Vulnerabilities

TI-2026-76992 CVE-2026-113711 · GHSA-86wm-68pq-5jwq

Unauthenticated resource exhaustion via ApostropheCMS import routes

HIGH 72

ApostropheCMS is an open-source Node.js content management system.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00561 Published 2026-10-20 Fixed in 4.33.0, 3.7.0 CWE-400

TI-2026-76991 CVE-2026-113710 · GHSA-653j-g8j7-gh54

Missing throttling in ApostropheCMS password change endpoint

LOW 28

ApostropheCMS is an open-source Node.js content management system.

CVSS 3.1MEDIUM 5.9 Network High privileges No interaction EPSS 0.0033 Published 2026-10-20 Fixed in 4.33.0 CWE-307

TI-2026-76989 CVE-2026-113671 · GHSA-527g-ff96-x6wj

Server-side request forgery in ApostropheCMS AI helper image fetch

MEDIUM 53

ApostropheCMS is an open-source Node.js content management system.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00329 Published 2026-10-20 Fixed in 4.33.0, 1.0.0-beta.13 CWE-918

TI-2026-76988 CVE-2026-113670 · GHSA-2j32-q6rx-h844

ApostropheCMS page REST API exposes private page content

LOW 24

ApostropheCMS is an open-source Node.js content management system.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00327 Published 2026-10-20 Fixed in 4.33.0 CWE-863

TI-2026-76987 CVE-2026-113669 · GHSA-hhvr-8m24-qqr3

Cross-domain session token in URL enables session takeover

MEDIUM 57

ApostropheCMS is an open-source Node.js content management system.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00416 Published 2026-10-20 Fixed in 4.33.0, 1.6.1 CWE-598

TI-2026-76985 CVE-2026-113667 · GHSA-44qr-rrjg-2cqq

ApostropheCMS CAPTCHA response token not URL-encoded

LOW 24

ApostropheCMS is an open-source Node.js content management system.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00366 Published 2026-10-20 Fixed in 4.33.0, 1.5.5 +2 CWE-116

TI-2026-76986 CVE-2026-113668 · GHSA-gqh3-7856-rjjg

Missing authorization in ApostropheCMS locales REST route

LOW 30

ApostropheCMS is an open-source Node.js content management system.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00322 Published 2026-10-20 Fixed in 4.33.0 CWE-200

TI-2026-76981 CVE-2026-113666 · GHSA-j5rq-xfvr-p969

Prototype pollution in ApostropheCMS db-connect causes service outage

MEDIUM 64

ApostropheCMS is an open-source Node.js content management system.

CVSS 3.1HIGH 7.1 Network Low privileges No interaction EPSS 0.00444 Published 2026-10-20 Fixed in 4.33.0, 1.1.0 CWE-1321

TI-2026-76980 CVE-2026-113665 · GHSA-vwwx-px9w-crrc

Missing authorization in ApostropheCMS notification endpoints

MEDIUM 51

ApostropheCMS is an open-source Node.js content management system.

CVSS 3.1LOW 3.7 Network No auth No interaction EPSS 0.00349 Published 2026-10-20 Fixed in 4.33.0 CWE-639

TI-2026-76979 CVE-2026-113664 · GHSA-97wv-p4xx-c7mg

ApostropheCMS import-export tar check bypass can crash Node.js

MEDIUM 59

ApostropheCMS is an open-source Node.js content management system.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00485 Published 2026-10-20 Fixed in 4.33.0, 3.7.0 CWE-22

TI-2026-76978 CVE-2026-113662 · GHSA-jqw5-w6h3-44g6

NoSQL injection in ApostropheCMS import-export overwrites documents

LOW 24

ApostropheCMS is an open-source Node.js content management system.

CVSS 3.1MEDIUM 5.4 Network Low privileges No interaction EPSS 0.003 Published 2026-10-20 Fixed in 4.33.0, 3.7.0 CWE-284

TI-2026-76977 CVE-2026-113661 · GHSA-cv27-6wvh-8x7j

Unsafe URLs survive in meta refresh content in ApostropheCMS

LOW 24

ApostropheCMS is an open-source Node.js content management system, and sanitize-html provides a simple HTML sanitizer with a clear API.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00263 Published 2026-10-20 Partial fix · 4.33.0, 2.18.0 CWE-79

TI-2026-76976 CVE-2026-113660 · GHSA-vmxh-77cw-65j7

Authorization bypass in ApostropheCMS reveals restricted document IDs

MEDIUM 53

ApostropheCMS is an open-source Node.js content management system.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00363 Published 2026-10-20 Fixed in 4.33.0 CWE-862

TI-2026-76975 CVE-2026-113659 · GHSA-m2m5-rw3w-cwmj

Prototype pollution in ApostropheCMS query parsing enables XSS

LOW 27

ApostropheCMS is an open-source Node.js content management system.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00345 Published 2026-10-20 Fixed in 4.33.0 CWE-1321

TI-2026-76974 CVE-2026-113658 · GHSA-qhcq-9pm2-c9w9

ApostropheCMS leaves rejected CSV uploads in temporary directory

HIGH 72

ApostropheCMS is an open-source Node.js content management system.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00615 Published 2026-10-20 Fixed in 4.33.0 CWE-400

TI-2026-76973 CVE-2026-113657 · GHSA-374f-7chj-9948

Namespace prefix bypass in sanitize-html enables XSS via SVG links

MEDIUM 51

ApostropheCMS is an open-source Node.js content management system, and sanitize-html provides a simple HTML sanitizer with a clear API.

CVSS 3.1LOW 3.7 Network Low privileges User interaction EPSS 0.00313 Published 2026-10-20 Partial fix · 4.33.0, 2.18.0 CWE-79

TI-2026-76972 CVE-2026-113656 · GHSA-89mh-mm8c-mv7f

Unbounded unauthenticated uploads in ApostropheCMS Form exhaust disk

LOW 30

ApostropheCMS is an open-source Node.js content management system.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00462 Published 2026-10-20 Fixed in 4.33.0, 1.5.5 CWE-770

TI-2026-76961 CVE-2026-113649 · GHSA-5m22-7pfq-vp65

ApostropheCMS import API skips publish checks for protected content

LOW 29

ApostropheCMS is an open-source Node.js content management system.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00298 Published 2026-10-20 Fixed in 4.34.0, 3.7.1 CWE-862

TI-2026-76967 CVE-2026-113655 · GHSA-2jrp-qc93-h2j8

Authorization bypass in ApostropheCMS page reordering

MEDIUM 53

ApostropheCMS is an open-source Node.js content management system.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00323 Published 2026-10-20 Fixed in 4.33.0 CWE-639

TI-2026-76966 CVE-2026-113654 · GHSA-x3q4-9hxx-gx8m

Improper sanitization in sanitize-html lets noscript content render

MEDIUM 57

ApostropheCMS is an open-source Node.js content management system, and sanitize-html provides a simple HTML sanitizer with a clear API.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00432 Published 2026-10-20 Partial fix · 4.33.0, 2.18.0 CWE-79

TI-2026-76965 CVE-2026-113653 · GHSA-xf6w-q65w-4f2w

ApostropheCMS exposes user objects to anonymous visitors

LOW 37

ApostropheCMS is an open-source Node.js content management system.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00387 Published 2026-10-20 Fixed in 4.33.0 CWE-863

TI-2026-76964 CVE-2026-113652 · GHSA-hhph-8536-gfq5

ApostropheCMS uploadfs leaks Azure SAS token in public attachment URLs

LOW 25

ApostropheCMS is an open-source Node.js content management system.

CVSS 3.1MEDIUM 5.6 Network No auth No interaction EPSS 0.00277 Published 2026-10-20 Fixed in 4.33.0, 1.28.0 CWE-200

TI-2026-76963 CVE-2026-113651 · GHSA-gmfx-5g6x-rr72

Path traversal in ApostropheCMS uploadfs exposes host files

MEDIUM 49

ApostropheCMS is an open-source Node.js content management system, and uploadfs is its file storage library.

CVSS 3.1LOW 3.3 Network High privileges No interaction EPSS 0.00328 Published 2026-10-20 Fixed in 4.33.0, 1.28.0 CWE-22

TI-2026-76962 CVE-2026-113650 · GHSA-c9rx-x947-fp3h

Uncontrolled recursion in sanitize-html discarded iframe handling

MEDIUM 63

ApostropheCMS is an open-source Node.js content management system.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.0048 Published 2026-10-20 Partial fix · 4.34.0, 2.18.1 CWE-674

TI-2026-76960 CVE-2026-113648 · GHSA-rw26-wwfc-9wvm

Missing authentication in ApostropheCMS import-export cleanExport

LOW 15

ApostropheCMS is an open-source Node.js content management system.

CVSS 3.1LOW 3.1 Network Low privileges No interaction EPSS 0.00328 Published 2026-10-20 Fixed in 4.34.0, 3.7.1 CWE-306

Vulnerabilities

Filters