing in @apostrophecms/import-export 0.6%
• CVE-2026-113710 Medium 5.9 ApostropheCMS: No Attempt Throttling on Authenticated Password-Change Endpoint Enables Unlimited Current-Password Guessing 0.3%
• CVE-2026-113671 Medium 4.3 ApostropheCMS: Host header controls server-side image fetch origin in @apostrophecms/ai-helper, enabling authenticated SSRF 0.3%
• CVE-2026-113669 Medium 5.3 ApostropheCMS: Cross-domain session token in URL confers session takeover 0.4%
• CVE-2026-113667 Medium 5.3 ApostropheCMS: CAPTCHA response token not URL-encoded 0.4%
• CVE-2026-113668 Medium 5.3 ApostropheCMS: :_id/locales REST route omits the public-API authorization gate its sibling read routes enforce (unauthenticated doc-existence + locale metadata disclosure) 0.3%
• CVE-2026-113666 High 7.1 ApostropheCMS: Authenticated projection-exclusion prototype-member deletion in @apostrophecms/db-connect causes process-wide denial of service 0.4%
• CVE-2026-113665 Low 3.7 ApostropheCMS: Missing Authorization on Notification PATCH/DELETE Endpoints 0.3%
• CVE-2026-113664 Medium 5.3 ApostropheCMS import-export tar guard misses './..' because it is a literal '../' substring test 0.5%
• CVE-2026-113662 Medium 5.4 ApostropheCMS import-export: NoSQL injection via update-key value lets a crafted import match and overwrite an unidentified document 0.3%
• CVE-2026-113661 Medium 5.4 ApostropheCMS: Incomplete CVE-2026-53606: `meta http-equiv=refresh` `content` still ships `javascript:` / `data:` URLs 0.3%
• CVE-2026-113660 Medium 4.3 ApostropheCMS: Authenticated Object-Level Authorization Bypass in exist-in-locale Reveals Restricted Localized Draft Identifiers 0.4%
• CVE-2026-113659 Medium 6.1 ApostropheCMS: Client-side Prototype Pollution in apos.http.parseQuery leading to DOM-based XSS against authenticated users 0.3%
• CVE-2026-113658 High 7.5 ApostropheCMS: Unauthenticated CSV import requests leave rejected uploads in the system temporary directory 0.6%
• CVE-2026-113657 Low 3.7 ApostropheCMS sanitize-html: SMIL animation namespace-prefix bypass allows javascript: URI injection (XSS) 0.3%
• CVE-2026-113656 Medium 5.3 ApostropheCMS: Unauthenticated unbounded multipart upload → disk-exhaustion DoS 0.5%
• CVE-2026-113649 Medium 6.5 ApostropheCMS: Import API bypasses publication roles for protected content 0.3%
• CVE-2026-113655 Medium 4.3 ApostropheCMS: Same-parent page reorder in @apostrophecms/page move() re-ranks a restricted parent's children without create authorization 0.3%
• CVE-2026-113654 Medium 5.3 ApostropheCMS sanitize-html: nonTextTags discard region ends early on an implied close, letting <noscript> content render 0.4%
• CVE-2026-113653 Medium 6.9 ApostropheCMS: The general public can access @apostrophecms/user objects via a relationship (viewRole is not applied to the general public) 0.4%
• CVE-2026-113652 Medium 5.6 ApostropheCMS uploadfs Azure backend leaks account-level SAS token into every public attachment URL (sas: true) 0.3%
• CVE-2026-113651 Low 3.3 ApostropheCMS: Path traversal in uploadfs 0.3%
• CVE-2026-113650 Medium 5.3 ApostropheCMS sanitize-html: unbounded recursion when re-sanitizing the fallback of a discarded iframe (stack overflow, nestingLimit not enforced) 0.5%
• CVE-2026-113648 Low 3.1 ApostropheCMS: Missing Authentication in `cleanExport` Route 0.3%
• CVE-2026-112958 Medium 5.4 ApostropheCMS: Stored XSS via Unescaped Widget Style Attribute Serialization 0.3%
• CVE-2026-112957 Medium 4.3 ApostropheCMS: GET /api/v1/@apostrophecms/page/:id bypasses viewRole restriction and exposes viewPermission-gated fields to lower-privileged users 0.3%
• CVE-2026-112956 Medium 6.5 ApostropheCMS: Archive duplicate continuation lets contributors overwrite published content 0.3%
• CVE-2026-112955 Medium 6.5 ApostropheCMS: Import archives can exhaust server storage and deny service 0.5%
• CVE-2026-112954 Medium 5.3 ApostropheCMS: Unauthenticated publicApiProjection bypass via search and sort query builders in the public REST API 0.4%
• CVE-2026-112953 Medium 6.0 ApostropheCMS: Exposure of Sensitive Information via predictable export filenames 0.6%
• CVE-2026-112952 Medium 4.3 ApostropheCMS: POST /api/v1/@apostrophecms/doc/slugTaken discloses existence of private/admin-only content to any authenticated user 0.3%
• CVE-2026-112951 Medium 5.4 ApostropheCMS: Color field validation bypass allows stored XSS via HTML appended after rgb()/hsl() prefix 0.3%
• CVE-2026-84371 Medium 5.4 ApostropheCMS: Stored XSS via SVG SMIL URI-list scheme-policy bypass 0.3%
• CVE-2026-71553 High 7.1 ApostropheCMS: 2nd-order prototype pollution via PATCH leading to single-request persistent DoS 0.4%
• CVE-2026-63667 Medium 6.5 ApostropheCMS: Arbitrary file read via import-export attachment-name path traversal 0.5%
• CVE-2026-63670 Medium 6.1 ApostropheCMS: Mutation-XSS / allowedTags bypass via literal `</textarea/>` solidus close 0.3%
• CVE-2026-63669 Medium 6.5 ApostropheCMS: Missing destination-parent authorization in page `move()` allows a low-privileged editor to move and re-rank pages inside a restricted subtree 0.3%
• CVE-2026-53609 Critical 9.1 Apostrophe has Server-Side Prototype Pollution in apos.util.set via patch operators that leads to process-wide authorization bypass 0.3%
• CVE-2026-53607 Low 3.7 @apostrophecms/file pretty-URL Vulnerable to Unauthenticated SSRF via Host header 0.3%
• CVE-2026-45014 Medium 5.3 Apostrophe Vulnerable to Stored Cross-Site Scripting via Unsanitized User Display Name in Draft Version Tooltip 0.3%
• CVE-2026-45013 High 8.1 Apostrophe has a Weak Password Recovery Mechanism for Forgotten Password and Improper Input Validation 0.3%
• CVE-2026-45012 High 7.6 Apostrophe has authenticated SSRF in rich-text widget import via @apostrophecms/area/validate-widget 0.2%
• CVE-2026-45011 High 7.3 Apostrophe has stored XSS via javascript: URL in Image Widget Link 0.3%
• CVE-2026-40186 Medium 6.1 ApostropheCMS: sanitize-html allowedTags Bypass via Entity-Decoded Text in nonTextTags Elements 0.2%
• CVE-2026-39857 Medium 5.3 Information Disclosure via `choices`/`counts` Query Parameters Bypassing publicApiProjection Field Restrictions 0.4%
• CVE-2026-35569 High 8.7 ApostropheCMS: Stored XSS in SEO Fields Leads to Authenticated API Data Exposure in ApostropheCMS 0.3%
• CVE-2026-33889 Medium 5.4 ApostropheCMS: Stored XSS via CSS Custom Property Injection in `@apostrophecms/color-field` Escaping Style Tag Context 0.2%
• CVE-2026-33888 Medium 5.3 ApostropheCMS: publicApiProjection Bypass via `project` Query Builder in Piece-Type REST API 0.5%
• CVE-2026-33877 Low 3.7 ApostropheCMS: User Enumeration via Timing Side Channel in Password Reset Endpoint 0.4%
• CVE-2026-32730 High 8.1 ApostropheCMS MFA/TOTP Bypass via Incorrect MongoDB Query in Bearer Token Middleware 0.4%