apostrophecms vulnerabilities

Newest CVEs

• CVE-2026-113711

  ApostropheCMS: Unauthenticated resource exhaustion via pre-auth aposBigUpload processing in @apostrophecms/import-export

  apostrophecms · apostrophe

  High7.5
• CVE-2026-113710

  ApostropheCMS: No Attempt Throttling on Authenticated Password-Change Endpoint Enables Unlimited Current-Password Guessing

  apostrophecms · apostrophe

  Medium5.9
• CVE-2026-113671

  ApostropheCMS: Host header controls server-side image fetch origin in @apostrophecms/ai-helper, enabling authenticated SSRF

  apostrophecms · apostrophe

  Medium4.3
• CVE-2026-113669

  ApostropheCMS: Cross-domain session token in URL confers session takeover

  apostrophecms · apostrophe

  Medium5.3
• CVE-2026-113667

  ApostropheCMS: CAPTCHA response token not URL-encoded

  apostrophecms · apostrophe

  Medium5.3
• CVE-2026-113668

  ApostropheCMS: :_id/locales REST route omits the public-API authorization gate its sibling read routes enforce (unauthenticated doc-existence + locale metadata disclosure)

  apostrophecms · apostrophe

  Medium5.3
• CVE-2026-113666

  ApostropheCMS: Authenticated projection-exclusion prototype-member deletion in @apostrophecms/db-connect causes process-wide denial of service

  apostrophecms · apostrophe

  High7.1
• CVE-2026-113665

  ApostropheCMS: Missing Authorization on Notification PATCH/DELETE Endpoints

  apostrophecms · apostrophe

  Low3.7
• CVE-2026-113664

  ApostropheCMS import-export tar guard misses './..' because it is a literal '../' substring test

  apostrophecms · apostrophe

  Medium5.3
• CVE-2026-113662

  ApostropheCMS import-export: NoSQL injection via update-key value lets a crafted import match and overwrite an unidentified document

  apostrophecms · apostrophe

  Medium5.4