Exposição de ApostropheCMS

CMS

score de exposição

349

sites usam

em exploração

críticos

Análise Vexday

ApostropheCMS acumula 18 CVEs catalogadas, das quais 16 surgiram nos últimos 90 dias — sinal de aumento recente na atenção de pesquisadores à plataforma. Nenhuma das vulnerabilidades consta no catálogo KEV da CISA, mantendo a taxa de exploração ativa abaixo da média geral do catálogo, o que sugere ausência de exploração confirmada em ambiente real até o momento. O tipo de falha mais comum é CWE-79 (Cross-Site Scripting), e há 3 CVEs de severidade crítica que merecem atenção prioritária na esteira de correções. A CVE mais perigosa ativa atualmente, CVE-2026-33888, apresenta EPSS de 0,0051, indicando baixa probabilidade estimada de exploração iminente, embora o volume concentrado de novas vulnerabilidades recentes justifique monitoramento contínuo.

CVEs

18 resultados

CVE-2026-44990CRITICALApostrophe has default XSS via `xmp` raw-text passthrough in `sanitize-html`EPSS 0.5%CVE-2026-33888MEDIUMApostropheCMS: publicApiProjection Bypass via `project` Query Builder in Piece-Type REST APIEPSS 0.5%CVE-2026-39857MEDIUMInformation Disclosure via `choices`/`counts` Query Parameters Bypassing publicApiProjection Field RestrictionsEPSS 0.4%CVE-2026-32731CRITICALApostropheCMS has Arbitrary File Write (Zip Slip / Path Traversal) in Import-Export Gzip ExtractionEPSS 0.4%CVE-2026-42853MEDIUM@apostrophecms/cli: Command Injection in apos create via Unsanitized Password InputEPSS 0.4%CVE-2026-33877LOWApostropheCMS: User Enumeration via Timing Side Channel in Password Reset EndpointEPSS 0.4%CVE-2026-32730HIGHApostropheCMS MFA/TOTP Bypass via Incorrect MongoDB Query in Bearer Token MiddlewareEPSS 0.4%CVE-2026-35569HIGHApostropheCMS: Stored XSS in SEO Fields Leads to Authenticated API Data Exposure in ApostropheCMSEPSS 0.3%CVE-2026-45014MEDIUMApostrophe Vulnerable to Stored Cross-Site Scripting via Unsanitized User Display Name in Draft Version TooltipEPSS 0.3%CVE-2026-45013HIGHApostrophe has a Weak Password Recovery Mechanism for Forgotten Password and Improper Input ValidationEPSS 0.3%CVE-2026-53609CRITICALApostrophe has Server-Side Prototype Pollution in apos.util.set via patch operators that leads to process-wide authorization bypassEPSS 0.2%CVE-2026-40186MEDIUMApostropheCMS: sanitize-html allowedTags Bypass via Entity-Decoded Text in nonTextTags ElementsEPSS 0.2%CVE-2026-53607LOW@apostrophecms/file pretty-URL Vulnerable to Unauthenticated SSRF via Host headerEPSS 0.2%CVE-2026-45011HIGHApostrophe has stored XSS via javascript: URL in Image Widget LinkEPSS 0.2%CVE-2026-53608HIGH@apostrophecms/seo Vulnerable to Stored XSS via Unsanitized Google Analytics / GTM ID Injected into Script TagEPSS 0.2%CVE-2026-33889MEDIUMApostropheCMS: Stored XSS via CSS Custom Property Injection in `@apostrophecms/color-field` Escaping Style Tag ContextEPSS 0.2%CVE-2026-45012HIGHApostrophe has authenticated SSRF in rich-text widget import via @apostrophecms/area/validate-widgetEPSS 0.2%CVE-2026-53606MEDIUMsanitize-html has an incomplete URI scheme validation that allows javascript: URIs through action, formaction, data, poster, and background attributesEPSS 0.1%