AP
Product
apostrophe
50
CVEs
0
On KEV
9.1
Max CVSS
32
New 30D
Severity mix
Critical 1High 9Medium 34Low 6
Watch
Add apostrophe to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-113665 | 3.7 | Oct 20 | ApostropheCMS: Missing Authorization on Notification PATCH/DELETE Endpoints Affected: < 4.33.0 |
| CVE-2026-113657 | 3.7 | Oct 20 | ApostropheCMS sanitize-html: SMIL animation namespace-prefix bypass allows javascript: URI injection (XSS) Affected: < 4.33.0 |
| CVE-2026-53607 | 3.7 | Jun 12 | @apostrophecms/file pretty-URL Vulnerable to Unauthenticated SSRF via Host header Affected: <= 4.30.0 |
| CVE-2026-33877 | 3.7 | Apr 15 | ApostropheCMS: User Enumeration via Timing Side Channel in Password Reset Endpoint Affected: < 4.29.0 |
| CVE-2026-113651 | 3.3 | Oct 20 | ApostropheCMS: Path traversal in uploadfs Affected: < 4.33.0 |
| CVE-2026-113648 | 3.1 | Oct 20 | ApostropheCMS: Missing Authentication in `cleanExport` Route Affected: < 4.34.0 |
Showing 6