CVE-2026-114501 Pillow: Arrow export leaks stale heap memory when PILLOW_ALIGNMENT > 1

Pillow is a Python imaging library. From 11.2.1 until 13.0.0, Arrow export assumes that an image's rows are tightly contiguous and exports from im-blocks0.ptr even when PILLOWALIGNMENT makes alignedlinesize include row padding or an aligned offset before the first row. The resulting Arrow buffer...

EUVD-2026-105103

ApostropheCMS: Exposure of Sensitive Information via predictable export filenames...

ApostropheCMS: Exposure of Sensitive Information via predictable export filenames

Summary When a user exports content through @apostrophecms/import-export, the module copies the generated archive into uploadfs at /exports/ and returns a public URL under /uploads/exports/. The filename is fully deterministic: site shortName, document type, a YYYYMMDDHHmmss timestamp, and the...

GHSA-RW26-WWFC-9WVM ApostropheCMS: Missing Authentication in `cleanExport` Route

Summary The API endpoint POST /api/v1/@apostrophecms/import-export/clean-export in @apostrophecms/import-export lacks authentication and authorization checks. Any client—including unauthenticated anonymous users who have obtained the standard CSRF cookie from visiting the site—can directly...

EUVD-2026-105172

ApostropheCMS: Missing Authentication in cleanExport Route...

ApostropheCMS: Missing Authentication in `cleanExport` Route

Summary The API endpoint POST /api/v1/@apostrophecms/import-export/clean-export in @apostrophecms/import-export lacks authentication and authorization checks. Any client—including unauthenticated anonymous users who have obtained the standard CSRF cookie from visiting the site—can directly...

GHSA-5M22-7PFQ-VP65 ApostropheCMS: Import API bypasses publication roles for protected content

Review scope and evidence limits Package: @apostrophecms/import-export, version 3.7.0. Release tag reviewed: @apostrophecms/[email protected], commit 9500b8b0e1d630d5e07fbb5fd2c25ed0943845ce September 30, 2026. Current main reviewed: 5ce3732be0ebdebb4db0f8ef160c81e8671157e6. The importer, gzip...

EUVD-2026-105184

ApostropheCMS: Import API bypasses publication roles for protected content...

ApostropheCMS: Import API bypasses publication roles for protected content

Review scope and evidence limits Package: @apostrophecms/import-export, version 3.7.0. Release tag reviewed: @apostrophecms/[email protected], commit 9500b8b0e1d630d5e07fbb5fd2c25ed0943845ce September 30, 2026. Current main reviewed: 5ce3732be0ebdebb4db0f8ef160c81e8671157e6. The importer, gzip...

GHSA-JF5H-36MG-RP6X ApostropheCMS: Archive duplicate continuation lets contributors overwrite published content

Review scope and evidence limits Package: @apostrophecms/import-export, version 3.7.0. Release tag reviewed: @apostrophecms/[email protected], commit 9500b8b0e1d630d5e07fbb5fd2c25ed0943845ce September 30, 2026. Current main reviewed: 5ce3732be0ebdebb4db0f8ef160c81e8671157e6. The importer, gzip...

ApostropheCMS: Archive duplicate continuation lets contributors overwrite published content

Review scope and evidence limits Package: @apostrophecms/import-export, version 3.7.0. Release tag reviewed: @apostrophecms/[email protected], commit 9500b8b0e1d630d5e07fbb5fd2c25ed0943845ce September 30, 2026. Current main reviewed: 5ce3732be0ebdebb4db0f8ef160c81e8671157e6. The importer, gzip...

EUVD-2026-105107

ApostropheCMS: Archive duplicate continuation lets contributors overwrite published content...

ApostropheCMS: Import archives can exhaust server storage and deny service

Review scope and evidence limits Package: @apostrophecms/import-export, version 3.7.0. Release tag reviewed: @apostrophecms/[email protected], commit 9500b8b0e1d630d5e07fbb5fd2c25ed0943845ce September 30, 2026. Current main reviewed: 5ce3732be0ebdebb4db0f8ef160c81e8671157e6. The importer, gzip...

EUVD-2026-105105

ApostropheCMS: Import archives can exhaust server storage and deny service...

GHSA-9G7P-M758-RP72 ApostropheCMS: Import archives can exhaust server storage and deny service

Review scope and evidence limits Package: @apostrophecms/import-export, version 3.7.0. Release tag reviewed: @apostrophecms/[email protected], commit 9500b8b0e1d630d5e07fbb5fd2c25ed0943845ce September 30, 2026. Current main reviewed: 5ce3732be0ebdebb4db0f8ef160c81e8671157e6. The importer, gzip...

ApostropheCMS: Unauthenticated Resource Exhaustion Via Pre-auth AposBigUpload Processing In @apostrophecms/import-export

Summary A potential unauthenticated denial-of-service vulnerability exists in the chunked import upload path used by "@apostrophecms/import-export". The affected import API routes invoke: "self.apos.http.bigUploadMiddleware" before the actual import handler performs its authentication check...

GHSA-86WM-68PQ-5JWQ ApostropheCMS: Unauthenticated resource exhaustion via pre-auth aposBigUpload processing in @apostrophecms/import-export

Summary A potential unauthenticated denial-of-service vulnerability exists in the chunked import upload path used by @apostrophecms/import-export. The affected import API routes invoke: self.apos.http.bigUploadMiddleware before the actual import handler performs its authentication check. Because ...

EUVD-2026-105223

ApostropheCMS: Unauthenticated resource exhaustion via pre-auth aposBigUpload processing in @apostrophecms/import-export...

ApostropheCMS: Unauthenticated resource exhaustion via pre-auth aposBigUpload processing in @apostrophecms/import-export

Summary A potential unauthenticated denial-of-service vulnerability exists in the chunked import upload path used by @apostrophecms/import-export. The affected import API routes invoke: self.apos.http.bigUploadMiddleware before the actual import handler performs its authentication check. Because ...

npm: ApostropheCMS: Unauthenticated resource exhaustion via pre-auth aposBigUpload processing in @apostrophecms/import-export

npm: ApostropheCMS: Unauthenticated resource exhaustion via pre-auth aposBigUpload processing in @apostrophecms/import-export vulnerability discovered by ? in WordPress npm apostrophe versions 4.33.0...