apostrophecms Latest High & Critical Vulnerabilities

Latest High & Critical vulnerabilities published by apostrophecms

JSON RSS CSV 🔔 Create Alert Trigger

12 June 2026

Apostrophe has Server-Side Prototype Pollution in apos.util.set via patch operators that leads to process-wide authorization bypass
CVE-2026-53609
ApostrophecmsApostrophe9.1CRITICAL
@apostrophecms/seo Vulnerable to Stored XSS via Unsanitized Google Analytics / GTM ID Injected into Script Tag
CVE-2026-53608
Apostrophecms@apostrophecms/seo8.7HIGH
Apostrophe has a Weak Password Recovery Mechanism for Forgotten Password and Improper Input Validation
CVE-2026-45013
ApostrophecmsApostrophe8.1HIGH
Apostrophe has authenticated SSRF in rich-text widget import via @apostrophecms/area/validate-widget
CVE-2026-45012
ApostrophecmsApostrophe7.6HIGH
Apostrophe has stored XSS via javascript: URL in Image Widget Link
CVE-2026-45011
ApostrophecmsApostrophe7.3HIGH
Apostrophe has default XSS via `xmp` raw-text passthrough in `sanitize-html`
CVE-2026-44990
ApostrophecmsSanitize-html9.3CRITICAL

15 April 2026

Stored Cross-Site Scripting Vulnerability in ApostropheCMS by Apostrophe
CVE-2026-35569
ApostrophecmsApostrophe8.7HIGH

18 March 2026