The leading open source vulnerability database

Instantly mitigate vulnerabilities in WordPress websites with Patchstack.

See pricing
Rated 4.9
Total54,997
Mitigations18,239
Stats
CVSS0
10
Affected software | Vulnerability
RiskDisclosed
apostrophe< 4.33.0
NPM: ApostropheCMS: :_id/locales REST route omits the public-API authorization gate its sibling read routes enforce (unauthenticated doc-existence + locale metadata disclosure)
5.3
1 minute ago
apostrophe< 4.33.0
NPM: ApostropheCMS: Page REST API authorization bypass
5.3
3 minutes ago
@apostrophecms/ai-helper>= 1.0.0-beta.10, < 1.0.0-beta.13
NPM: ApostropheCMS: Host header controls server-side image fetch origin in @apostrophecms/ai-helper, enabling authenticated SSRF
4.3
5 minutes ago
apostrophe< 4.33.0
NPM: ApostropheCMS: Unauthenticated CSV import requests leave rejected uploads in the system temporary directory
7.5
5 minutes ago
@apostrophecms/passport-bridge< 1.6.1
NPM: ApostropheCMS: Cross-domain session token in URL confers session takeover
5.3
7 minutes ago
apostrophe< 4.33.0
NPM: ApostropheCMS: Cross-domain session token in URL confers session takeover
5.3
7 minutes ago
@apostrophecms/form< 1.5.5
NPM: ApostropheCMS: Unauthenticated unbounded multipart upload → disk-exhaustion DoS
5.3
7 minutes ago
@apostrophecms/login-hcaptcha< 1.3.0
NPM: ApostropheCMS: CAPTCHA response token not URL-encoded
5.3
10 minutes ago
@apostrophecms/login-recaptcha< 1.2.1
NPM: ApostropheCMS: CAPTCHA response token not URL-encoded
5.3
10 minutes ago
@apostrophecms/form< 1.5.5
NPM: ApostropheCMS: CAPTCHA response token not URL-encoded
5.3
10 minutes ago
apostrophe< 4.33.0
NPM: ApostropheCMS: Same-parent page reorder in @apostrophecms/page move() re-ranks a restricted parent's children without create authorization
4.3
12 minutes ago
apostrophe< 4.33.0
NPM: ApostropheCMS: Authenticated projection-exclusion prototype-member deletion in @apostrophecms/db-connect causes process-wide denial of service
7.1
12 minutes ago
@apostrophecms/db-connect< 1.1.0
NPM: ApostropheCMS: Authenticated projection-exclusion prototype-member deletion in @apostrophecms/db-connect causes process-wide denial of service
7.1
12 minutes ago
sanitize-html< 2.18.0
NPM: ApostropheCMS sanitize-html: nonTextTags discard region ends early on an implied close, letting <noscript> content render
5.3
13 minutes ago
follow-redirects>= 1.16.0, < 1.16.1
NPM: follow-redirects array-form headers bypass cross-origin credential stripping
8.2
18 minutes ago
follow-redirects>= 1.16.0, < 1.16.1
NPM: follow-redirects sensitiveHeaders regex escaping can expose credential headers
8.2
23 minutes ago
@angular/router>= 21.2.0, < 21.2.25
NPM: @angular/router: Denial of Service via RouterLink Query Parameter Retention in Server-Side Rendering (SSR)
8.2
23 minutes ago
Participants Database<= 2.7.8.5
Insecure Direct Object References (IDOR) vulnerability
6.3
29 minutes ago
Profile Builder<= 4.0.3
Authenticated (Author+) Limited Privilege Escalation vulnerability
7.1
57 minutes ago
WP User Manager<= 2.9.25
Broken Access Control vulnerability
4.3
3 hours ago