Login Request a demo
AP
Product
apostrophe
by apostrophecms · last CVE Oct 20, 2026
50
CVEs
0
On KEV
9.1
Max CVSS
32
New 30D
Vulnerabilities50In the news0Timeline
Severity mix
Critical 1High 9Medium 34Low 6
Severity
All severities50Critical1High9Medium34Low6
Exploitation
On CISA KEV0Exploited in the wild0
Watch

Add apostrophe to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2026-35569
8.7
0%
Apr 15
ApostropheCMS: Stored XSS in SEO Fields Leads to Authenticated API Data Exposure in ApostropheCMS
Affected: < 4.29.0
CVE-2026-45013
8.1
0%
Jun 12
Apostrophe has a Weak Password Recovery Mechanism for Forgotten Password and Improper Input Validation
Affected: <= 4.29.0
CVE-2026-32730
8.1
0%
Mar 18
ApostropheCMS MFA/TOTP Bypass via Incorrect MongoDB Query in Bearer Token Middleware
Affected: < 4.28.0
CVE-2026-45012
7.6
0%
Jun 12
Apostrophe has authenticated SSRF in rich-text widget import via @apostrophecms/area/validate-widget
Affected: <= 4.29.0
CVE-2026-113711
7.5
1%
Oct 20
ApostropheCMS: Unauthenticated resource exhaustion via pre-auth aposBigUpload processing in @apostrophecms/import-export
Affected: < 4.33.0
CVE-2026-113658
7.5
1%
Oct 20
ApostropheCMS: Unauthenticated CSV import requests leave rejected uploads in the system temporary directory
Affected: < 4.33.0
CVE-2026-45011
7.3
0%
Jun 12
Apostrophe has stored XSS via javascript: URL in Image Widget Link
Affected: = 4.29.0
CVE-2026-113666
7.1
0%
Oct 20
ApostropheCMS: Authenticated projection-exclusion prototype-member deletion in @apostrophecms/db-connect causes process-wide denial of service
Affected: < 4.33.0
CVE-2026-71553
7.1
0%
Aug 17
ApostropheCMS: 2nd-order prototype pollution via PATCH leading to single-request persistent DoS
Affected: <= 4.32.0
Showing 9