CVE-2026-91406

A vulnerability exists in the Outside In PDF Export SDK component of the Oracle Outside In Technology product within Oracle Fusion Middleware (affected version 8.5.8 ). An unauthenticated attacker with network access via HTTP can exploit this high-complexity vulnerability to compromise or take ov...

CLSA-2026-1792530394 TuxCare security update for @babel/helper-split-export-declaration (2 CVEs)

TuxCare rebuilt @babel/helper-split-export-declaration to address 2 CVEs. Fixed in 7.16.7-tuxcare.2...

CLSA-2026-1792530389 TuxCare security update for @babel/helper-split-export-declaration (1 CVE)

TuxCare rebuilt @babel/helper-split-export-declaration to address 1 CVE. Fixed in 7.18.9-tuxcare.3...

CLSA-2026-1792530387 TuxCare security update for @babel/helper-split-export-declaration (1 CVE)

TuxCare rebuilt @babel/helper-split-export-declaration to address 1 CVE. Fixed in 7.21.5-tuxcare.1...

CLSA-2026-1792530388 TuxCare security update for @babel/helper-split-export-declaration (1 CVE)

TuxCare rebuilt @babel/helper-split-export-declaration to address 1 CVE. Fixed in 7.21.0-tuxcare.4...

CLSA-2026-1792525290 TuxCare security update for @babel/plugin-proposal-export-default-from (1 CVE)

TuxCare rebuilt @babel/plugin-proposal-export-default-from to address 1 CVE. Fixed in 7.18.9-tuxcare.3...

CLSA-2026-1792525288 TuxCare security update for @babel/plugin-proposal-export-default-from (2 CVEs)

TuxCare rebuilt @babel/plugin-proposal-export-default-from to address 2 CVEs. Fixed in 7.16.7-tuxcare.2...

CLSA-2026-1792525287 TuxCare security update for @babel/plugin-proposal-export-default-from (1 CVE)

TuxCare rebuilt @babel/plugin-proposal-export-default-from to address 1 CVE. Fixed in 7.21.0-tuxcare.4...

CLSA-2026-1792525284 TuxCare security update for @babel/plugin-proposal-export-default-from (1 CVE)

TuxCare rebuilt @babel/plugin-proposal-export-default-from to address 1 CVE. Fixed in 7.21.5-tuxcare.1...

ApostropheCMS import-export tar guard misses './..' because it is a literal '../' substring test

Summary The tar-extraction guard added to @apostrophecms/import-export for GHSA-mwxc-m426-3f78 is a literal substring test for ../, and ./.. does not contain that substring. An entry named ./.. therefore passes the guard, path.join normalizes it to the parent of the export directory, and the...

ApostropheCMS import-export: NoSQL injection via update-key value lets a crafted import match and overwrite an unidentified document

Summary @apostrophecms/import-export's update-by-key feature lets an imported document carry a :key property for example slug:key whose value is used to find an existing document to update instead of inserting a new one. getUpdateKey/insertOrUpdateDocWithKey lib/methods/import.js use that value...

GHSA-JQW5-W6H3-44G6 ApostropheCMS import-export: NoSQL injection via update-key value lets a crafted import match and overwrite an unidentified document

Summary @apostrophecms/import-export's update-by-key feature lets an imported document carry a :key property for example slug:key whose value is used to find an existing document to update instead of inserting a new one. getUpdateKey/insertOrUpdateDocWithKey lib/methods/import.js use that value...

CVE-2026-113711

ApostropheCMS is an open-source Node.js content management system. Prior to 4.33.0 of ApostropheCMS and 3.7.0 of the import-export module, import routes invoke bigUploadMiddleware without an early authorize callback, allowing unauthenticated requests to perform upload initialization, chunk storag...

CVE-2026-113662

ApostropheCMS is an open-source Node.js content management system. Prior to 3.7.0 of the import-export module, an authenticated user with import access to a target type can supply an object or operator as an update-key value, causing the import query to match an unidentified existing document tha...

CVE-2026-113664

ApostropheCMS is an open-source Node.js content management system. Prior to 3.7.0 of the import-export module, an authenticated importer can submit a tar entry whose normalized destination targets a directory while bypassing the literal parent-path substring guard. Opening that directory as a wri...

CVE-2026-113711

ApostropheCMS is an open-source Node.js content management system. Prior to 4.33.0 of ApostropheCMS and 3.7.0 of the import-export module, import routes invoke bigUploadMiddleware without an early authorize callback, allowing unauthenticated requests to perform upload initialization, chunk storag...

CVE-2026-113711 ApostropheCMS: Unauthenticated resource exhaustion via pre-auth aposBigUpload processing in @apostrophecms/import-export

ApostropheCMS is an open-source Node.js content management system. Prior to 4.33.0 of ApostropheCMS and 3.7.0 of the import-export module, import routes invoke bigUploadMiddleware without an early authorize callback, allowing unauthenticated requests to perform upload initialization, chunk storag...

CVE-2026-113711

The ApostropheCMS Node.js content management system is vulnerable to unauthenticated resource exhaustion due to improper authorization in the @apostrophecms/import-export module. Specifically, import routes invoke bigUploadMiddleware without an early authorize callback, enabling unauthenticated r...

CVE-2026-113711 ApostropheCMS: Unauthenticated resource exhaustion via pre-auth aposBigUpload processing in @apostrophecms/import-export

ApostropheCMS is an open-source Node.js content management system. Prior to 4.33.0 of ApostropheCMS and 3.7.0 of the import-export module, import routes invoke bigUploadMiddleware without an early authorize callback, allowing unauthenticated requests to perform upload initialization, chunk storag...

CVE-2026-113649

ApostropheCMS is an open-source Node.js content management system. Prior to 3.7.1 of the import-export module and 4.34.0 of core ApostropheCMS, an editor who can import an enabled content type but lacks its stronger publication role can cause import write helpers to create, replace, or remove...