PkgSeer

Vulnerabilities

Last updated 41 minutes ago
Filters
Severity
Critical Severity
CVSS Score Range: 9.0–10.0
Critical severity vulnerabilities (CVSS 9.0–10.0). These represent the highest impact issues.
High Severity
CVSS Score Range: 7.0–8.9
High severity vulnerabilities (CVSS 7.0–8.9). Serious vulnerabilities that should be prioritized soon after critical fixes.
Medium Severity
CVSS Score Range: 4.0–6.9
Medium severity vulnerabilities (CVSS 4.0–6.9). Important issues that meaningfully reduce security confidence.
Low Severity
CVSS Score Range: < 4.0
Low severity vulnerabilities (CVSS < 4.0). Hygiene issues that can accumulate but pose lower immediate risk.
Unknown Severity
CVSS Score Range: No score
Vulnerabilities without an assigned CVSS score. Severity is not determinable from available data.
Package Summary Severity Published Modified
apostrophe ApostropheCMS: Missing Authorization on Notification PATCH/DELETE Endpoints Low Risk 3.7 3 hours ago 2 hours ago
apostrophe ApostropheCMS: The general public can access @apostrophecms/user objects via a relationship (viewRole is not applied to the general public) Medium Risk 6.0 3 hours ago 2 hours ago
apostrophe ApostropheCMS: Page REST API authorization bypass Medium Risk 5.3 3 hours ago 3 hours ago
apostrophe ApostropheCMS: No Attempt Throttling on Authenticated Password-Change Endpoint Enables Unlimited Current-Password Guessing Medium Risk 5.9 3 hours ago 3 hours ago
@apostrophecms/import-export ApostropheCMS import-export tar guard misses './..' because it is a literal '../' substring test Medium Risk 6.0 3 hours ago 3 hours ago
apostrophe ApostropheCMS: Client-side Prototype Pollution in apos.http.parseQuery leading to DOM-based XSS against authenticated users Medium Risk 6.1 3 hours ago 3 hours ago
@apostrophecms/ai-helper ApostropheCMS: Host header controls server-side image fetch origin in @apostrophecms/ai-helper, enabling authenticated SSRF Medium Risk 4.3 3 hours ago 3 hours ago
apostrophe ApostropheCMS: :_id/locales REST route omits the public-API authorization gate its sibling read routes enforce (unauthenticated doc-existence + locale metadata disclosure) Medium Risk 5.3 3 hours ago 3 hours ago
@apostrophecms/import-export ApostropheCMS import-export: NoSQL injection via update-key value lets a crafted import match and overwrite an unidentified document Medium Risk 5.4 3 hours ago 3 hours ago
apostrophe ApostropheCMS: Authenticated Object-Level Authorization Bypass in exist-in-locale Reveals Restricted Localized Draft Identifiers Medium Risk 4.3 3 hours ago 3 hours ago
apostrophe ApostropheCMS: Same-parent page reorder in @apostrophecms/page move() re-ranks a restricted parent's children without create authorization Medium Risk 4.3 3 hours ago 3 hours ago
@apostrophecms/form ApostropheCMS: CAPTCHA response token not URL-encoded Medium Risk 6.0 3 hours ago 3 hours ago
@apostrophecms/login-hcaptcha ApostropheCMS: CAPTCHA response token not URL-encoded Medium Risk 6.0 3 hours ago 3 hours ago
@apostrophecms/login-recaptcha ApostropheCMS: CAPTCHA response token not URL-encoded Medium Risk 6.0 3 hours ago 3 hours ago
@apostrophecms/form ApostropheCMS: Unauthenticated unbounded multipart upload → disk-exhaustion DoS Medium Risk 5.3 3 hours ago 3 hours ago
apostrophe ApostropheCMS: Cross-domain session token in URL confers session takeover Medium Risk 6.0 3 hours ago 3 hours ago
@apostrophecms/passport-bridge ApostropheCMS: Cross-domain session token in URL confers session takeover Medium Risk 6.0 3 hours ago 3 hours ago
apostrophe ApostropheCMS: Authenticated projection-exclusion prototype-member deletion in @apostrophecms/db-connect causes process-wide denial of service High Risk 7.1 3 hours ago 3 hours ago
@apostrophecms/db-connect ApostropheCMS: Authenticated projection-exclusion prototype-member deletion in @apostrophecms/db-connect causes process-wide denial of service High Risk 7.1 3 hours ago 3 hours ago
apostrophe ApostropheCMS: Unauthenticated CSV import requests leave rejected uploads in the system temporary directory High Risk 7.5 3 hours ago 3 hours ago
@apostrophecms/cli @apostrophecms/cli: Command Injection in apos create via Unsanitized Password Input Medium Risk 6.5 5 months ago 1 month ago
apostrophe ApostropheCMS: Missing destination-parent authorization in page `move()` allows a low-privileged editor to move and re-rank pages inside a restricted subtree Medium Risk 6.5 1 month ago 1 month ago
apostrophe ApostropheCMS: 2nd-order prototype pollution via PATCH leading to single-request persistent DoS High Risk 8.0 1 month ago 1 month ago
@apostrophecms/import-export ApostropheCMS: Arbitrary file read via import-export attachment-name path traversal Medium Risk 6.5 1 month ago 1 month ago
apostrophe @apostrophecms/file pretty-URL Vulnerable to Unauthenticated SSRF via Host header Low Risk 3.7 2 months ago 2 months ago
apostrophe Apostrophe has Server-Side Prototype Pollution in apos.util.set via patch operators that leads to process-wide authorization bypass Critical 9.1 2 months ago 2 months ago
@apostrophecms/seo @apostrophecms/seo Vulnerable to Stored XSS via Unsanitized Google Analytics / GTM ID Injected into Script Tag High Risk 8.7 2 months ago 2 months ago
apostrophe Apostrophe has a Weak Password Recovery Mechanism for Forgotten Password and Improper Input Validation High Risk 8.1 5 months ago 4 months ago
apostrophe Apostrophe has stored XSS via javascript: URL in Image Widget Link High Risk 7.3 5 months ago 4 months ago
apostrophe Apostrophe has authenticated SSRF in rich-text widget import via @apostrophecms/area/validate-widget High Risk 7.6 5 months ago 4 months ago
apostrophe Stored XSS in SEO Fields Leads to Authenticated API Data Exposure in ApostropheCMS High Risk 8.7 6 months ago 5 months ago
apostrophe ApostropheCMS: User Enumeration via Timing Side Channel in Password Reset Endpoint Low Risk 3.7 6 months ago 6 months ago
apostrophe ApostropheCMS: Stored XSS via CSS Custom Property Injection in @apostrophecms/color-field Escaping Style Tag Context Medium Risk 5.4 6 months ago 6 months ago
apostrophe ApostropheCMS: Information Disclosure via choices/counts Query Parameters Bypassing publicApiProjection Field Restrictions Medium Risk 5.3 6 months ago 6 months ago
apostrophe ApostropheCMS: publicApiProjection Bypass via project Query Builder in Piece-Type REST API Medium Risk 5.3 6 months ago 6 months ago
apostrophe ApostropheCMS MFA/TOTP Bypass via Incorrect MongoDB Query in Bearer Token Middleware High Risk 8.1 7 months ago 7 months ago
@apostrophecms/import-export ApostropheCMS has Arbitrary File Write (Zip Slip / Path Traversal) in Import-Export Gzip Extraction Critical 9.9 7 months ago 7 months ago
apostrophe Cross-site Scripting in apostrophe Medium Risk 5.4 4 years ago 2 years ago
apostrophe Apostrophe CMS Insufficient Session Expiration vulnerability Critical 9.8 4 years ago 2 years ago
apostrophe Open Redirect in apostrophe Medium Risk 6.0 6 years ago 5 years ago
apostrophe Denial of Service in apostrophe Low Risk 3.0 6 years ago 6 years ago
Data courtesy of OSV.dev
Page 1