CVE-2026-113712

The open-source status page system Cachet (versions 2.4.1 and earlier) contains a stored Cross-Site Scripting (XSS) vulnerability within the incident creation form. This flaw allows an authenticated attacker to inject malicious HTML or JavaScript, which then executes in the browser of any user vi...

CVE-2026-113712 Cachet has Stored XSS in Incident Component

Cachet is an open-source status page system. Versions 2.4.1 and earlier have a stored Cross-Site Scripting XSS vulnerability in the incident creation form, allowing an authenticated attacker to inject malicious HTML/JavaScript that executes in the browser of any user who views the status page,...

CVE-2026-113712 Cachet has Stored XSS in Incident Component

Cachet is an open-source status page system. Versions 2.4.1 and earlier have a stored Cross-Site Scripting XSS vulnerability in the incident creation form, allowing an authenticated attacker to inject malicious HTML/JavaScript that executes in the browser of any user who views the status page,...

CVE-2026-113667

ApostropheCMS is an open-source Node.js content management system. Prior to 1.5.5 of the Form add-on, 1.2.1 of login-recaptcha, and 1.3.0 of login-hcaptcha, these three CAPTCHA integrations interpolate an unencoded user-supplied response token into the provider verification request. Crafted token...

ApostropheCMS: Unauthenticated unbounded multipart upload → disk-exhaustion DoS

Summary The form submission endpoint runs multer dest: os.tmpdir .any before authentication, API-key, CSRF-equivalent, or form-existence logic, with no size/count/rate limits. Unauthenticated users can stream unbounded bodies to disk per request; cleanup occurs only after the full body is receive...

ApostropheCMS: CAPTCHA response token not URL-encoded

Summary Form and login CAPTCHA verification interpolate the user-supplied widget token unencoded into the server-side verification URL/body, allowing a crafted token to inject query parameters into the reCAPTCHA/hCaptcha verify request. Details - packages/form/lib/recaptcha.js:39 — recaptchaUri =...

CVE-2026-111756 follow-redirects array-form headers bypass cross-origin credential stripping

follow-redirects is a Node.js HTTP and HTTPS client wrapper that automatically follows redirects. From version 1.16.0 to before version 1.16.1, follow-redirects removes sensitive credential headers Authorization, Proxy-Authorization, Cookie, and any caller-declared sensitiveHeaders before followi...

CVE-2026-111756

The follow-redirects Node.js library (versions 1.16.0 to before 1.16.1 ) contains an unauthenticated confidentiality vulnerability where sensitive credential headers are leaked during cross-origin redirects. The root cause is a logic flaw in the removeMatchingHeaders function; while it correctly ...

CVE-2026-111756 follow-redirects array-form headers bypass cross-origin credential stripping

follow-redirects is a Node.js HTTP and HTTPS client wrapper that automatically follows redirects. From version 1.16.0 to before version 1.16.1, follow-redirects removes sensitive credential headers Authorization, Proxy-Authorization, Cookie, and any caller-declared sensitiveHeaders before followi...

EUVD-2026-105225

follow-redirects is a Node.js HTTP and HTTPS client wrapper that automatically follows redirects. From version 1.16.0 to before version 1.16.1, follow-redirects removes sensitive credential headers Authorization, Proxy-Authorization, Cookie, and any caller-declared sensitiveHeaders before followi...

GHSA-Q3JH-WRC6-JGQ8 follow-redirects array-form headers bypass cross-origin credential stripping

Summary follow-redirects removes sensitive credential headers Authorization, Proxy-Authorization, Cookie, and any caller-declared sensitiveHeaders before following a redirect that crosses to a different host or downgrades to a less secure protocol. The removal routine iterates the caller's header...

npm: follow-redirects array-form headers bypass cross-origin credential stripping

npm: follow-redirects array-form headers bypass cross-origin credential stripping vulnerability discovered by ? in WordPress npm follow-redirects versions = 1.16.0, 1.16.1...

follow-redirects array-form headers bypass cross-origin credential stripping

Summary follow-redirects removes sensitive credential headers Authorization, Proxy-Authorization, Cookie, and any caller-declared sensitiveHeaders before following a redirect that crosses to a different host or downgrades to a less secure protocol. The removal routine iterates the caller's header...

CVE-2026-113667 ApostropheCMS: CAPTCHA response token not URL-encoded

ApostropheCMS is an open-source Node.js content management system. Prior to 1.5.5 of the Form add-on, 1.2.1 of login-recaptcha, and 1.3.0 of login-hcaptcha, these three CAPTCHA integrations interpolate an unencoded user-supplied response token into the provider verification request. Crafted token...

CVE-2026-113667 ApostropheCMS: CAPTCHA response token not URL-encoded

ApostropheCMS is an open-source Node.js content management system. Prior to 1.5.5 of the Form add-on, 1.2.1 of login-recaptcha, and 1.3.0 of login-hcaptcha, these three CAPTCHA integrations interpolate an unencoded user-supplied response token into the provider verification request. Crafted token...

CVE-2026-113667

ApostropheCMS, an open-source Node.js content management system, contains a vulnerability in three CAPTCHA integrations: Form , login-recaptcha , and login-hcaptcha . The flaw exists because these components interpolate an unencoded user-supplied response token into the provider verification requ...

CVE-2026-113656

ApostropheCMS is an open-source Node.js content management system. Prior to 1.5.5 of the ApostropheCMS Form add-on, its form submission route stages unbounded multipart uploads before form validation or authentication and lacks upload size, count, and rate limits. Repeated unauthenticated...

CVE-2026-112958

ApostropheCMS is an open-source Node.js content management system. Prior to 4.34.0, a project-defined free-form widget style field can carry an editor-controlled quote into an inline style attribute because the wrapper serializer does not apply HTML-attribute encoding. The quote can terminate the...

CVE-2026-113656 ApostropheCMS: Unauthenticated unbounded multipart upload → disk-exhaustion DoS

ApostropheCMS is an open-source Node.js content management system. Prior to 1.5.5 of the ApostropheCMS Form add-on, its form submission route stages unbounded multipart uploads before form validation or authentication and lacks upload size, count, and rate limits. Repeated unauthenticated...

CVE-2026-113656

The ApostropheCMS Form add-on for Node.js is vulnerable to a denial of service (DoS) via disk exhaustion. Prior to version 1.5.5 , the form submission route processes unbounded multipart uploads without prior authentication, validation, or enforcement of size, count, and rate limits. An unauthent...