Security Advisories

medium2026-10-20

ApostropheCMS: Client-side Prototype Pollution in apos.http.parseQuery leading to DOM-based XSS against authenticated users

apostrophecms/apostrophe · GHSA-m2m5-rw3w-cwmj · CVE-2026-113659

medium2026-10-20

ApostropheCMS: No Attempt Throttling on Authenticated Password-Change Endpoint Enables Unlimited Current-Password Guessing

apostrophecms/apostrophe · GHSA-653j-g8j7-gh54 · CVE-2026-113710

medium2026-10-20

ApostropheCMS: Incomplete CVE-2026-53606: `meta http-equiv=refresh` `content` still ships `javascript:` / `data:` URLs

apostrophecms/apostrophe · GHSA-cv27-6wvh-8x7j · CVE-2026-113661

medium2026-10-20

ApostropheCMS: :_id/locales REST route omits the public-API authorization gate its sibling read routes enforce (unauthenticated doc-existence + locale metadata disclosure)

apostrophecms/apostrophe · GHSA-gqh3-7856-rjjg · CVE-2026-113668

medium2026-10-20

ApostropheCMS: Page REST API authorization bypass

apostrophecms/apostrophe · GHSA-2j32-q6rx-h844 · CVE-2026-113670

medium2026-10-20

ApostropheCMS: Host header controls server-side image fetch origin in @apostrophecms/ai-helper, enabling authenticated SSRF

apostrophecms/apostrophe · GHSA-527g-ff96-x6wj · CVE-2026-113671

high2026-10-20

ApostropheCMS: Unauthenticated CSV import requests leave rejected uploads in the system temporary directory

apostrophecms/apostrophe · GHSA-qhcq-9pm2-c9w9 · CVE-2026-113658

medium2026-10-20

ApostropheCMS: Cross-domain session token in URL confers session takeover

apostrophecms/apostrophe · GHSA-hhvr-8m24-qqr3 · CVE-2026-113669

medium2026-10-20

ApostropheCMS: Unauthenticated unbounded multipart upload → disk-exhaustion DoS

apostrophecms/apostrophe · GHSA-89mh-mm8c-mv7f · CVE-2026-113656

medium2026-10-20

ApostropheCMS: CAPTCHA response token not URL-encoded

apostrophecms/apostrophe · GHSA-44qr-rrjg-2cqq · CVE-2026-113667

medium2026-10-20

ApostropheCMS: Same-parent page reorder in @apostrophecms/page move() re-ranks a restricted parent's children without create authorization

apostrophecms/apostrophe · GHSA-2jrp-qc93-h2j8 · CVE-2026-113655

high2026-10-20

ApostropheCMS: Authenticated projection-exclusion prototype-member deletion in @apostrophecms/db-connect causes process-wide denial of service

apostrophecms/apostrophe · GHSA-j5rq-xfvr-p969 · CVE-2026-113666

medium2026-10-20

ApostropheCMS sanitize-html: nonTextTags discard region ends early on an implied close, letting <noscript> content render

apostrophecms/apostrophe · GHSA-x3q4-9hxx-gx8m · CVE-2026-113654

high2026-10-20

follow-redirects array-form headers bypass cross-origin credential stripping

follow-redirects/follow-redirects · GHSA-q3jh-wrc6-jgq8 · CVE-2026-111756

high2026-10-20

follow-redirects sensitiveHeaders regex escaping can expose credential headers

follow-redirects/follow-redirects · GHSA-8r9p-f939-6h3c · CVE-2026-111755

high2026-10-20

@angular/router: Denial of Service via RouterLink Query Parameter Retention in Server-Side Rendering (SSR)

angular/angular · GHSA-57xq-rjx2-v5xh · CVE-2026-111751

high2026-10-20

@angular/router: Denial of Service via Unmatched Empty-Path Outlet Route Matching in Server-Side Rendering (SSR)

angular/angular · GHSA-62vg-58rm-qff7 · CVE-2026-111752

medium2026-10-20

Hono: `serveStatic` decodes the request path a second time, leading to bypass of middleware on static paths

honojs/hono · GHSA-5r4p-p66f-jhc7 · CVE-2026-111757

medium2026-10-20

@angular/platform-server: Open Redirect via Protocol-Relative URLs in Server-Side Rendering (SSR)

angular/angular · GHSA-w739-gvwx-grc3 · CVE-2026-111754

high2026-10-20

markdown-it: Quadratic complexity in smartquotes with unmatched closing quotes

markdown-it/markdown-it · GHSA-r7fv-28h4-cvq7 · CVE-2026-111759