TI-2026-27673 CVE-2026-35569 · GHSA-855c-r2vq-c292
ApostropheCMS: Stored XSS in SEO Fields Leads to Authenticated API Data Exposure in ApostropheCMS
Priority HIGH 73
ApostropheCMS is an open-source Node.js content management system.
apostrophecms
Records66All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical4CVSS 9.0–10.0
CVSS high11CVSS 7.0–8.9
Exploited now
apostrophecms records in CISA KEVNo apostrophecms vulnerabilities are listed in CISA KEV.
Components
Products in the NVD configurations · select one to filter the recordsRecords
9 records in Apostrophecms · all components
TI-2026-25222 CVE-2026-32730 · GHSA-v9xm-ffx2-7h35
ApostropheCMS MFA/TOTP Bypass via Incorrect MongoDB Query in Bearer Token Middleware
Priority HIGH 70
ApostropheCMS is an open-source content management framework.
TI-2026-28738 CVE-2026-39857 · GHSA-c276-fj82-f2pq
Information Disclosure via `choices`/`counts` Query Parameters Bypassing publicApiProjection Field Restrictions
Priority MEDIUM 63
ApostropheCMS is an open-source Node.js content management system.
TI-2026-26246 CVE-2026-33888 · GHSA-xhq9-58fw-859p
ApostropheCMS: publicApiProjection Bypass via `project` Query Builder in Piece-Type REST API
Priority MEDIUM 63
ApostropheCMS is an open-source Node.js content management system.
TI-2026-29000 CVE-2026-40186 · GHSA-9mrh-v2v3-xpfm
ApostropheCMS: sanitize-html allowedTags Bypass via Entity-Decoded Text in nonTextTags Elements
Priority MEDIUM 60
ApostropheCMS is an open-source Node.js content management system.
TI-2026-26247 CVE-2026-33889 · GHSA-97v6-998m-fp4g
ApostropheCMS: Stored XSS via CSS Custom Property Injection in `@apostrophecms/color-field` Escaping Style Tag Context
Priority MEDIUM 58
ApostropheCMS is an open-source Node.js content management system.
TI-2026-26237 CVE-2026-33877 · GHSA-mj7r-x3h3-7rmr
ApostropheCMS: User Enumeration via Timing Side Channel in Password Reset Endpoint
Priority MEDIUM 51
ApostropheCMS is an open-source Node.js content management system.
TI-2021-07985 CVE-2021-25979 · GHSA-9j9m-8wjc-ff96
Apostrophe - Insufficient Session Expiration
Priority MEDIUM 51
Apostrophe CMS versions prior to 3.3.1 did not invalidate existing login sessions when disabling a user account or changing the password, creating a situation in which a device compromised by a third party could not be l…
TI-2021-07984 CVE-2021-25978 · GHSA-4r9c-jghc-cx5m
Apostrophe - XSS
Priority LOW 25
Apostrophe CMS versions between 2.63.0 to 3.3.1 are vulnerable to Stored XSS where an editor uploads an SVG file that contains malicious JavaScript onto the Images module, which triggers XSS once viewed.