apostrophe has 14 CVEs on record. Disclosure cadence is accelerating: 14 in the last 90 days against 0 in the 90 before. The busiest recent month was October 2026 with 10. The median CVSS is 5.4 (medium), with 1 rated critical. None have a confirmed exploitation report. The dominant weakness classes are CWE-862 (5) and CWE-1321 (3).
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 5.4
- Publish → KEV
- —
- Last 90 days
- 14 prev 0
Weakness classes
Products
- apostrophe 14
Worst active — by depth score
CVE-2026-113711High· 7.5ApostropheCMS: Unauthenticated resource exhaustion via pre-auth aposBigUpload processing in @apostrophecms/import-export53CVE-2026-53609Critical· 9.1Apostrophe has Server-Side Prototype Pollution in apos.util.set via patch operators that leads to process-wide authorization bypass50CVE-2026-112958Medium· 5.4ApostropheCMS: Stored XSS via Unescaped Widget Style Attribute Serialization42CVE-2026-112951Medium· 5.4ApostropheCMS: Color field validation bypass allows stored XSS via HTML appended after rgb()/hsl() prefix42CVE-2026-71553HighApostropheCMS: 2nd-order prototype pollution via PATCH leading to single-request persistent DoS41
apostrophe vulnerabilities
CVEs affecting apostrophe, newest first. Open any entry for full detail, references, and exploit status.
14 CVEsRSS
CVE-2026-113711High· 7.5PoCApostropheCMS: Unauthenticated resource exhaustion via pre-auth aposBigUpload processing in @apostrophecms/import-export
ApostropheCMS: Unauthenticated resource exhaustion via pre-auth aposBigUpload processing in @apostrophecms/import-export
CVE-2026-112957Medium· 4.3ApostropheCMS: GET /api/v1/@apostrophecms/page/:id bypasses viewRole restriction and exposes viewPermission-gated fields to lower-privileged users
ApostropheCMS: GET /api/v1/@apostrophecms/page/:id bypasses viewRole restriction and exposes viewPermission-gated fields to lower-privileged users
CVE-2026-112958Medium· 5.4PoCApostropheCMS: Stored XSS via Unescaped Widget Style Attribute Serialization
ApostropheCMS: Stored XSS via Unescaped Widget Style Attribute Serialization
CVE-2026-112951Medium· 5.4PoCApostropheCMS: Color field validation bypass allows stored XSS via HTML appended after rgb()/hsl() prefix
ApostropheCMS: Color field validation bypass allows stored XSS via HTML appended after rgb()/hsl() prefix
CVE-2026-112952Medium· 4.3ApostropheCMS: POST /api/v1/@apostrophecms/doc/slugTaken discloses existence of private/admin-only content to any authenticated user
ApostropheCMS: POST /api/v1/@apostrophecms/doc/slugTaken discloses existence of private/admin-only content to any authenticated user
CVE-2026-113659Medium· 6.1ApostropheCMS: Client-side Prototype Pollution in apos.http.parseQuery leading to DOM-based XSS against authenticated users
ApostropheCMS: Client-side Prototype Pollution in apos.http.parseQuery leading to DOM-based XSS against authenticated users
CVE-2026-113665Low· 3.7ApostropheCMS: Missing Authorization on Notification PATCH/DELETE Endpoints
ApostropheCMS: Missing Authorization on Notification PATCH/DELETE Endpoints
CVE-2026-113660Medium· 4.3PoCApostropheCMS: Authenticated Object-Level Authorization Bypass in exist-in-locale Reveals Restricted Localized Draft Identifiers
ApostropheCMS: Authenticated Object-Level Authorization Bypass in exist-in-locale Reveals Restricted Localized Draft Identifiers
CVE-2026-113655Medium· 4.3PoCApostropheCMS: Same-parent page reorder in @apostrophecms/page move() re-ranks a restricted parent's children without create authorization
ApostropheCMS: Same-parent page reorder in @apostrophecms/page move() re-ranks a restricted parent's children without create authorization
CVE-2026-113653Medium· 6.9ApostropheCMS: The general public can access @apostrophecms/user objects via a relationship (viewRole is not applied to the general public)
ApostropheCMS: The general public can access @apostrophecms/user objects via a relationship (viewRole is not applied to the general public)
CVE-2026-71553HighApostropheCMS: 2nd-order prototype pollution via PATCH leading to single-request persistent DoS
ApostropheCMS: 2nd-order prototype pollution via PATCH leading to single-request persistent DoS
CVE-2026-63669Medium· 6.5ApostropheCMS is an open-source Node.js content management system
ApostropheCMS is an open-source Node.js content management system. Prior to 4.32.0, the page module's move() operation fails to enforce the destination parent's _create permission because its oldParent archive condition disables the chec…
CVE-2026-53609Critical· 9.1Apostrophe has Server-Side Prototype Pollution in apos.util.set via patch operators that leads to process-wide authorization bypass
Apostrophe has Server-Side Prototype Pollution in apos.util.set via patch operators that leads to process-wide authorization bypass
CVE-2026-53607Low· 3.7@apostrophecms/file pretty-URL Vulnerable to Unauthenticated SSRF via Host header
@apostrophecms/file pretty-URL Vulnerable to Unauthenticated SSRF via Host header