apostrophecms apostrophe vulnerabilities
50 published CVEs name apostrophecms apostrophe among the affected products.
- 50Published CVEs50 of them scored
- 50Last 12 monthspublished in the last year
- 1Critical9 more rated high
- 0Known exploitedin CISA's KEV catalog
Newest CVEs
- CVE-2026-113711
ApostropheCMS: Unauthenticated resource exhaustion via pre-auth aposBigUpload processing in @apostrophecms/import-export
apostrophecms · apostrophe
High7.5 - CVE-2026-113710
ApostropheCMS: No Attempt Throttling on Authenticated Password-Change Endpoint Enables Unlimited Current-Password Guessing
apostrophecms · apostrophe
Medium5.9 - CVE-2026-113671
ApostropheCMS: Host header controls server-side image fetch origin in @apostrophecms/ai-helper, enabling authenticated SSRF
apostrophecms · apostrophe
Medium4.3 - CVE-2026-113669
ApostropheCMS: Cross-domain session token in URL confers session takeover
apostrophecms · apostrophe
Medium5.3 - CVE-2026-113667
ApostropheCMS: CAPTCHA response token not URL-encoded
apostrophecms · apostrophe
Medium5.3 - CVE-2026-113668
ApostropheCMS: :_id/locales REST route omits the public-API authorization gate its sibling read routes enforce (unauthenticated doc-existence + locale metadata disclosure)
apostrophecms · apostrophe
Medium5.3 - CVE-2026-113666
ApostropheCMS: Authenticated projection-exclusion prototype-member deletion in @apostrophecms/db-connect causes process-wide denial of service
apostrophecms · apostrophe
High7.1 - CVE-2026-113665
ApostropheCMS: Missing Authorization on Notification PATCH/DELETE Endpoints
apostrophecms · apostrophe
Low3.7 - CVE-2026-113664
ApostropheCMS import-export tar guard misses './..' because it is a literal '../' substring test
apostrophecms · apostrophe
Medium5.3 - CVE-2026-113662
ApostropheCMS import-export: NoSQL injection via update-key value lets a crafted import match and overwrite an unidentified document
apostrophecms · apostrophe
Medium5.4