Low, CVSS 3.7
ApostropheCMS: Missing Authorization on Notification PATCH/DELETE Endpoints
npm apostrophe · Upgrade to 4.33.0 or later · < 4.33.0 · CVE-2026-113665 · GHSA-vwwx-px9w-crrc · amended
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 982 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 1,020 in the 30 days before.
- Critical
- 68 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
Actionable
776–800 of 30,910 matching · newest first
- Medium, CVSS 5.3
ApostropheCMS import-export tar guard misses './..' because it is a literal '../' substring test
npm @apostrophecms/import-export · Upgrade to 3.7.0 or later · < 3.7.0 · CVE-2026-113664 · GHSA-97wv-p4xx-c7mg · amended
- Low, CVSS 3.3
ApostropheCMS: Path traversal in uploadfs
npm uploadfs · Upgrade to 1.28.0 or later · < 1.28.0 · CVE-2026-113651 · GHSA-gmfx-5g6x-rr72 · amended
- Low, CVSS 3.7
ApostropheCMS sanitize-html: SMIL animation namespace-prefix bypass allows javascript: URI injection (XSS)
npm sanitize-html · Upgrade to 2.18.0 or later · >= 2.17.7, < 2.18.0 · CVE-2026-113657 · GHSA-374f-7chj-9948 · amended
- Medium, CVSS 5.6
ApostropheCMS uploadfs Azure backend leaks account-level SAS token into every public attachment URL (sas: true)
npm uploadfs · Upgrade to 1.28.0 or later · >= 1.25.0, < 1.28.0 · CVE-2026-113652 · GHSA-hhph-8536-gfq5 · amended
- Medium, CVSS 4.3
ApostropheCMS: Authenticated Object-Level Authorization Bypass in exist-in-locale Reveals Restricted Localized Draft Identifiers
npm apostrophe · Upgrade to 4.33.0 or later · < 4.33.0 · CVE-2026-113660 · GHSA-vmxh-77cw-65j7 · amended
- Medium, CVSS 5.4
ApostropheCMS import-export: NoSQL injection via update-key value lets a crafted import match and overwrite an unidentified document
npm @apostrophecms/import-export · Upgrade to 3.7.0 or later · < 3.7.0 · CVE-2026-113662 · GHSA-jqw5-w6h3-44g6 · amended
- Medium, CVSS 6.1
ApostropheCMS: Client-side Prototype Pollution in apos.http.parseQuery leading to DOM-based XSS against authenticated users
npm apostrophe · Upgrade to 4.33.0 or later · < 4.33.0 · CVE-2026-113659 · GHSA-m2m5-rw3w-cwmj · amended
- Medium, CVSS 5.9
ApostropheCMS: No Attempt Throttling on Authenticated Password-Change Endpoint Enables Unlimited Current-Password Guessing
npm apostrophe · Upgrade to 4.33.0 or later · < 4.33.0 · CVE-2026-113710 · GHSA-653j-g8j7-gh54 · amended
- Medium, CVSS 5.4
ApostropheCMS: Incomplete CVE-2026-53606:
meta http-equiv=refreshcontentstill shipsjavascript:/data:URLsnpm sanitize-html · Upgrade to 2.18.0 or later · < 2.18.0 · CVE-2026-113661 · GHSA-cv27-6wvh-8x7j · amended
- Medium, CVSS 5.3
ApostropheCMS: :_id/locales REST route omits the public-API authorization gate its sibling read routes enforce (unauthenticated doc-existence + locale metadata disclosure)
npm apostrophe · Upgrade to 4.33.0 or later · < 4.33.0 · CVE-2026-113668 · GHSA-gqh3-7856-rjjg · amended
- Medium, CVSS 5.3
ApostropheCMS: Page REST API authorization bypass
npm apostrophe · Upgrade to 4.33.0 or later · < 4.33.0 · CVE-2026-113670 · GHSA-2j32-q6rx-h844 · amended
- Medium, CVSS 4.3
ApostropheCMS: Host header controls server-side image fetch origin in @apostrophecms/ai-helper, enabling authenticated SSRF
npm @apostrophecms/ai-helper · Upgrade to 1.0.0-beta.13 (pre-release) or later · >= 1.0.0-beta.10, < 1.0.0-beta.13 · CVE-2026-113671 · GHSA-527g-ff96-x6wj · amended
- High, CVSS 7.5
ApostropheCMS: Unauthenticated CSV import requests leave rejected uploads in the system temporary directory
npm apostrophe · Upgrade to 4.33.0 or later · < 4.33.0 · CVE-2026-113658 · GHSA-qhcq-9pm2-c9w9 · amended
- Medium, CVSS 5.3
ApostropheCMS: Cross-domain session token in URL confers session takeover
npm @apostrophecms/passport-bridge · Upgrade to 1.6.1 or later · < 1.6.1 · +1 more package · CVE-2026-113669 · GHSA-hhvr-8m24-qqr3 · amended
- Medium, CVSS 5.3
ApostropheCMS: Unauthenticated unbounded multipart upload → disk-exhaustion DoS
npm @apostrophecms/form · Upgrade to 1.5.5 or later · < 1.5.5 · CVE-2026-113656 · GHSA-89mh-mm8c-mv7f · amended
- Medium, CVSS 5.3
ApostropheCMS: CAPTCHA response token not URL-encoded
npm @apostrophecms/login-recaptcha · Upgrade to 1.2.1 or later · < 1.2.1 · +2 more packages · CVE-2026-113667 · GHSA-44qr-rrjg-2cqq · amended
- Medium, CVSS 4.3
ApostropheCMS: Same-parent page reorder in @apostrophecms/page move() re-ranks a restricted parent's children without create authorization
npm apostrophe · Upgrade to 4.33.0 or later · < 4.33.0 · CVE-2026-113655 · GHSA-2jrp-qc93-h2j8 · amended
- High, CVSS 7.1
ApostropheCMS: Authenticated projection-exclusion prototype-member deletion in @apostrophecms/db-connect causes process-wide denial of service
npm @apostrophecms/db-connect · Upgrade to 1.1.0 or later · < 1.1.0 · +1 more package · CVE-2026-113666 · GHSA-j5rq-xfvr-p969 · amended
- Medium, CVSS 5.3
ApostropheCMS sanitize-html: nonTextTags discard region ends early on an implied close, letting content render
npm sanitize-html · Upgrade to 2.18.0 or later · < 2.18.0 · CVE-2026-113654 · GHSA-x3q4-9hxx-gx8m · amended
- High, CVSS 8.2
follow-redirects array-form headers bypass cross-origin credential stripping
npm follow-redirects · Upgrade to 1.16.1 or later · >= 1.16.0, < 1.16.1 · CVE-2026-111756 · GHSA-q3jh-wrc6-jgq8 · amended
- High, CVSS 8.2
follow-redirects sensitiveHeaders regex escaping can expose credential headers
npm follow-redirects · Upgrade to 1.16.1 or later · >= 1.16.0, < 1.16.1 · CVE-2026-111755 · GHSA-8r9p-f939-6h3c · amended
- High, CVSS 8.2
@angular/router: Denial of Service via RouterLink Query Parameter Retention in Server-Side Rendering (SSR)
npm @angular/router · Upgrade to 22.2.1 or 21.2.25 by release line · >= 22.0.0, < 22.2.1; >= 21.2.0, < 21.2.25 · CVE-2026-111751 · GHSA-57xq-rjx2-v5xh · amended
- High, CVSS 8.2
@angular/router: Denial of Service via Unmatched Empty-Path Outlet Route Matching in Server-Side Rendering (SSR)
npm @angular/router · Upgrade to 22.2.1, 21.2.25 or 20.3.33 by release line; some affected versions have no fix yet · >= 22.0.0, < 22.2.1; >= 21.0.0, < 21.2.25; >= 20.0.0, < 20.3.33; <= 19.2.25 · CVE-2026-111752 · GHSA-62vg-58rm-qff7 · amended
- Medium, CVSS 5.3
Hono:
serveStaticdecodes the request path a second time, leading to bypass of middleware on static pathsnpm hono · Upgrade to 4.13.11 or later · >= 4.12.4, < 4.13.11 · CVE-2026-111757 · GHSA-5r4p-p66f-jhc7 · amended
A vendor fix does not resolve your finding until you verify it in your own systems.
News
Security reports that are not matched to your stack.
CISA security events · all vendors
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
Advisory watch · no fix evidence
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.