CVE-2026-84371ApostropheCMS: Stored XSS via SVG SMIL URI-list scheme-policy bypass Exploitation status Not known exploited Fix Affected product A apostrophe Published 09/01/2026 Severity Medium CVE-2026-71553ApostropheCMS: 2nd-order prototype pollution via PATCH leading to single-request persistent DoS Exploitation status Not known exploited Fix Not confirmed Affected product A apostrophe Published 08/17/2026 Severity High CVE-2026-63667ApostropheCMS: Arbitrary file read via import-export attachment-name path traversal Exploitation status Public exploit Fix Affected product A apostrophe Published 08/17/2026 Severity Medium CVE-2026-63670ApostropheCMS: Mutation-XSS / allowedTags bypass via literal `</textarea/>` solidus close Exploitation status Public exploit Fix Affected product A apostrophe Published 08/17/2026 Severity Medium CVE-2026-63669ApostropheCMS: Missing destination-parent authorization in page `move()` allows a low-privileged editor to move and re-rank pages inside a restricted subtree Exploitation status Not known exploited Fix Affected product A apostrophe Published 08/17/2026 Severity Medium CVE-2026-53609Apostrophe has Server-Side Prototype Pollution in apos.util.set via patch operators that leads to process-wide authorization bypass Exploitation status Public exploit Fix Not confirmed Affected product A apostrophe Published 06/12/2026 Severity Critical CVE-2026-53608@apostrophecms/seo Vulnerable to Stored XSS via Unsanitized Google Analytics / GTM ID Injected into Script Tag Exploitation status Public exploit Fix Not confirmed Affected product @ @apostrophecms/seo Published 06/12/2026 Severity High CVE-2026-53607@apostrophecms/file pretty-URL Vulnerable to Unauthenticated SSRF via Host header Exploitation status Public exploit Fix Not confirmed Affected product A apostrophe Published 06/12/2026 Severity Low CVE-2026-53606sanitize-html has an incomplete URI scheme validation that allows javascript: URIs through action, formaction, data, poster, and background attributes Exploitation status Public exploit Fix Not confirmed Affected product S sanitize-html Published 06/12/2026 Severity Medium CVE-2026-45014Apostrophe Vulnerable to Stored Cross-Site Scripting via Unsanitized User Display Name in Draft Version Tooltip Exploitation status Not known exploited Fix Not confirmed Affected product A apostrophe Published 06/12/2026 Severity Medium CVE-2026-45013Apostrophe has a Weak Password Recovery Mechanism for Forgotten Password and Improper Input Validation Exploitation status Public exploit Fix Not confirmed Affected product A apostrophe Published 06/12/2026 Severity High CVE-2026-45012Apostrophe has authenticated SSRF in rich-text widget import via @apostrophecms/area/validate-widget Exploitation status Public exploit Fix Not confirmed Affected product A apostrophe Published 06/12/2026 Severity High CVE-2026-45011Apostrophe has stored XSS via javascript: URL in Image Widget Link Exploitation status Public exploit Fix Not confirmed Affected product A apostrophe Published 06/12/2026 Severity High CVE-2026-44990Apostrophe has default XSS via `xmp` raw-text passthrough in `sanitize-html` Exploitation status Public exploit Fix Not confirmed Affected product S sanitize-html Published 06/12/2026 Severity Critical CVE-2026-42853@apostrophecms/cli: Command Injection in apos create via Unsanitized Password Input Exploitation status Public exploit Fix Not confirmed Affected product @ @apostrophecms/cli Published 06/12/2026 Severity Medium CVE-2026-40186ApostropheCMS: sanitize-html allowedTags Bypass via Entity-Decoded Text in nonTextTags Elements Exploitation status Public exploit Fix Affected product A apostrophe Published 04/15/2026 Severity Medium CVE-2026-39857Information Disclosure via `choices`/`counts` Query Parameters Bypassing publicApiProjection Field Restrictions Exploitation status Public exploit Fix Affected product A apostrophe Published 04/15/2026 Severity Medium CVE-2026-35569ApostropheCMS: Stored XSS in SEO Fields Leads to Authenticated API Data Exposure in ApostropheCMS Exploitation status Public exploit Fix Affected product A apostrophe Published 04/15/2026 Severity High CVE-2026-33889ApostropheCMS: Stored XSS via CSS Custom Property Injection in `@apostrophecms/color-field` Escaping Style Tag Context Exploitation status Public exploit Fix Affected product A apostrophe Published 04/15/2026 Severity Medium CVE-2026-33888ApostropheCMS: publicApiProjection Bypass via `project` Query Builder in Piece-Type REST API Exploitation status Public exploit Fix Affected product A apostrophe Published 04/15/2026 Severity Medium CVE-2026-33877ApostropheCMS: User Enumeration via Timing Side Channel in Password Reset Endpoint Exploitation status Public exploit Fix Affected product A apostrophe Published 04/15/2026 Severity Low CVE-2026-32731ApostropheCMS has Arbitrary File Write (Zip Slip / Path Traversal) in Import-Export Gzip Extraction Exploitation status Public exploit Fix Not confirmed Affected product I import-export Published 03/18/2026 Severity Critical CVE-2026-32730ApostropheCMS MFA/TOTP Bypass via Incorrect MongoDB Query in Bearer Token Middleware Exploitation status Public exploit Fix Not confirmed Affected product A apostrophe Published 03/18/2026 Severity High CVE-2014-125128Exploitation status Public exploit Fix Affected product S sanitize-html Published 09/08/2025 Severity Medium CVE-2019-25225Exploitation status Public exploit Fix Affected product S sanitize-html Published 09/08/2025 Severity Medium CVE-2024-21501Exploitation status Public exploit Fix Affected product S sanitize-html Published 02/24/2024 Severity Medium CVE-2022-25887Regular Expression Denial of Service (ReDoS) Exploitation status Not confirmed Fix Affected product S sanitize-html Published 08/30/2022 Severity Medium CVE-2021-25979Apostrophe - Insufficient Session Expiration Exploitation status Not known exploited Fix Affected product A Apostrophe Published 11/08/2021 Severity Critical CVE-2021-25978Apostrophe - XSS Exploitation status Not known exploited Fix Affected product A Apostrophe Published 11/07/2021 Severity Medium CVE-2021-26540Exploitation status Not confirmed Fix Not confirmed Affected product Not confirmed Published 02/08/2021 Severity Unknown CVE-2021-26539Exploitation status Not confirmed Fix Not confirmed Affected product Not confirmed Published 02/08/2021 Severity Unknown CVE-2016-1000237Exploitation status Not confirmed Fix Not confirmed Affected product Not confirmed Published 01/23/2020 Severity Unknown 
