Login Request a demo
AP
Vendor
apostrophecms
14 products with CVEs on record
94
CVEs
0
On KEV
54
New 30D
Products
AP
apostrophe
apostrophecms
9.1
50 CVEs0 on KEV32 new
IM
import-export
apostrophecms
9.9
8 CVEs0 on KEV7 new
SA
sanitize-html
apostrophecms
9.3
14 CVEs0 on KEV4 new
AP
ApostropheCMS
apostrophecms
9.8
10 CVEs0 on KEV1 new
FO
form
@apostrophecms
5.3
2 CVEs0 on KEV2 new
UP
uploadfs
apostrophecms
5.6
2 CVEs0 on KEV2 new
AI
ai-helper
@apostrophecms
4.3
1 CVEs0 on KEV1 new
DB
db-connect
@apostrophecms
7.1
1 CVEs0 on KEV1 new
LO
login-hcaptcha
@apostrophecms
5.3
1 CVEs0 on KEV1 new
LO
login-recaptcha
@apostrophecms
5.3
1 CVEs0 on KEV1 new
MP
mport-export
@apostrophecms
6.5
1 CVEs0 on KEV1 new
PA
passport-bridge
@apostrophecms
5.3
1 CVEs0 on KEV1 new
AP
@apostrophecms/cli
apostrophecms
6.5
1 CVEs0 on KEV0 new
AP
@apostrophecms/seo
apostrophecms
8.7
1 CVEs0 on KEV0 new
Recent CVEs
CVEProductCVSSEPSSPublishedSummary
CVE-2026-113711
AP
apostrophe
apostrophecms
7.5
1%
Oct 20ApostropheCMS: Unauthenticated resource exhaustion via pre-auth aposBigUpload processing in @apostrophecms/import-export
CVE-2026-113710
AP
apostrophe
apostrophecms
5.9
0%
Oct 20ApostropheCMS: No Attempt Throttling on Authenticated Password-Change Endpoint Enables Unlimited Current-Password Guessing
CVE-2026-113671
AP
apostrophe
apostrophecms
4.3
0%
Oct 20ApostropheCMS: Host header controls server-side image fetch origin in @apostrophecms/ai-helper, enabling authenticated SSRF
CVE-2026-113669
AP
apostrophe
apostrophecms
5.3
0%
Oct 20ApostropheCMS: Cross-domain session token in URL confers session takeover
CVE-2026-113667
LO
login-recaptcha
@apostrophecms
5.3
0%
Oct 20ApostropheCMS: CAPTCHA response token not URL-encoded
CVE-2026-113668
AP
apostrophe
apostrophecms
5.3
0%
Oct 20ApostropheCMS: :_id/locales REST route omits the public-API authorization gate its sibling read routes enforce (unauthenticated doc-existence + locale metadata disclosure)
CVE-2026-113666
DB
db-connect
@apostrophecms
7.1
0%
Oct 20ApostropheCMS: Authenticated projection-exclusion prototype-member deletion in @apostrophecms/db-connect causes process-wide denial of service
CVE-2026-113665
AP
apostrophe
apostrophecms
3.7
0%
Oct 20ApostropheCMS: Missing Authorization on Notification PATCH/DELETE Endpoints
CVE-2026-113664
AP
apostrophe
apostrophecms
5.3
0%
Oct 20ApostropheCMS import-export tar guard misses './..' because it is a literal '../' substring test
CVE-2026-113662
IM
import-export
@apostrophecms
5.4
0%
Oct 20ApostropheCMS import-export: NoSQL injection via update-key value lets a crafted import match and overwrite an unidentified document
CVE-2026-113661
AP
apostrophe
apostrophecms
5.4
0%
Oct 20ApostropheCMS: Incomplete CVE-2026-53606: `meta http-equiv=refresh` `content` still ships `javascript:` / `data:` URLs
CVE-2026-113660
AP
apostrophe
apostrophecms
4.3
0%
Oct 20ApostropheCMS: Authenticated Object-Level Authorization Bypass in exist-in-locale Reveals Restricted Localized Draft Identifiers
CVE-2026-113659
AP
apostrophe
apostrophecms
6.1
0%
Oct 20ApostropheCMS: Client-side Prototype Pollution in apos.http.parseQuery leading to DOM-based XSS against authenticated users
CVE-2026-113658
AP
apostrophe
apostrophecms
7.5
1%
Oct 20ApostropheCMS: Unauthenticated CSV import requests leave rejected uploads in the system temporary directory
CVE-2026-113657
SA
sanitize-html
apostrophecms
3.7
0%
Oct 20ApostropheCMS sanitize-html: SMIL animation namespace-prefix bypass allows javascript: URI injection (XSS)
CVE-2026-113656
AP
apostrophe
apostrophecms
5.3
0%
Oct 20ApostropheCMS: Unauthenticated unbounded multipart upload → disk-exhaustion DoS
CVE-2026-113649
AP
apostrophe
apostrophecms
6.5
0%
Oct 20ApostropheCMS: Import API bypasses publication roles for protected content
CVE-2026-113655
AP
apostrophe
apostrophecms
4.3
0%
Oct 20ApostropheCMS: Same-parent page reorder in @apostrophecms/page move() re-ranks a restricted parent's children without create authorization
CVE-2026-113654
SA
sanitize-html
apostrophecms
5.3
0%
Oct 20ApostropheCMS sanitize-html: nonTextTags discard region ends early on an implied close, letting <noscript> content render
CVE-2026-113653
AP
apostrophe
apostrophecms
6.9
0%
Oct 20ApostropheCMS: The general public can access @apostrophecms/user objects via a relationship (viewRole is not applied to the general public)
CVE-2026-113652
AP
apostrophe
apostrophecms
5.6
0%
Oct 20ApostropheCMS uploadfs Azure backend leaks account-level SAS token into every public attachment URL (sas: true)
CVE-2026-113651
UP
uploadfs
apostrophecms
3.3
0%
Oct 20ApostropheCMS: Path traversal in uploadfs
CVE-2026-113650
SA
sanitize-html
apostrophecms
5.3
0%
Oct 20ApostropheCMS sanitize-html: unbounded recursion when re-sanitizing the fallback of a discarded iframe (stack overflow, nestingLimit not enforced)
CVE-2026-113648
IM
import-export
@apostrophecms
3.1
0%
Oct 20ApostropheCMS: Missing Authentication in `cleanExport` Route
CVE-2026-112958
AP
apostrophe
apostrophecms
5.4
0%
Oct 20ApostropheCMS: Stored XSS via Unescaped Widget Style Attribute Serialization
CVE-2026-112957
AP
apostrophe
apostrophecms
4.3
0%
Oct 20ApostropheCMS: GET /api/v1/@apostrophecms/page/:id bypasses viewRole restriction and exposes viewPermission-gated fields to lower-privileged users
CVE-2026-112956
AP
apostrophe
apostrophecms
6.5
0%
Oct 20ApostropheCMS: Archive duplicate continuation lets contributors overwrite published content
CVE-2026-112955
IM
import-export
@apostrophecms
6.5
1%
Oct 20ApostropheCMS: Import archives can exhaust server storage and deny service
CVE-2026-112954
AP
apostrophe
apostrophecms
5.3
0%
Oct 20ApostropheCMS: Unauthenticated publicApiProjection bypass via search and sort query builders in the public REST API
CVE-2026-112953
AP
apostrophe
apostrophecms
6.0
1%
Oct 20ApostropheCMS: Exposure of Sensitive Information via predictable export filenames
CVE-2026-112952
AP
apostrophe
apostrophecms
4.3
0%
Oct 20ApostropheCMS: POST /api/v1/@apostrophecms/doc/slugTaken discloses existence of private/admin-only content to any authenticated user
CVE-2026-112951
AP
apostrophe
apostrophecms
5.4
0%
Oct 20ApostropheCMS: Color field validation bypass allows stored XSS via HTML appended after rgb()/hsl() prefix
CVE-2026-110904
AP
ApostropheCMS
apostrophecms
5.3
0%
Oct 15ApostropheCMS before 4.33.0 allows authentication bypass for REST API page reading, as demonstrated by a /api/v1/@apostrophecms/page?all=1 call
CVE-2026-84371
AP
apostrophe
apostrophecms
5.4
0%
Sep 1ApostropheCMS: Stored XSS via SVG SMIL URI-list scheme-policy bypass
CVE-2026-71553
AP
apostrophe
apostrophecms
7.1
0%
Aug 17ApostropheCMS: 2nd-order prototype pollution via PATCH leading to single-request persistent DoS
CVE-2026-63667
AP
apostrophe
apostrophecms
6.5
0%
Aug 17ApostropheCMS: Arbitrary file read via import-export attachment-name path traversal
CVE-2026-63670
AP
apostrophe
apostrophecms
6.1
0%
Aug 17ApostropheCMS: Mutation-XSS / allowedTags bypass via literal `</textarea/>` solidus close
CVE-2026-63669
AP
apostrophe
apostrophecms
6.5
0%
Aug 17ApostropheCMS: Missing destination-parent authorization in page `move()` allows a low-privileged editor to move and re-rank pages inside a restricted subtree
CVE-2026-53609
AP
apostrophe
apostrophecms
9.1
0%
Jun 12Apostrophe has Server-Side Prototype Pollution in apos.util.set via patch operators that leads to process-wide authorization bypass
CVE-2026-53608
AP
@apostrophecms/seo
apostrophecms
8.7
0%
Jun 12@apostrophecms/seo Vulnerable to Stored XSS via Unsanitized Google Analytics / GTM ID Injected into Script Tag
CVE-2026-53607
AP
apostrophe
apostrophecms
3.7
0%
Jun 12@apostrophecms/file pretty-URL Vulnerable to Unauthenticated SSRF via Host header
CVE-2026-53606
SA
sanitize-html
apostrophecms
5.4
0%
Jun 12sanitize-html has an incomplete URI scheme validation that allows javascript: URIs through action, formaction, data, poster, and background attributes
CVE-2026-45014
AP
apostrophe
apostrophecms
5.3
0%
Jun 12Apostrophe Vulnerable to Stored Cross-Site Scripting via Unsanitized User Display Name in Draft Version Tooltip
CVE-2026-45013
AP
apostrophe
apostrophecms
8.1
0%
Jun 12Apostrophe has a Weak Password Recovery Mechanism for Forgotten Password and Improper Input Validation
CVE-2026-45012
AP
apostrophe
apostrophecms
7.6
0%
Jun 12Apostrophe has authenticated SSRF in rich-text widget import via @apostrophecms/area/validate-widget
CVE-2026-45011
AP
apostrophe
apostrophecms
7.3
0%
Jun 12Apostrophe has stored XSS via javascript: URL in Image Widget Link
CVE-2026-44990
SA
sanitize-html
apostrophecms
9.3
1%
Jun 12Apostrophe has default XSS via `xmp` raw-text passthrough in `sanitize-html`
CVE-2026-42853
AP
@apostrophecms/cli
apostrophecms
6.5
1%
Jun 12@apostrophecms/cli: Command Injection in apos create via Unsanitized Password Input
CVE-2026-40186
SA
sanitize-html
apostrophecms
6.1
0%
Apr 15ApostropheCMS: sanitize-html allowedTags Bypass via Entity-Decoded Text in nonTextTags Elements
CVE-2026-39857
AP
apostrophe
apostrophecms
5.3
0%
Apr 15Information Disclosure via `choices`/`counts` Query Parameters Bypassing publicApiProjection Field Restrictions
CVE-2026-35569
AP
apostrophe
apostrophecms
8.7
0%
Apr 15ApostropheCMS: Stored XSS in SEO Fields Leads to Authenticated API Data Exposure in ApostropheCMS
CVE-2026-33889
AP
apostrophe
apostrophecms
5.4
0%
Apr 15ApostropheCMS: Stored XSS via CSS Custom Property Injection in `@apostrophecms/color-field` Escaping Style Tag Context
CVE-2026-33888
AP
apostrophe
apostrophecms
5.3
1%
Apr 15ApostropheCMS: publicApiProjection Bypass via `project` Query Builder in Piece-Type REST API
CVE-2026-33877
AP
apostrophe
apostrophecms
3.7
0%
Apr 15ApostropheCMS: User Enumeration via Timing Side Channel in Password Reset Endpoint
CVE-2026-32731
IM
import-export
apostrophecms
9.9
1%
Mar 18ApostropheCMS has Arbitrary File Write (Zip Slip / Path Traversal) in Import-Export Gzip Extraction
CVE-2026-32730
AP
apostrophe
apostrophecms
8.1
0%
Mar 18ApostropheCMS MFA/TOTP Bypass via Incorrect MongoDB Query in Bearer Token Middleware
CVE-2014-125128
SA
Sanitize-html
Apostrophecms
6.1
0%
Sep 8'sanitize-html' prior to version 1.0.3 is vulnerable to Cross-site Scripting (XSS)
CVE-2019-25225
SA
Sanitize-html
Apostrophecms
6.1
0%
Sep 8`sanitize-html` prior to version 2.0.0-beta is vulnerable to Cross-site Scripting (XSS)
CVE-2024-21501
SA
Sanitize-html
Apostrophecms
5.3
1%
Feb 24Versions of the package sanitize-html before 2.12.1 are vulnerable to Information Exposure when used on the backend and with the style attribute allowed, allowing enumeration of…
CVE-2022-25887
SA
Sanitize-html
Apostrophecms
7.5
2%
Aug 30The package sanitize-html before 2.7.1 are vulnerable to Regular Expression Denial of Service (ReDoS) due to insecure global regular expression replacement logic of HTML comment…