The leading open source vulnerability database

Instantly mitigate vulnerabilities in WordPress websites with Patchstack.

See pricing
Rated 4.9
Total55,011
Mitigations18,239
Stats
CVSS0
10
Affected software | Vulnerability
RiskDisclosed
@modelcontextprotocol/sdk>= 1.24.0, < 1.32.0
NPM: MCP TypeScript SDK: Experimental tasks were not tied to the session that created them
8.6
13 minutes ago
@modelcontextprotocol/client>= 2.0.0, < 2.3.0
NPM: MCP TypeScript client SDK: HTTP client transports and OAuth requests followed cross-origin redirects and re-sent custom headers and request bodies
6.5
14 minutes ago
@modelcontextprotocol/sdk< 1.32.0
NPM: MCP TypeScript client SDK: HTTP client transports and OAuth requests followed cross-origin redirects and re-sent custom headers and request bodies
6.5
14 minutes ago
apostrophe< 4.33.0
NPM: ApostropheCMS: The general public can access @apostrophecms/user objects via a relationship (viewRole is not applied to the general public)
6.9
14 minutes ago
apostrophe< 4.33.0
NPM: ApostropheCMS: Missing Authorization on Notification PATCH/DELETE Endpoints
3.7
14 minutes ago
@apostrophecms/import-export< 3.7.0
NPM: ApostropheCMS import-export tar guard misses './..' because it is a literal '../' substring test
5.3
16 minutes ago
uploadfs< 1.28.0
NPM: ApostropheCMS: Path traversal in uploadfs
3.3
18 minutes ago
sanitize-html>= 2.17.7, < 2.18.0
NPM: ApostropheCMS sanitize-html: SMIL animation namespace-prefix bypass allows javascript: URI injection (XSS)
3.7
19 minutes ago
uploadfs>= 1.25.0, < 1.28.0
NPM: ApostropheCMS uploadfs Azure backend leaks account-level SAS token into every public attachment URL (sas: true)
5.6
19 minutes ago
apostrophe< 4.33.0
NPM: ApostropheCMS: Authenticated Object-Level Authorization Bypass in exist-in-locale Reveals Restricted Localized Draft Identifiers
4.3
20 minutes ago
@apostrophecms/import-export< 3.7.0
NPM: ApostropheCMS import-export: NoSQL injection via update-key value lets a crafted import match and overwrite an unidentified document
5.4
21 minutes ago
apostrophe< 4.33.0
NPM: ApostropheCMS: Client-side Prototype Pollution in apos.http.parseQuery leading to DOM-based XSS against authenticated users
6.1
21 minutes ago
apostrophe< 4.33.0
NPM: ApostropheCMS: No Attempt Throttling on Authenticated Password-Change Endpoint Enables Unlimited Current-Password Guessing
5.9
22 minutes ago
sanitize-html< 2.18.0
NPM: ApostropheCMS: Incomplete CVE-2026-53606: `meta http-equiv=refresh` `content` still ships `javascript:` / `data:` URLs
5.4
25 minutes ago
apostrophe< 4.33.0
NPM: ApostropheCMS: :_id/locales REST route omits the public-API authorization gate its sibling read routes enforce (unauthenticated doc-existence + locale metadata disclosure)
5.3
26 minutes ago
apostrophe< 4.33.0
NPM: ApostropheCMS: Page REST API authorization bypass
5.3
27 minutes ago
@apostrophecms/ai-helper>= 1.0.0-beta.10, < 1.0.0-beta.13
NPM: ApostropheCMS: Host header controls server-side image fetch origin in @apostrophecms/ai-helper, enabling authenticated SSRF
4.3
29 minutes ago
apostrophe< 4.33.0
NPM: ApostropheCMS: Unauthenticated CSV import requests leave rejected uploads in the system temporary directory
7.5
30 minutes ago
@apostrophecms/passport-bridge< 1.6.1
NPM: ApostropheCMS: Cross-domain session token in URL confers session takeover
5.3
31 minutes ago
apostrophe< 4.33.0
NPM: ApostropheCMS: Cross-domain session token in URL confers session takeover
5.3
31 minutes ago