Security Operations
Threat Intelligence
🔎
❓

Threat Feed

Normalized, deduplicated intelligence. When several agencies report the same CVE, they are merged into one object showing all reporting sources.
DEMO MODE
MEDIUM
GHSA-97wv-p4xx-c7mg - ApostropheCMS import-export tar guard misses './..' because it is a literal '../' substring test
NEAR-REAL-TIME
CVE-2026-113664 · GitHub Security Advisories · published 2026-10-20T18:23
@apostrophecms
Source ↗
LOW
GHSA-gmfx-5g6x-rr72 - ApostropheCMS: Path traversal in uploadfs
NEAR-REAL-TIME
CVE-2026-113651 · GitHub Security Advisories · published 2026-10-20T18:21
uploadfs
Source ↗
LOW
GHSA-374f-7chj-9948 - ApostropheCMS sanitize-html: SMIL animation namespace-prefix bypass allows javascript: URI injection (XSS)
NEAR-REAL-TIME
CVE-2026-113657 · GitHub Security Advisories · published 2026-10-20T18:21 · correlated from 2 sources
sanitize-htmlRed Hat
Source ↗
MEDIUM
GHSA-hhph-8536-gfq5 - ApostropheCMS uploadfs Azure backend leaks account-level SAS token into every public attachment URL (sas: true)
NEAR-REAL-TIME
CVE-2026-113652 · GitHub Security Advisories · published 2026-10-20T18:20
uploadfs
Source ↗
MEDIUM
GHSA-vmxh-77cw-65j7 - ApostropheCMS: Authenticated Object-Level Authorization Bypass in exist-in-locale Reveals Restricted Localized Draft Identifiers
NEAR-REAL-TIME
CVE-2026-113660 · GitHub Security Advisories · published 2026-10-20T18:19
apostrophe
Source ↗
MEDIUM
GHSA-jqw5-w6h3-44g6 - ApostropheCMS import-export: NoSQL injection via update-key value lets a crafted import match and overwrite an unidentified document
NEAR-REAL-TIME
CVE-2026-113662 · GitHub Security Advisories · published 2026-10-20T18:19
@apostrophecms
Source ↗
MEDIUM
GHSA-m2m5-rw3w-cwmj - ApostropheCMS: Client-side Prototype Pollution in apos.http.parseQuery leading to DOM-based XSS against authenticated users
NEAR-REAL-TIME
CVE-2026-113659 · GitHub Security Advisories · published 2026-10-20T18:18
apostrophe
Source ↗
MEDIUM
GHSA-653j-g8j7-gh54 - ApostropheCMS: No Attempt Throttling on Authenticated Password-Change Endpoint Enables Unlimited Current-Password Guessing
NEAR-REAL-TIME
CVE-2026-113710 · GitHub Security Advisories · published 2026-10-20T18:17
apostrophe
Source ↗
MEDIUM
GHSA-cv27-6wvh-8x7j - ApostropheCMS: Incomplete CVE-2026-53606: `meta http-equiv=refresh` `content` still ships `javascript:` / `data:` URLs
NEAR-REAL-TIME
CVE-2026-113661 · GitHub Security Advisories · published 2026-10-20T18:15 · correlated from 2 sources
sanitize-htmlRed Hat
Source ↗
MEDIUM
GHSA-gqh3-7856-rjjg - ApostropheCMS: :_id/locales REST route omits the public-API authorization gate its sibling read routes enforce (unauthenticated doc-existence + locale metadata disclosure)
NEAR-REAL-TIME
CVE-2026-113668 · GitHub Security Advisories · published 2026-10-20T18:14
apostrophe
Source ↗
MEDIUM
GHSA-2j32-q6rx-h844 - ApostropheCMS: Page REST API authorization bypass
NEAR-REAL-TIME
CVE-2026-113670 · GitHub Security Advisories · published 2026-10-20T18:13
apostrophe
Source ↗
MEDIUM
GHSA-527g-ff96-x6wj - ApostropheCMS: Host header controls server-side image fetch origin in @apostrophecms/ai-helper, enabling authenticated SSRF
NEAR-REAL-TIME
CVE-2026-113671 · GitHub Security Advisories · published 2026-10-20T18:11
@apostrophecms
Source ↗
HIGH
GHSA-qhcq-9pm2-c9w9 - ApostropheCMS: Unauthenticated CSV import requests leave rejected uploads in the system temporary directory
NEAR-REAL-TIME
CVE-2026-113658 · GitHub Security Advisories · published 2026-10-20T18:10
apostrophe
Source ↗
MEDIUM
GHSA-hhvr-8m24-qqr3 - ApostropheCMS: Cross-domain session token in URL confers session takeover
NEAR-REAL-TIME
CVE-2026-113669 · GitHub Security Advisories · published 2026-10-20T18:09
apostrophe@apostrophecms
Source ↗
MEDIUM
GHSA-89mh-mm8c-mv7f - ApostropheCMS: Unauthenticated unbounded multipart upload → disk-exhaustion DoS
NEAR-REAL-TIME
CVE-2026-113656 · GitHub Security Advisories · published 2026-10-20T18:08
@apostrophecms
Source ↗
MEDIUM
GHSA-44qr-rrjg-2cqq - ApostropheCMS: CAPTCHA response token not URL-encoded
NEAR-REAL-TIME
CVE-2026-113667 · GitHub Security Advisories · published 2026-10-20T18:05
@apostrophecms
Source ↗
MEDIUM
GHSA-2jrp-qc93-h2j8 - ApostropheCMS: Same-parent page reorder in @apostrophecms/page move() re-ranks a restricted parent's children without create authorization
NEAR-REAL-TIME
CVE-2026-113655 · GitHub Security Advisories · published 2026-10-20T18:04
apostrophe
Source ↗
HIGH
GHSA-j5rq-xfvr-p969 - ApostropheCMS: Authenticated projection-exclusion prototype-member deletion in @apostrophecms/db-connect causes process-wide denial of service
NEAR-REAL-TIME
CVE-2026-113666 · GitHub Security Advisories · published 2026-10-20T18:03
@apostrophecmsapostrophe
Source ↗
MEDIUM
GHSA-x3q4-9hxx-gx8m - ApostropheCMS sanitize-html: nonTextTags discard region ends early on an implied close, letting <noscript> content render
NEAR-REAL-TIME
CVE-2026-113654 · GitHub Security Advisories · published 2026-10-20T18:03 · correlated from 2 sources
sanitize-htmlRed Hat
Source ↗
HIGH
GHSA-q3jh-wrc6-jgq8 - follow-redirects array-form headers bypass cross-origin credential stripping
NEAR-REAL-TIME
CVE-2026-111756 · GitHub Security Advisories · published 2026-10-20T17:58 · correlated from 2 sources
follow-redirectsRed Hat
Source ↗