Understand vulnerabilities. Protect your applications.

Nuxt: Route rules are matched against the raw request path, so a percent-encoded segment can bypass `appMiddleware` on dynamic and catch-all routes

ApostropheCMS: Stored XSS via Unescaped Widget Style Attribute Serialization

ApostropheCMS contains a stored cross-site scripting vulnerability where editor-controlled style field values in widgets are serialized into HTML wrapper attributes without escaping, allowing arbitrary script execution.

ApostropheCMS: Color field validation bypass allows stored XSS via HTML appended after rgb()/hsl() prefix

A stored cross-site scripting vulnerability in ApostropheCMS allows authenticated users with edit permissions to inject arbitrary HTML and JavaScript via trailing content in color fields. Upgrading to version 4.34.0 or later mitigates this issue.

ApostropheCMS import-export tar guard misses './..' because it is a literal '../' substring test

A substring check in ApostropheCMS import-export tar extraction fails to catch relative directory traversal paths, allowing authenticated users to crash the Node process.

ApostropheCMS: Client-side Prototype Pollution in apos.http.parseQuery leading to DOM-based XSS against authenticated users

A client-side prototype pollution vulnerability in ApostropheCMS allows attackers to execute arbitrary JavaScript in the context of an authenticated user session if the victim visits a crafted link, potentially leading to unauthorized data access and administrative compromise.

ApostropheCMS: No Attempt Throttling on Authenticated Password-Change Endpoint Enables Unlimited Current-Password Guessing

A lack of attempt throttling on ApostropheCMS's authenticated password-change endpoint allows attackers with an active session to repeatedly guess the current password without lockout or rate limiting, potentially enabling account takeover if the password is weak.

ApostropheCMS: Host header controls server-side image fetch origin in @apostrophecms/ai-helper, enabling authenticated SSRF

In @apostrophecms/ai-helper, an authenticated editor can supply a crafted Host header to control the server-side image fetch origin, enabling SSRF against internal hosts and ports.

ApostropheCMS: Unauthenticated Unbounded Multipart Upload Leading to Disk-Exhaustion DoS

Unauthenticated attackers can stream unbounded multipart request bodies to disk via form submission endpoints in ApostropheCMS, leading to disk space exhaustion and a denial-of-service condition.

ApostropheCMS sanitize-html: nonTextTags discard region ends early on an implied close, letting <noscript> content render

In sanitize-html prior to 2.18.0, an implied close within elements such as <noscript> causes discard regions to end early, allowing raw text content to be erroneously rendered as regular HTML elements.

@angular/platform-server: Open Redirect via Protocol-Relative URLs in Server-Side Rendering (SSR)

An open redirect vulnerability in Angular Server-Side Rendering allows unauthenticated attackers to supply crafted dot-segments that bypass URL checks and redirect users off-origin.

fast-jwt: Verifier cache accepts expired JWTs without iat.

fast-jwt clockTolerance: Infinity silently bypasses both exp and nbf validation (and persists in the verifier cache)

music-metadata: MP4 stsd sample-entry size==0 causes a synchronous infinite loop (DoS) — unreleased regression on master