A
Vendor security profile
apostrophecms
Product portfolio, patch evidence and exploitation signals in a single security scorecard
The data is combined from the CVE Program, NVD, CISA KEV and vendor security advisories.
Total CVEs7
Critical1
CISA KEV0
Public exploit3
Patch rate%43
Avg. CVSS6.6
12-month vulnerability rate
0
0
0
0
0
0
0
1
0
4
1
1
CVE KEV
CVE severity distribution
7toplam CVE
Critical1 (14%)
High1 (14%)
Medium5 (71%)
Patch and exploitation view
%43
Verified patch
%0
CISA KEV
%43
Public exploit
3Patch available
0Partial
0Workaround
0Vendor: no patch
4Unknown
Latest vulnerabilities
5.3
CVE-2026-110904
Incorrect authorization in ApostropheCMS
A
Patch status unknown
5.4
CVE-2026-84371
ApostropheCMS: Stored XSS via SVG SMIL URI-list scheme-policy bypass
A
Patch verifiedEPSS %0
7.1
CVE-2026-71553
ApostropheCMS: 2nd-order prototype pollution via PATCH leading to single-request persistent DoS
A
Patch status unknownEPSS %0
6.5
CVE-2026-63667
ApostropheCMS: Arbitrary file read via import-export attachment-name path traversal
A
Patch status unknownEPSS %0
6.1
CVE-2026-63670
ApostropheCMS: Mutation-XSS / allowedTags bypass via literal `</textarea/>` solidus close
A
Patch verifiedEPSS %0
6.5
CVE-2026-63669
ApostropheCMS: Missing destination-parent authorization in page `move()` allows a low-privileged editor to move and re-rank pages inside a restricted subtree
A
Patch verifiedEPSS %0
9.3
CVE-2026-44990
Apostrophe has default XSS via `xmp` raw-text passthrough in `sanitize-html`
A
Patch status unknownEPSS %1