These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.
CVE-2026-53606 is a vulnerability in the sanitize-html package, used by ApostropheCMS, a Node.js content management system. The vulnerability arises from the `allowedSchemesAppliedToAttributes` configuration, which by default does not include all HTML attributes that accept URIs. This oversight enables `javascript:` URIs to pass through unmodified, potentially leading to Cross-Site Scripting (XSS) attacks [truncated]
ApostropheCMS, an open-source Node.js content management system, is vulnerable to stored cross-site scripting (XSS) via an unsanitized user display name in the draft version tooltip. This vulnerability is identified as CVE-2026-45014 and has a CVSS score of 5.3, categorized as MEDIUM severity. As of the publication date, no patched versions are available. The vulnerability allows an attacker to inject mal [truncated]
ApostropheCMS, an open-source Node.js content management system, has a password reset flow vulnerability in versions up to and including 4.29.0. The vulnerability allows an unauthenticated attacker who knows a victim's email address to send a crafted reset request. This causes the application to email the victim a reset link pointing to the attacker's domain. When the victim clicks the link, the valid res [truncated]
ApostropheCMS, an open-source Node.js content management system, is vulnerable to an authenticated server-side request forgery (SSRF) attack in the rich-text widget import flow. This vulnerability, tracked as CVE-2026-45012, affects versions up to and including 4.29.0. An authenticated user who can submit or edit rich-text widget content can cause the server to fetch attacker-controlled URLs during widget [truncated]
ApostropheCMS version 4.29.0 has a stored cross-site scripting vulnerability in the image widget functionality. A user with the Editor role can configure an image widget link to use a javascript: URL payload. Because editors have permission to publish pages, the malicious widget can be published to the live site. When another user, including an administrator or public visitor, clicks the affected image/li [truncated]
ApostropheCMS's sanitize-html library versions prior to 2.17.4 have a vulnerability that can turn attacker-controlled content inside a disallowed `xmp` element into live HTML or JavaScript, leading to stored XSS. This issue is patched in version 2.17.4. The vulnerability allows an attacker to inject malicious code, which can then be executed by the application, potentially leading to unauthorized access o [truncated]
ApostropheCMS's @apostrophecms/cli package, up to and including version 3.6.0, contains a command injection vulnerability in the apos create command. User-supplied input from the password prompt is embedded directly into a shell command without proper sanitization or escaping, allowing execution of arbitrary commands on the host system. As of publication, no patched versions are available.
ApostropheCMS versions 4.28.0 and prior are vulnerable to a regression in the sanitize-html package, which allows for arbitrary tag injection, including XSS payloads, through entity encoding in option or textarea elements. This vulnerability affects non-default configurations where option or textarea are included in allowedTags, common in form builders and CMS platforms. The regression, introduced in comm [truncated]
CVE-2026-39857 debrief based on the supplied source corpus. The CVE record was published on 2026-04-15T20:16:36.567Z and has not been modified since then. This vulnerability affects ApostropheCMS versions 4.28.0 and prior, allowing unauthorized access to distinct field values. Defenders should assess exposure and apply patches to prevent potential exploitation. The vulnerability is caused by an authorizat [truncated]
ApostropheCMS versions 4.28.0 and prior contain a stored cross-site scripting vulnerability in SEO-related fields. An attacker can inject a payload to break out of the intended HTML context and execute arbitrary JavaScript in the browser of any authenticated user who views the affected page. This vulnerability allows for potential access to sensitive data such as usernames, email addresses, and roles via [truncated]
ApostropheCMS versions 4.28.0 and prior contain a stored cross-site scripting vulnerability in the @apostrophecms/color-field module. An editor can inject a value which closes the style tag and executes arbitrary JavaScript in the browser of every visitor to any page containing the affected widget. This vulnerability allows for mass session hijacking, cookie theft, and privilege escalation to administrati [truncated]
ApostropheCMS versions 4.28.0 and prior contain an authorization bypass vulnerability in the getRestQuery method of the @apostrophecms/piece-type module. An unauthenticated attacker can supply a project query parameter in the REST API request to disclose any field on publicly queryable documents that the administrator explicitly restricted from the public API.
ApostropheCMS versions 4.28.0 and prior have a timing side-channel vulnerability in the password reset endpoint, allowing unauthenticated username and email enumeration. This issue is fixed in version 4.29.0. The vulnerability enables attackers to enumerate valid accounts for credential stuffing or targeted phishing in instances with the passwordReset option enabled. Defenders should assess exposure and i [truncated]
