[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"repo-stars":3,"vuln-CVE-2026-44990":6},{"stargazers_count":4,"fetched_at":5},8,"2026-09-19T11:35:27.363Z",{"id":7,"descriptions":8,"cisa":9,"weaknesses":10,"exploits":44,"aliases":45,"duplicate_of":9,"upstream":47,"downstream":48,"duplicates":51,"related":52,"reserved_at":9,"published_at":54,"modified_at":55,"state":56,"summary":57,"references_raw":66,"kevs":226,"epss":227,"epss_history":230,"metrics":508,"affected":518},"CVE-2026-44990","ApostropheCMS is an open-source Node.js content management system, and sanitize-html provides a simple HTML sanitizer with a clear API. Under the default configuration, versions of `sanitize-html` prior to 2.17.4 can turn attacker-controlled content inside a disallowed `xmp` element into live HTML or JavaScript. This is a sanitizer bypass in the default `disallowedTagsMode: 'discard'` path and can lead to stored XSS in applications that render sanitized output back to users. Version 2.17.4 patches the issue.",null,[11],{"_key":12,"id":12,"name":13,"description":14,"type":15,"status":16,"abstraction":17,"likelihood_of_exploit":18,"capec":19},"CWE-79","Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.","weakness","Stable","Base","High",[20,24,28,32,36,40],{"id":21,"name":22,"techniques":23},"CAPEC-209","XSS Using MIME Type Mismatch",[],{"id":25,"name":26,"techniques":27},"CAPEC-588","DOM-Based XSS",[],{"id":29,"name":30,"techniques":31},"CAPEC-591","Reflected XSS",[],{"id":33,"name":34,"techniques":35},"CAPEC-592","Stored XSS",[],{"id":37,"name":38,"techniques":39},"CAPEC-63","Cross-Site Scripting (XSS)",[],{"id":41,"name":42,"techniques":43},"CAPEC-85","AJAX Footprinting",[],[],[46],"GHSA-rpr9-rxv7-x643",[],[49],{"_key":50},"OPENSUSE-SU-2026:11436-1",[],[53],{"_key":50},"2026-06-12T20:39:47.065Z","2026-09-10T12:05:09.696Z","Deferred",{"cisa_kev":58,"cisa_ransomware":58,"cisa_vendor":9,"epss_severity":59,"epss_score":60,"severity":61,"severity_score":62,"severity_version":63,"severity_source":64,"severity_vector":65,"severity_status":56},false,"low",0.00601,"critical",9.3,"v3.1","cve.org","CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N",[67,75,80,84,88,93,99,104,109,114,118,122,126,130,134,138,142,146,150,154,158,162,166,170,174,178,182,186,190,194,198,202,206,210,214,218,222],{"url":68,"sources":69,"tags":72},"https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-rpr9-rxv7-x643",[70,64,71],"osv_npm","nvd",[73,74],"WEB","X Refsource CONFIRM",{"url":76,"sources":77,"tags":78},"https://github.com/apostrophecms/apostrophe",[70],[79],"PACKAGE",{"url":81,"sources":82,"tags":83},"https://github.com/apostrophecms/apostrophe/issues/5418",[70],[73],{"url":85,"sources":86,"tags":87},"https://github.com/apostrophecms/apostrophe/commit/8d4c882b4ed3a7ce802cd87f89f0c1cb7482b8c2",[70],[73],{"url":89,"sources":90,"tags":91},"https://nvd.nist.gov/vuln/detail/CVE-2026-44990",[70],[92],"Advisory",{"url":94,"sources":95,"tags":96},"https://access.redhat.com/security/cve/CVE-2026-44990",[64,71],[97,98],"VDB Entry","X Refsource REDHAT",{"url":100,"sources":101,"tags":102},"https://bugzilla.redhat.com/show_bug.cgi?id=2488565",[64,71],[103,98],"Issue Tracking",{"url":105,"sources":106,"tags":107},"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-44990.json",[64,71],[108],"X Sadp Csaf Vex",{"url":110,"sources":111,"tags":112},"https://access.redhat.com/errata/RHSA-2026:36882",[64,71],[113,98],"Vendor Advisory",{"url":115,"sources":116,"tags":117},"https://access.redhat.com/errata/RHSA-2026:36883",[64,71],[113,98],{"url":119,"sources":120,"tags":121},"https://access.redhat.com/errata/RHSA-2026:40138",[64],[113,98],{"url":123,"sources":124,"tags":125},"https://access.redhat.com/errata/RHSA-2026:41031",[64,71],[113,98],{"url":127,"sources":128,"tags":129},"https://access.redhat.com/errata/RHSA-2026:41066",[64,71],[113,98],{"url":131,"sources":132,"tags":133},"https://access.redhat.com/errata/RHSA-2026:40262",[64,71],[113,98],{"url":135,"sources":136,"tags":137},"https://access.redhat.com/errata/RHSA-2026:40119",[64],[113,98],{"url":139,"sources":140,"tags":141},"https://access.redhat.com/errata/RHSA-2026:41064",[64,71],[113,98],{"url":143,"sources":144,"tags":145},"https://access.redhat.com/errata/RHSA-2026:41055",[64,71],[113,98],{"url":147,"sources":148,"tags":149},"https://access.redhat.com/errata/RHSA-2026:42146",[64,71],[113,98],{"url":151,"sources":152,"tags":153},"https://access.redhat.com/errata/RHSA-2026:42796",[64,71],[113,98],{"url":155,"sources":156,"tags":157},"https://access.redhat.com/errata/RHSA-2026:47737",[64,71],[113,98],{"url":159,"sources":160,"tags":161},"https://access.redhat.com/errata/RHSA-2026:46903",[64,71],[113,98],{"url":163,"sources":164,"tags":165},"https://access.redhat.com/errata/RHSA-2026:46685",[64,71],[113,98],{"url":167,"sources":168,"tags":169},"https://access.redhat.com/errata/RHSA-2026:46598",[64,71],[113,98],{"url":171,"sources":172,"tags":173},"https://access.redhat.com/errata/RHSA-2026:48124",[64,71],[113,98],{"url":175,"sources":176,"tags":177},"https://access.redhat.com/errata/RHSA-2026:43052",[64,71],[113,98],{"url":179,"sources":180,"tags":181},"https://access.redhat.com/errata/RHSA-2026:51349",[64,71],[113,98],{"url":183,"sources":184,"tags":185},"https://access.redhat.com/errata/RHSA-2026:51196",[64,71],[113,98],{"url":187,"sources":188,"tags":189},"https://access.redhat.com/errata/RHSA-2026:51197",[64,71],[113,98],{"url":191,"sources":192,"tags":193},"https://access.redhat.com/errata/RHSA-2026:46885",[64,71],[113,98],{"url":195,"sources":196,"tags":197},"https://access.redhat.com/errata/RHSA-2026:47735",[64,71],[113,98],{"url":199,"sources":200,"tags":201},"https://access.redhat.com/errata/RHSA-2026:57191",[64,71],[113,98],{"url":203,"sources":204,"tags":205},"https://access.redhat.com/errata/RHSA-2026:57194",[64,71],[113,98],{"url":207,"sources":208,"tags":209},"https://access.redhat.com/errata/RHSA-2026:59593",[64,71],[113,98],{"url":211,"sources":212,"tags":213},"https://access.redhat.com/errata/RHSA-2026:60386",[64,71],[113,98],{"url":215,"sources":216,"tags":217},"https://access.redhat.com/errata/RHSA-2026:60441",[64,71],[113,98],{"url":219,"sources":220,"tags":221},"https://access.redhat.com/errata/RHSA-2026:63103",[64,71],[113,98],{"url":223,"sources":224,"tags":225},"https://access.redhat.com/errata/RHSA-2026:63046",[64,71],[113,98],[],{"date":228,"score":60,"percentile":229},"2026-09-19",0.47434,[231,235,239,242,246,249,252,255,258,261,264,267,270,273,276,279,282,285,288,292,295,298,301,304,307,310,312,315,318,322,325,328,331,334,337,340,344,348,351,354,357,360,364,368,371,374,377,380,383,386,389,392,395,398,401,404,407,410,413,416,419,422,425,428,431,434,437,440,443,446,449,452,455,458,461,464,467,470,473,476,479,481,484,487,490,493,496,499,502,505],{"date":232,"score":233,"percentile":234},"2026-06-12",0.00064,0.2018,{"date":236,"score":237,"percentile":238},"2026-06-13",0.00012,0.01691,{"date":240,"score":237,"percentile":241},"2026-06-14",0.01698,{"date":243,"score":244,"percentile":245},"2026-06-15",0.00323,0.23831,{"date":247,"score":244,"percentile":248},"2026-06-16",0.23857,{"date":250,"score":244,"percentile":251},"2026-06-17",0.23875,{"date":253,"score":244,"percentile":254},"2026-06-18",0.23897,{"date":256,"score":244,"percentile":257},"2026-06-19",0.23889,{"date":259,"score":244,"percentile":260},"2026-06-20",0.23876,{"date":262,"score":244,"percentile":263},"2026-06-21",0.2386,{"date":265,"score":244,"percentile":266},"2026-06-22",0.23838,{"date":268,"score":244,"percentile":269},"2026-06-23",0.23906,{"date":271,"score":244,"percentile":272},"2026-06-24",0.23942,{"date":274,"score":244,"percentile":275},"2026-06-25",0.24021,{"date":277,"score":244,"percentile":278},"2026-06-26",0.24058,{"date":280,"score":244,"percentile":281},"2026-06-27",0.24099,{"date":283,"score":244,"percentile":284},"2026-06-28",0.24061,{"date":286,"score":244,"percentile":287},"2026-06-29",0.24063,{"date":289,"score":290,"percentile":291},"2026-06-30",0.0037,0.28788,{"date":293,"score":290,"percentile":294},"2026-07-01",0.28898,{"date":296,"score":290,"percentile":297},"2026-07-02",0.28921,{"date":299,"score":290,"percentile":300},"2026-07-03",0.28937,{"date":302,"score":290,"percentile":303},"2026-07-04",0.2895,{"date":305,"score":290,"percentile":306},"2026-07-05",0.28967,{"date":308,"score":290,"percentile":309},"2026-07-06",0.28975,{"date":311,"score":290,"percentile":309},"2026-07-07",{"date":313,"score":290,"percentile":314},"2026-07-08",0.28977,{"date":316,"score":290,"percentile":317},"2026-07-09",0.29021,{"date":319,"score":320,"percentile":321},"2026-07-10",0.00397,0.31853,{"date":323,"score":320,"percentile":324},"2026-07-11",0.31885,{"date":326,"score":320,"percentile":327},"2026-07-12",0.31877,{"date":329,"score":320,"percentile":330},"2026-07-13",0.31895,{"date":332,"score":320,"percentile":333},"2026-07-14",0.31919,{"date":335,"score":320,"percentile":336},"2026-07-15",0.31993,{"date":338,"score":320,"percentile":339},"2026-07-16",0.32027,{"date":341,"score":342,"percentile":343},"2026-07-17",0.00478,0.38158,{"date":345,"score":346,"percentile":347},"2026-07-18",0.00491,0.38964,{"date":349,"score":346,"percentile":350},"2026-07-19",0.38966,{"date":352,"score":346,"percentile":353},"2026-07-20",0.39036,{"date":355,"score":346,"percentile":356},"2026-07-21",0.39052,{"date":358,"score":346,"percentile":359},"2026-07-22",0.39277,{"date":361,"score":362,"percentile":363},"2026-07-23",0.0051,0.4042,{"date":365,"score":366,"percentile":367},"2026-07-24",0.00514,0.4068,{"date":369,"score":366,"percentile":370},"2026-07-25",0.4074,{"date":372,"score":366,"percentile":373},"2026-07-26",0.40729,{"date":375,"score":366,"percentile":376},"2026-07-27",0.40713,{"date":378,"score":366,"percentile":379},"2026-07-28",0.40768,{"date":381,"score":366,"percentile":382},"2026-07-29",0.40795,{"date":384,"score":366,"percentile":385},"2026-07-30",0.4087,{"date":387,"score":366,"percentile":388},"2026-07-31",0.40898,{"date":390,"score":366,"percentile":391},"2026-08-01",0.40907,{"date":393,"score":366,"percentile":394},"2026-08-02",0.40911,{"date":396,"score":366,"percentile":397},"2026-08-03",0.40918,{"date":399,"score":366,"percentile":400},"2026-08-04",0.40904,{"date":402,"score":366,"percentile":403},"2026-08-05",0.40889,{"date":405,"score":366,"percentile":406},"2026-08-06",0.40925,{"date":408,"score":366,"percentile":409},"2026-08-07",0.40967,{"date":411,"score":366,"percentile":412},"2026-08-08",0.40973,{"date":414,"score":366,"percentile":415},"2026-08-09",0.4096,{"date":417,"score":366,"percentile":418},"2026-08-10",0.40965,{"date":420,"score":366,"percentile":421},"2026-08-11",0.41048,{"date":423,"score":366,"percentile":424},"2026-08-12",0.41142,{"date":426,"score":366,"percentile":427},"2026-08-13",0.41176,{"date":429,"score":366,"percentile":430},"2026-08-14",0.41243,{"date":432,"score":366,"percentile":433},"2026-08-15",0.41362,{"date":435,"score":366,"percentile":436},"2026-08-16",0.41382,{"date":438,"score":366,"percentile":439},"2026-08-17",0.41347,{"date":441,"score":366,"percentile":442},"2026-08-18",0.41372,{"date":444,"score":366,"percentile":445},"2026-08-19",0.41576,{"date":447,"score":366,"percentile":448},"2026-08-20",0.4163,{"date":450,"score":366,"percentile":451},"2026-08-21",0.41664,{"date":453,"score":366,"percentile":454},"2026-08-22",0.4168,{"date":456,"score":366,"percentile":457},"2026-08-23",0.41556,{"date":459,"score":366,"percentile":460},"2026-08-24",0.41375,{"date":462,"score":366,"percentile":463},"2026-08-25",0.41412,{"date":465,"score":366,"percentile":466},"2026-08-26",0.41506,{"date":468,"score":366,"percentile":469},"2026-08-27",0.41557,{"date":471,"score":366,"percentile":472},"2026-08-28",0.41481,{"date":474,"score":366,"percentile":475},"2026-08-29",0.41522,{"date":477,"score":366,"percentile":478},"2026-08-30",0.41657,{"date":480,"score":366,"percentile":451},"2026-08-31",{"date":482,"score":366,"percentile":483},"2026-09-01",0.41696,{"date":485,"score":366,"percentile":486},"2026-09-02",0.41748,{"date":488,"score":366,"percentile":489},"2026-09-03",0.41773,{"date":491,"score":366,"percentile":492},"2026-09-04",0.41815,{"date":494,"score":366,"percentile":495},"2026-09-05",0.4174,{"date":497,"score":366,"percentile":498},"2026-09-06",0.41888,{"date":500,"score":366,"percentile":501},"2026-09-07",0.41895,{"date":503,"score":60,"percentile":504},"2026-09-08",0.46629,{"date":506,"score":60,"percentile":507},"2026-09-09",0.46787,[509,513,516],{"source":70,"cvss_v2_0":9,"cvss_v3_0":9,"cvss_v3_1":510,"cvss_v4_0":9},{"baseScore":62,"baseSeverity":9,"vectorString":65,"impactScore":511,"exploitabilityScore":512},9.7,7.2,{"source":64,"cvss_v2_0":9,"cvss_v3_0":9,"cvss_v3_1":514,"cvss_v4_0":9},{"baseScore":62,"baseSeverity":515,"vectorString":65,"impactScore":511,"exploitabilityScore":512},"CRITICAL",{"source":71,"cvss_v2_0":9,"cvss_v3_0":9,"cvss_v3_1":517,"cvss_v4_0":9},{"baseScore":62,"baseSeverity":515,"vectorString":65,"impactScore":511,"exploitabilityScore":512},[519,529],{"ecosystem":9,"name":520,"vendor":521,"product":520,"cpe_part":522,"purl_type":9,"purl_namespace":9,"purl_name":9,"source":9,"versions":523},"sanitize-html","apostrophecms","a",[524],{"version":525,"is_range":526,"range_type":64,"version_start":9,"version_start_type":9,"version_end":527,"version_end_type":528,"fixed_in":9},"\u003C 2.17.4",true,"2.17.4","excluding",{"ecosystem":530,"name":520,"vendor":530,"product":520,"cpe_part":9,"purl_type":531,"purl_namespace":9,"purl_name":520,"source":9,"versions":532},"Npm","npm",[533,538],{"version":534,"is_range":526,"range_type":535,"version_start":9,"version_start_type":9,"version_end":536,"version_end_type":537,"fixed_in":9},"lte2_17_3","semver","2.17.3","including",{"version":539,"is_range":526,"range_type":535,"version_start":536,"version_start_type":537,"version_end":527,"version_end_type":528,"fixed_in":9},"gte2_17_3_lt2_17_4"]