AP
Product
ApostropheCMS
10
CVEs
0
On KEV
9.8
Max CVSS
1
New 30D
Severity mix
Critical 1High 2Medium 6Low 1
Watch
Add ApostropheCMS to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-40186 | 6.1 | Apr 15 | ApostropheCMS: sanitize-html allowedTags Bypass via Entity-Decoded Text in nonTextTags Elements Affected: 4.29.0 |
| CVE-2026-33889 | 5.4 | Apr 15 | ApostropheCMS: Stored XSS via CSS Custom Property Injection in `@apostrophecms/color-field` Escaping Style Tag Context Affected: before 4.29.0 |
| CVE-2021-25978 | 5.4 | Nov 7 | Apostrophe CMS versions between 2.63.0 to 3.3.1 are vulnerable to Stored XSS where an editor uploads an SVG file that contains malicious JavaScript onto the Images module, which… Affected: 2.63.0 through 3.3.1 |
| CVE-2026-110904 | 5.3 | Oct 15 | ApostropheCMS before 4.33.0 allows authentication bypass for REST API page reading, as demonstrated by a /api/v1/@apostrophecms/page?all=1 call Affected: before 4.33.0 |
| CVE-2026-39857 | 5.3 | Apr 15 | Information Disclosure via `choices`/`counts` Query Parameters Bypassing publicApiProjection Field Restrictions Affected: before 4.29.0 |
| CVE-2026-33888 | 5.3 | Apr 15 | ApostropheCMS: publicApiProjection Bypass via `project` Query Builder in Piece-Type REST API Affected: before 4.29.0 |
Showing 6