Every public CVE, as it is published
The whole CVE List, enriched with NVD scores, CISA's known exploited catalog and EPSS exploit probabilities. Updated every few minutes; last read 1 min ago.
At a glance
Published CVEs; rejected ones are not counted.
- 400,905All CVEsplus 19,118 rejected
- 348Last 24 hours2,786 in the last 7 days
- 16,766Last 30 days1,547 of them critical
- 1,768Known exploitedin the CISA KEV catalog
CVEs published per year
All time, by publication date in UTC; follows the filter above.
- Critical
- High
- Medium
- Low
- Not scored
Show the numbers as a table
| Period | Critical | High | Medium | Low | Not scored | Total | Cumulative |
|---|---|---|---|---|---|---|---|
| 2026 | 3 | 10 | 37 | 6 | 0 | 56 | 56 |
| Title | ||
|---|---|---|
| CVE-2026-113711 | ApostropheCMS: Unauthenticated resource exhaustion via pre-auth aposBigUpload processing in @apostrophecms/import-exportapostrophecms · apostrophe | High7.5 |
| CVE-2026-113710 | ApostropheCMS: No Attempt Throttling on Authenticated Password-Change Endpoint Enables Unlimited Current-Password Guessingapostrophecms · apostrophe | Medium5.9 |
| CVE-2026-113671 | ApostropheCMS: Host header controls server-side image fetch origin in @apostrophecms/ai-helper, enabling authenticated SSRFapostrophecms · apostrophe | Medium4.3 |
| CVE-2026-113669 | ApostropheCMS: Cross-domain session token in URL confers session takeoverapostrophecms · apostrophe | Medium5.3 |
| CVE-2026-113667 | ApostropheCMS: CAPTCHA response token not URL-encodedapostrophecms · apostrophe | Medium5.3 |
| CVE-2026-113668 | ApostropheCMS: :_id/locales REST route omits the public-API authorization gate its sibling read routes enforce (unauthenticated doc-existence + locale metadata disclosure)apostrophecms · apostrophe | Medium5.3 |
| CVE-2026-113666 | ApostropheCMS: Authenticated projection-exclusion prototype-member deletion in @apostrophecms/db-connect causes process-wide denial of serviceapostrophecms · apostrophe | High7.1 |
| CVE-2026-113665 | ApostropheCMS: Missing Authorization on Notification PATCH/DELETE Endpointsapostrophecms · apostrophe | Low3.7 |
| CVE-2026-113664 | ApostropheCMS import-export tar guard misses './..' because it is a literal '../' substring testapostrophecms · apostrophe | Medium5.3 |
| CVE-2026-113662 | ApostropheCMS import-export: NoSQL injection via update-key value lets a crafted import match and overwrite an unidentified documentapostrophecms · apostrophe | Medium5.4 |
| CVE-2026-113661 | ApostropheCMS: Incomplete CVE-2026-53606: `meta http-equiv=refresh` `content` still ships `javascript:` / `data:` URLsapostrophecms · apostrophe | Medium5.4 |
| CVE-2026-113660 | ApostropheCMS: Authenticated Object-Level Authorization Bypass in exist-in-locale Reveals Restricted Localized Draft Identifiersapostrophecms · apostrophe | Medium4.3 |
| CVE-2026-113659 | ApostropheCMS: Client-side Prototype Pollution in apos.http.parseQuery leading to DOM-based XSS against authenticated usersapostrophecms · apostrophe | Medium6.1 |
| CVE-2026-113658 | ApostropheCMS: Unauthenticated CSV import requests leave rejected uploads in the system temporary directoryapostrophecms · apostrophe | High7.5 |
| CVE-2026-113657 | ApostropheCMS sanitize-html: SMIL animation namespace-prefix bypass allows javascript: URI injection (XSS)apostrophecms · apostrophe | Low3.7 |
| CVE-2026-113656 | ApostropheCMS: Unauthenticated unbounded multipart upload → disk-exhaustion DoSapostrophecms · apostrophe | Medium5.3 |
| CVE-2026-113649 | ApostropheCMS: Import API bypasses publication roles for protected contentapostrophecms · apostrophe | Medium6.5 |
| CVE-2026-113655 | ApostropheCMS: Same-parent page reorder in @apostrophecms/page move() re-ranks a restricted parent's children without create authorizationapostrophecms · apostrophe | Medium4.3 |
| CVE-2026-113654 | ApostropheCMS sanitize-html: nonTextTags discard region ends early on an implied close, letting <noscript> content renderapostrophecms · apostrophe | Medium5.3 |
| CVE-2026-113653 | ApostropheCMS: The general public can access @apostrophecms/user objects via a relationship (viewRole is not applied to the general public)apostrophecms · apostrophe | Medium6.9 |
| CVE-2026-113652 | ApostropheCMS uploadfs Azure backend leaks account-level SAS token into every public attachment URL (sas: true)apostrophecms · apostrophe | Medium5.6 |
| CVE-2026-113651 | ApostropheCMS: Path traversal in uploadfsapostrophecms · apostrophe | Low3.3 |
| CVE-2026-113650 | ApostropheCMS sanitize-html: unbounded recursion when re-sanitizing the fallback of a discarded iframe (stack overflow, nestingLimit not enforced)apostrophecms · apostrophe | Medium5.3 |
| CVE-2026-113648 | ApostropheCMS: Missing Authentication in `cleanExport` Routeapostrophecms · apostrophe | Low3.1 |
| CVE-2026-112958 | ApostropheCMS: Stored XSS via Unescaped Widget Style Attribute Serializationapostrophecms · apostrophe | Medium5.4 |
| CVE-2026-112957 | ApostropheCMS: GET /api/v1/@apostrophecms/page/:id bypasses viewRole restriction and exposes viewPermission-gated fields to lower-privileged usersapostrophecms · apostrophe | Medium4.3 |
| CVE-2026-112956 | ApostropheCMS: Archive duplicate continuation lets contributors overwrite published contentapostrophecms · apostrophe | Medium6.5 |
| CVE-2026-112955 | ApostropheCMS: Import archives can exhaust server storage and deny serviceapostrophecms · apostrophe | Medium6.5 |
| CVE-2026-112954 | ApostropheCMS: Unauthenticated publicApiProjection bypass via search and sort query builders in the public REST APIapostrophecms · apostrophe | Medium5.3 |
| CVE-2026-112953 | ApostropheCMS: Exposure of Sensitive Information via predictable export filenamesapostrophecms · apostrophe | Medium6.0 |
| CVE-2026-112952 | ApostropheCMS: POST /api/v1/@apostrophecms/doc/slugTaken discloses existence of private/admin-only content to any authenticated userapostrophecms · apostrophe | Medium4.3 |
| CVE-2026-112951 | ApostropheCMS: Color field validation bypass allows stored XSS via HTML appended after rgb()/hsl() prefixapostrophecms · apostrophe | Medium5.4 |
| CVE-2026-110904 | ApostropheCMS before 4.33.0 allows authentication bypass for REST API page reading, as demonstrated by a /api/v1/@apostrophecms/page?all=1 call.apostrophecms · ApostropheCMS | Medium5.3 |
| CVE-2026-84371 | ApostropheCMS: Stored XSS via SVG SMIL URI-list scheme-policy bypassapostrophecms · apostrophe | Medium5.4 |
| CVE-2026-71553 | ApostropheCMS: 2nd-order prototype pollution via PATCH leading to single-request persistent DoSapostrophecms · apostrophe | High7.1 |
| CVE-2026-63667 | ApostropheCMS: Arbitrary file read via import-export attachment-name path traversalapostrophecms · apostrophe | Medium6.5 |
| CVE-2026-63670 | ApostropheCMS: Mutation-XSS / allowedTags bypass via literal `</textarea/>` solidus closeapostrophecms · apostrophe | Medium6.1 |
| CVE-2026-63669 | ApostropheCMS: Missing destination-parent authorization in page `move()` allows a low-privileged editor to move and re-rank pages inside a restricted subtreeapostrophecms · apostrophe | Medium6.5 |
| CVE-2026-53609 | Apostrophe has Server-Side Prototype Pollution in apos.util.set via patch operators that leads to process-wide authorization bypassapostrophecms · apostrophe | Critical9.1 |
| CVE-2026-53608 | @apostrophecms/seo Vulnerable to Stored XSS via Unsanitized Google Analytics / GTM ID Injected into Script Tagapostrophecms · @apostrophecms/seo | High8.7 |
| CVE-2026-53607 | @apostrophecms/file pretty-URL Vulnerable to Unauthenticated SSRF via Host headerapostrophecms · apostrophe | Low3.7 |
| CVE-2026-53606 | sanitize-html has an incomplete URI scheme validation that allows javascript: URIs through action, formaction, data, poster, and background attributesapostrophecms · sanitize-html | Medium5.4 |
| CVE-2026-45014 | Apostrophe Vulnerable to Stored Cross-Site Scripting via Unsanitized User Display Name in Draft Version Tooltipapostrophecms · apostrophe | Medium5.3 |
| CVE-2026-45013 | Apostrophe has a Weak Password Recovery Mechanism for Forgotten Password and Improper Input Validationapostrophecms · apostrophe | High8.1 |
| CVE-2026-45012 | Apostrophe has authenticated SSRF in rich-text widget import via @apostrophecms/area/validate-widgetapostrophecms · apostrophe | High7.6 |
| CVE-2026-45011 | Apostrophe has stored XSS via javascript: URL in Image Widget Linkapostrophecms · apostrophe | High7.3 |
| CVE-2026-44990 | Apostrophe has default XSS via `xmp` raw-text passthrough in `sanitize-html`apostrophecms · sanitize-html | Critical9.3 |
| CVE-2026-42853 | @apostrophecms/cli: Command Injection in apos create via Unsanitized Password Inputapostrophecms · @apostrophecms/cli | Medium6.5 |
| CVE-2026-40186 | ApostropheCMS: sanitize-html allowedTags Bypass via Entity-Decoded Text in nonTextTags Elementsapostrophecms · apostrophe | Medium6.1 |
| CVE-2026-39857 | Information Disclosure via `choices`/`counts` Query Parameters Bypassing publicApiProjection Field Restrictionsapostrophecms · apostrophe | Medium5.3 |