Tagged “npm”
CVEs tagged npm, newest first.
1554 CVEsRSS
CVE-2026-113666High· 7.1PoCApostropheCMS: Authenticated projection-exclusion prototype-member deletion in @apostrophecms/db-connect causes process-wide denial of service
ApostropheCMS: Authenticated projection-exclusion prototype-member deletion in @apostrophecms/db-connect causes process-wide denial of service
CVE-2026-111756High· 7.5PoCfollow-redirects: follow-redirects: Information disclosure via array-formatted headers during cross-origin redirects (CVE-2026-111756)
A flaw was found in follow-redirects. When an application provides request headers in an array format, the library fails to remove sensitive credential headers before following a redirect to another host or an insecure protocol. A remote, …
CVE-2026-113669Medium· 5.3PoCApostropheCMS: Cross-domain session token in URL confers session takeover
ApostropheCMS is an open-source Node.js content management system. Prior to 4.33.0 of ApostropheCMS and 1.6.1 of passport-bridge, cross-host or cross-locale session migration places a single-use bearer session token in a redirect URL. A …
CVE-2026-113667Medium· 5.3ApostropheCMS: CAPTCHA response token not URL-encoded
ApostropheCMS is an open-source Node.js content management system. Prior to 1.5.5 of the Form add-on, 1.2.1 of login-recaptcha, and 1.3.0 of login-hcaptcha, these three CAPTCHA integrations interpolate an unencoded user-supplied response…
CVE-2026-113671Medium· 4.3PoCApostropheCMS: Host header controls server-side image fetch origin in @apostrophecms/ai-helper, enabling authenticated SSRF
ApostropheCMS is an open-source Node.js content management system. From 1.0.0-beta.10 until 1.0.0-beta.13 of the AI helper, an editor with image-generation capability can create a base64-generated image record without a stored provider U…
CVE-2026-113670Medium· 5.3ApostropheCMS: Page REST API authorization bypass
ApostropheCMS is an open-source Node.js content management system. Prior to 4.33.0, the core page REST API reads full page documents with .permission(false) in getOne and in the all=1 tree dump, bypassing page-type viewRole, visibility: …
CVE-2026-113648Low· 3.1ApostropheCMS: Missing Authentication in `cleanExport` Route
ApostropheCMS is an open-source Node.js content management system. Prior to 3.7.1 of the import-export module, the API endpoint POST /api/v1/@apostrophecms/import-export/clean-export in @apostrophecms/import-export lacks authentication a…
CVE-2026-113651Low· 3.3PoCApostropheCMS: Path traversal in uploadfs
ApostropheCMS: Path traversal in uploadfs
CVE-2026-113652Medium· 5.6ApostropheCMS uploadfs Azure backend leaks account-level SAS token into every public attachment URL (sas: true)
ApostropheCMS is an open-source Node.js content management system. From 1.25.0 until 1.28.0, uploadfs Azure backend leaks account-level SAS token into every public attachment URL. When uploadfs is configured with the Azure backend and sa…
CVE-2026-113655Medium· 4.3PoCApostropheCMS: Same-parent page reorder in @apostrophecms/page move() re-ranks a restricted parent's children without create authorization
ApostropheCMS: Same-parent page reorder in @apostrophecms/page move() re-ranks a restricted parent's children without create authorization
CVE-2026-113654Medium· 5.3ApostropheCMS sanitize-html: nonTextTags discard region ends early on an implied close, letting <noscript> content render
ApostropheCMS sanitize-html: nonTextTags discard region ends early on an implied close, letting <noscript> content render
CVE-2026-113649Medium· 6.5ApostropheCMS: Import API bypasses publication roles for protected content
ApostropheCMS is an open-source Node.js content management system. Prior to 3.7.1 of the import-export module and 4.34.0 of core ApostropheCMS, an editor who can import an enabled content type but lacks its stronger publication role can …
CVE-2026-113657Low· 3.7PoCApostropheCMS sanitize-html: SMIL animation namespace-prefix bypass allows javascript: URI injection (XSS)
ApostropheCMS sanitize-html: SMIL animation namespace-prefix bypass allows javascript: URI injection (XSS)
CVE-2026-113656Medium· 5.3ApostropheCMS: Unauthenticated unbounded multipart upload → disk-exhaustion DoS
ApostropheCMS is an open-source Node.js content management system. Prior to 1.5.5 of the ApostropheCMS Form add-on, its form submission route stages unbounded multipart uploads before form validation or authentication and lacks upload si…
CVE-2026-113658High· 7.5PoCApostropheCMS: Unauthenticated CSV import requests leave rejected uploads in the system temporary directory
ApostropheCMS is an open-source Node.js content management system. Prior to 4.33.0, the unauthenticated Rich Text CSV conversion route writes a multipart upload to the system temporary directory before checking its extension and does not…
CVE-2026-113653Medium· 6.9ApostropheCMS: The general public can access @apostrophecms/user objects via a relationship (viewRole is not applied to the general public)
ApostropheCMS: The general public can access @apostrophecms/user objects via a relationship (viewRole is not applied to the general public)
CVE-2026-112949Medium· 4.7PoCVitest: Code injection via unauthenticated manual mock registration
Vitest is a Vite-native testing framework for JavaScript and TypeScript projects. From 2.1.0-beta.7 until 4.1.12 and 5.0.3, an unauthenticated non-browser WebSocket client that can reach a development server using interceptorPlugin can r…
CVE-2026-112954Medium· 5.3PoCApostropheCMS: Unauthenticated publicApiProjection bypass via search and sort query builders in the public REST API
ApostropheCMS is an open-source Node.js content management system. Prior to 4.34.0, a public REST API type that uses publicApiProjection can expose excluded searchable or sortable field information through search membership and sort orde…
CVE-2026-112955Medium· 6.5ApostropheCMS: Import archives can exhaust server storage and deny service
ApostropheCMS is an open-source Node.js content management system. Prior to 3.7.1 of the import-export module, an authenticated importer can submit archives whose decompressed bytes, entry count, and entry sizes are not bounded before do…
CVE-2026-112942High· 7.5launch-editor: `fs.existsSync()` existence check can be bypassed on Windows
launch-editor allows users to open files with line numbers in editor from Node.js. Prior to 2.14.2, launch-editor-middleware processes an attacker-controlled Windows file argument where the file argument ends in a parent-directory compon…
CVE-2026-112943Medium· 6.3launch-editor: escapeCmdArgs() omits % escaping on Windows
launch-editor: escapeCmdArgs() omits % escaping on Windows
CVE-2026-112944Medium· 6.3launch-editor: Editor CLI flag misinterpretation causing arbitrary command execution for some editors
launch-editor: Editor CLI flag misinterpretation causing arbitrary command execution for some editors
CVE-2026-111754Medium@angular/platform-server: Open Redirect via Protocol-Relative URLs in Server-Side Rendering (SSR)
@angular/platform-server: Open Redirect via Protocol-Relative URLs in Server-Side Rendering (SSR)
CVE-2026-111752High@angular/router: Denial of Service via Unmatched Empty-Path Outlet Route Matching in Server-Side Rendering (SSR)
@angular/router: Denial of Service via Unmatched Empty-Path Outlet Route Matching in Server-Side Rendering (SSR)
CVE-2026-111759High· 7.5PoCmarkdown-it: Quadratic complexity in smartquotes with unmatched closing quotes
markdown-it: Quadratic complexity in smartquotes with unmatched closing quotes
CVE-2026-111766Low· 3.7markdown-it: Quadratic-time denial of service in inline HTML parsing with html enabled
markdown-it is a Markdown parser. Prior to 14.3.3 and 15.0.3, when the html option or commonmark preset is enabled and the constructs occur inside a paragraph, attacker-controlled Markdown containing repeated unterminated inline HTML com…
CVE-2026-111757Medium· 5.3hono: hono: Information disclosure via malformed percent-encoded paths in serveStatic (CVE-2026-111757)
A flaw was found in Hono's serveStatic middleware. This vulnerability allows a remote attacker to cause unauthorized information disclosure by bypassing path-based access controls. Because serveStatic decodes request paths a second time be…
CVE-2026-111755Medium· 5.9PoC⚖ disputedfollow-redirects: follow-redirects: Information disclosure via improper regular expression escaping in sensitive header filtering (CVE-2026…
A flaw was found in follow-redirects. This vulnerability allows an untrusted remote server to receive sensitive credential headers due to improper handling of cross-origin redirects. When an application specifies sensitive headers containi…
GHSA-p3hm-x653-5rc6MediumDuplicate Advisory: ip-address: Address6 matches a zone identifier in quadratic time ahead of its length limit, allowing a single long string to stall the process
Duplicate Advisory: ip-address: Address6 matches a zone identifier in quadratic time ahead of its length limit, allowing a single long string to stall the process
CVE-2026-76894Low· 3.1ckan-mcp-server: DataStore Table UI resource does not validate postMessage origin (in) and posts to targetOrigin "*" (out)
ckan-mcp-server: DataStore Table UI resource does not validate postMessage origin (in) and posts to targetOrigin "*" (out)