Security releases
Researcher credits in vendor advisories
Vendors name researchers in their own advisories. Find your line and claim it. It counts on your profile right away and gets a BugRater ID you can quote.
Vendor
-
Apostrophecms CVE-2026-113711
ApostropheCMS is an open-source Node.js content management system. Prior to 4.33.0 of ApostropheCMS and 3.7.0 of the import-export module, import routes invoke
0 CVEs and 0 credit lines.
-
Apostrophecms CVE-2026-113710
ApostropheCMS is an open-source Node.js content management system. Prior to 4.33.0, the self-service password-change endpoint verifies the current password but
0 CVEs and 0 credit lines.
-
Apostrophecms CVE-2026-113671
ApostropheCMS is an open-source Node.js content management system. From 1.0.0-beta.10 until 1.0.0-beta.13 of the AI helper, an editor with image-generation capa
0 CVEs and 0 credit lines.
-
Apostrophecms CVE-2026-113670
ApostropheCMS is an open-source Node.js content management system. Prior to 4.33.0, the core page REST API reads full page documents with .permission(false) in
0 CVEs and 0 credit lines.
-
Apostrophecms CVE-2026-113669
ApostropheCMS is an open-source Node.js content management system. Prior to 4.33.0 of ApostropheCMS and 1.6.1 of passport-bridge, cross-host or cross-locale ses
0 CVEs and 0 credit lines.
-
Apostrophecms CVE-2026-113668
ApostropheCMS is an open-source Node.js content management system. Prior to 4.33.0, the REST route GET /api/v1/<piece-type>/:_id/locales (and the equivalent pag
0 CVEs and 0 credit lines.
-
Apostrophecms CVE-2026-113667
ApostropheCMS is an open-source Node.js content management system. Prior to 1.5.5 of the Form add-on, 1.2.1 of login-recaptcha, and 1.3.0 of login-hcaptcha, the
0 CVEs and 0 credit lines.
-
Apostrophecms CVE-2026-113666
ApostropheCMS is an open-source Node.js content management system. Prior to 1.1.0 of db-connect and 4.33.0 of ApostropheCMS, an account with view-draft access c
0 CVEs and 0 credit lines.
-
Apostrophecms CVE-2026-113665
ApostropheCMS is an open-source Node.js content management system. Prior to 4.33.0, the notification module exposes PATCH and DELETE REST endpoints that perform
0 CVEs and 0 credit lines.
-
Apostrophecms CVE-2026-113664
ApostropheCMS is an open-source Node.js content management system. Prior to 3.7.0 of the import-export module, an authenticated importer can submit a tar entry
0 CVEs and 0 credit lines.
-
Apostrophecms CVE-2026-113662
ApostropheCMS is an open-source Node.js content management system. Prior to 3.7.0 of the import-export module, an authenticated user with import access to a tar
0 CVEs and 0 credit lines.
-
Apostrophecms CVE-2026-113661
ApostropheCMS is an open-source Node.js content management system, and sanitize-html provides a simple HTML sanitizer with a clear API. Prior to sanitize-html 2
0 CVEs and 0 credit lines.
-
Apostrophecms CVE-2026-113660
ApostropheCMS is an open-source Node.js content management system. Prior to 4.33.0, ApostropheCMS’s exist-in-locale API allows an authenticated low-privilege us
0 CVEs and 0 credit lines.
-
Apostrophecms CVE-2026-113659
ApostropheCMS is an open-source Node.js content management system. Prior to 4.33.0, an unauthenticated attacker can send a crafted link whose query string is au
0 CVEs and 0 credit lines.
-
Apostrophecms CVE-2026-113658
ApostropheCMS is an open-source Node.js content management system. Prior to 4.33.0, the unauthenticated Rich Text CSV conversion route writes a multipart upload
0 CVEs and 0 credit lines.
-
Apostrophecms CVE-2026-113657
ApostropheCMS is an open-source Node.js content management system, and sanitize-html provides a simple HTML sanitizer with a clear API. From sanitize-html 2.17.
0 CVEs and 0 credit lines.
-
Apostrophecms CVE-2026-113656
ApostropheCMS is an open-source Node.js content management system. Prior to 1.5.5 of the ApostropheCMS Form add-on, its form submission route stages unbounded m
0 CVEs and 0 credit lines.
-
Apostrophecms CVE-2026-113655
ApostropheCMS is an open-source Node.js content management system. Prior to 4.33.0, an authenticated editor with legitimate edit rights on a pre-existing ordina
0 CVEs and 0 credit lines.
-
Apostrophecms CVE-2026-113654
ApostropheCMS is an open-source Node.js content management system, and sanitize-html provides a simple HTML sanitizer with a clear API. Prior to sanitize-html 2
0 CVEs and 0 credit lines.
-
Apostrophecms CVE-2026-113653
ApostropheCMS is an open-source Node.js content management system. Prior to 4.33.0, viewRole is not applied to anonymous visitors when a developer exposes user
0 CVEs and 0 credit lines.
-
Apostrophecms CVE-2026-113652
ApostropheCMS is an open-source Node.js content management system. From 1.25.0 until 1.28.0, uploadfs Azure backend leaks account-level SAS token into every pub
0 CVEs and 0 credit lines.
-
Apostrophecms CVE-2026-113651
ApostropheCMS is an open-source Node.js content management system, and uploadfs is its file storage library. Prior to uploadfs 1.28.0, attacker-controlled paths
0 CVEs and 0 credit lines.
-
Apostrophecms CVE-2026-113650
ApostropheCMS is an open-source Node.js content management system. In sanitize-html 2.18.0, when an <iframe> is not allowed and disallowedTagsMode is 'discard'
0 CVEs and 0 credit lines.
-
Apostrophecms CVE-2026-113649
ApostropheCMS is an open-source Node.js content management system. Prior to 3.7.1 of the import-export module and 4.34.0 of core ApostropheCMS, an editor who ca
0 CVEs and 0 credit lines.
-
Apostrophecms CVE-2026-113648
ApostropheCMS is an open-source Node.js content management system. Prior to 3.7.1 of the import-export module, the API endpoint POST /api/v1/@apostrophecms/impo
0 CVEs and 0 credit lines.
-
Apostrophecms CVE-2026-112958
ApostropheCMS is an open-source Node.js content management system. Prior to 4.34.0, a project-defined free-form widget style field can carry an editor-controlle
0 CVEs and 0 credit lines.
-
Apostrophecms CVE-2026-112957
ApostropheCMS is an open-source Node.js content management system. Prior to 4.34.0, the getOne REST endpoint for pages does not apply viewRole type-level restri
0 CVEs and 0 credit lines.
-
Apostrophecms CVE-2026-112956
ApostropheCMS is an open-source Node.js content management system. Prior to 3.7.1 of the import-export module, duplicate-import continuation accepts client-cont
0 CVEs and 0 credit lines.
-
Apostrophecms CVE-2026-112955
ApostropheCMS is an open-source Node.js content management system. Prior to 3.7.1 of the import-export module, an authenticated importer can submit archives who
0 CVEs and 0 credit lines.
-
Apostrophecms CVE-2026-112954
ApostropheCMS is an open-source Node.js content management system. Prior to 4.34.0, a public REST API type that uses publicApiProjection can expose excluded sea
0 CVEs and 0 credit lines.
-
Apostrophecms CVE-2026-112953
ApostropheCMS is an open-source Node.js content management system. Prior to 3.7.1 of the import-export module, predictable export archive filenames allow an una
0 CVEs and 0 credit lines.
-
Apostrophecms CVE-2026-112952
ApostropheCMS is an open-source Node.js content management system. Prior to 4.34.0, 'POST /api/v1/@apostrophecms/doc/slugTaken' with body { "slug": "target-slug
0 CVEs and 0 credit lines.
-
Apostrophecms CVE-2026-112951
ApostropheCMS is an open-source Node.js content management system. Prior to 4.34.0, the color field accepts trailing content after a valid rgb() or hsl() prefix
0 CVEs and 0 credit lines.
-
Apostrophecms apostrophecms-2026-10
Apostrophecms Security Releases - October 2026
0 CVEs and 0 credit lines.