https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2026-40186.htmlhttps://patchthecve.com/cve/CVE-2026-40186.htmlMon, 26 Oct 2026 21:10:00 +0000MEDIUM 6.1: ApostropheCMS is an open-source Node.js content management system. A regression introduced in commit 49d0bb7, included in versions 2.17.1 of the ApostropheCMS-maintained sanitize-html package bypasses allowedTags enforcement for text inside nonTextTagsArray elements (textarea and option). Apostrophehttps://patchthecve.com/cve/CVE-2026-39857.htmlhttps://patchthecve.com/cve/CVE-2026-39857.htmlMon, 26 Oct 2026 22:10:00 +0000MEDIUM 5.3: ApostropheCMS is an open-source Node.js content management system. Versions 4.28.0 and prior contain an authorization bypass vulnerability in the choices and counts query parameters of the REST API, where these query builders execute MongoDB distinct() operations that bypass the publicApiProjection https://patchthecve.com/cve/CVE-2026-35569.htmlhttps://patchthecve.com/cve/CVE-2026-35569.htmlMon, 26 Oct 2026 22:10:00 +0000HIGH 8.7: ApostropheCMS is an open-source Node.js content management system. Versions 4.28.0 and prior contain a stored cross-site scripting vulnerability in SEO-related fields (SEO Title and Meta Description), where user-controlled input is rendered without proper output encoding into HTML contexts includinghttps://patchthecve.com/cve/CVE-2026-33889.htmlhttps://patchthecve.com/cve/CVE-2026-33889.htmlMon, 26 Oct 2026 22:10:00 +0000MEDIUM 5.4: ApostropheCMS is an open-source Node.js content management system. Versions 4.28.0 and prior contain a stored cross-site scripting vulnerability in the @apostrophecms/color-field module, where color values prefixed with -- bypass TinyColor validation intended for CSS custom properties, and the laundhttps://patchthecve.com/cve/CVE-2026-33888.htmlhttps://patchthecve.com/cve/CVE-2026-33888.htmlMon, 26 Oct 2026 21:10:00 +0000MEDIUM 5.3: ApostropheCMS is an open-source Node.js content management system. Versions 4.28.0 and prior contain an authorization bypass vulnerability in the getRestQuery method of the @apostrophecms/piece-type module, where the method checks whether a MongoDB projection has already been set before applying thehttps://patchthecve.com/cve/CVE-2026-33877.htmlhttps://patchthecve.com/cve/CVE-2026-33877.htmlMon, 26 Oct 2026 22:10:00 +0000LOW 3.7: ApostropheCMS is an open-source Node.js content management system. Versions 4.28.0 and prior contain a timing side-channel vulnerability in the password reset endpoint (/api/v1/@apostrophecms/login/reset-request) that allows unauthenticated username and email enumeration. When a user is not found, t