Missing Authentication for Critical Function

Overview @apostrophecms/import-export is an Import Export Documents for ApostropheCMS Affected versions of this package are vulnerable to Missing Authentication for Critical Function due to missing authentication and authorization checks in the POST /api/v1/@apostrophecms/import-export/clean-expo...

Missing Authorization

Overview apostrophe is a content management system CMS for Node.js. It supports in-context editing, schema-driven content types, flexible widgets and a great deal more. This module contains everything necessary to build a website with ApostropheCMS. Affected versions of this package are vulnerabl...

Missing Authorization

Overview @apostrophecms/import-export is an Import Export Documents for ApostropheCMS Affected versions of this package are vulnerable to Missing Authorization due to missing publication permission checks in the import API’s write operations. An authenticated attacker with edit permissions for an...

Allocation of Resources Without Limits or Throttling

Overview apostrophe is a content management system CMS for Node.js. It supports in-context editing, schema-driven content types, flexible widgets and a great deal more. This module contains everything necessary to build a website with ApostropheCMS. Affected versions of this package are vulnerabl...

@biztory/n8n-nodes-tableau-rest-api (>=0.1.13, <=0.1.14), @blinkk/root-cms (>=3.5.2, <=4.1.2) +129 more potentially affected by CVE-2026-113657 via sanitize-html (2.17.7)

sanitize-html NPM version 2.17.7 is affected by a known vulnerability. The following packages have a transitive dependency on sanitize-html and may be impacted: - @biztory/n8n-nodes-tableau-rest-api =0.1.13, =3.5.2, =12.3.0-depup.0, =39.0.0, =9.0.2, =0.0.0-dummy.1, =0.29.2, =0.1.0, =0.10.2,...

Missing Authorization

Overview apostrophe is a content management system CMS for Node.js. It supports in-context editing, schema-driven content types, flexible widgets and a great deal more. This module contains everything necessary to build a website with ApostropheCMS. Affected versions of this package are vulnerabl...

@biztory/n8n-nodes-tableau-rest-api (>=0.1.13, <=0.1.14), @blinkk/root-cms (>=3.5.2, <=4.1.2) +129 more potentially affected by CVE-2026-113657 via sanitize-html (2.17.7)

sanitize-html NPM version 2.17.7 is affected by a known vulnerability. The following packages have a transitive dependency on sanitize-html and may be impacted: - @biztory/n8n-nodes-tableau-rest-api =0.1.13, =3.5.2, =12.3.0-depup.0, =39.0.0, =9.0.2, =0.0.0-dummy.1, =0.29.2, =0.1.0, =0.10.2,...

@biztory/n8n-nodes-tableau-rest-api (>=0.1.13, <=0.1.14), @blinkk/root-cms (>=3.5.2, <=4.1.2) +129 more potentially affected by CVE-2026-113657 via sanitize-html (2.17.7)

sanitize-html NPM version 2.17.7 is affected by a known vulnerability. The following packages have a transitive dependency on sanitize-html and may be impacted: - @biztory/n8n-nodes-tableau-rest-api =0.1.13, =3.5.2, =12.3.0-depup.0, =39.0.0, =9.0.2, =0.0.0-dummy.1, =0.29.2, =0.1.0, =0.10.2,...

GHSA-VMXH-77CW-65J7 ApostropheCMS: Authenticated Object-Level Authorization Bypass in exist-in-locale Reveals Restricted Localized Draft Identifiers

Summary ApostropheCMS’s exist-in-locale API allows an authenticated low-privilege user to determine whether restricted documents exist in a specified locale and mode, including draft mode. The endpoint returns localized document identifiers without applying document-level view or edit authorizati...

ApostropheCMS: Authenticated Object-Level Authorization Bypass in exist-in-locale Reveals Restricted Localized Draft Identifiers

Summary ApostropheCMS’s exist-in-locale API allows an authenticated low-privilege user to determine whether restricted documents exist in a specified locale and mode, including draft mode. The endpoint returns localized document identifiers without applying document-level view or edit authorizati...

ApostropheCMS: No Attempt Throttling on Authenticated Password-Change Endpoint Enables Unlimited Current-Password Guessing

Summary The self-service password-change endpoint verifies the current password but does not use the login module’s failed-attempt counter, throttle, delay, or lockout mechanism. An attacker with a valid authenticated session can submit repeated guesses for the current password without receiving ...

CVE-2026-113670

Rejected reason: This CVE is a duplicate of another CVE...

CVE-2026-113660

ApostropheCMS is an open-source Node.js content management system. Prior to 4.33.0, ApostropheCMS’s exist-in-locale API allows an authenticated low-privilege user to determine whether restricted documents exist in a specified locale and mode, including draft mode. The endpoint returns localized...

GHSA-2J32-Q6RX-H844 ApostropheCMS: Page REST API authorization bypass

Summary The core page REST API reads full page documents with .permissionfalse in getOne and in the all=1 tree dump, bypassing page-type viewRole, visibility: private, and visibility: loginRequired checks. Unauthenticated visitors and low-privilege contributors can read admin-only and non-public...

ApostropheCMS: Page REST API authorization bypass

Summary The core page REST API reads full page documents with .permissionfalse in getOne and in the all=1 tree dump, bypassing page-type viewRole, visibility: private, and visibility: loginRequired checks. Unauthenticated visitors and low-privilege contributors can read admin-only and non-public...

npm: ApostropheCMS: Page REST API authorization bypass

npm: ApostropheCMS: Page REST API authorization bypass vulnerability discovered by ? in WordPress npm apostrophe versions 4.33.0...

CVE-2026-97406 Authentication Bypass via Bearer Tokens to Unauthorized Credential Minting

XERJ Console API bearer tokens can bypass the passkey‑only authentication requirement and directly invoke the API‑token creation endpoint, allowing unauthorized minting of persistent successor credentials...

CVE-2026-97406

The Xerj Console API , an open-source search and indexing engine, contains an authentication bypass vulnerability (CVE-2026-97406 ). The root cause is an architectural flaw where the system fails to distinguish between standard browser sessions and API bearer tokens, converting both into a generi...

EUVD-2026-105251

XERJ Console API bearer tokens can bypass the passkey‑only authentication requirement and directly invoke the API‑token creation endpoint, allowing unauthorized minting of persistent successor credentials...

EUVD-2026-105250

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. From 2.1.0 until 3.3.15, 3.4.10, 3.5.4, and 3.6.0-rc2, when an operator has enabled --enable-helm for kustomize build, helmGlobals.configHome can point Helm's config and data directories at a repository-controlled location...