https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 01 Oct 2026 11:40:14 +0000 https://vulnerability.circl.lu/vuln/fkie_cve-2026-71553 <p>ApostropheCMS is an open-source Node.js content management system. In 4.32.0 and earlier, PATCH /api/v1/article/:id accepts the inherited path toString.call and passes it through the utility module to apos.util.set() and apos.util.get(), allowing an authenticated editor to overwrite the shared Object.prototype.toString function&#39;s call property and cause a persistent process-wide denial of service until restart.</p> <p>ApostropheCMS is an open-source Node.js content management system. In 4.32.0 and earlier, PATCH /api/v1/article/:id accepts the inherited path toString.call and passes it through the utility module to apos.util.set() and apos.util.get(), allowing an authenticated editor to overwrite the shared Object.prototype.toString function&#39;s call property and cause a persistent process-wide denial of service until restart.</p> https://vulnerability.circl.lu/vuln/fkie_cve-2026-71553 https://vulnerability.circl.lu/vuln/ghsa-vmg4-6gfg-83qx <p><strong>Affected:</strong> npm: apostrophe</p> <p>The vulnerability is a single-request persistent DoS by submitting e.g. &#34;PATCH /api/v1/article/&lt;id&gt;&#34; with a valid editor session and body of {&#34;toString.call&#34;:&#34;x&#34;}, overwriting the global toString function with value x.</p> <p>Fabian</p> <p><strong>Affected:</strong> npm: apostrophe</p> <p>The vulnerability is a single-request persistent DoS by submitting e.g. &#34;PATCH /api/v1/article/&lt;id&gt;&#34; with a valid editor session and body of {&#34;toString.call&#34;:&#34;x&#34;}, overwriting the global toString function with value x.</p> <p>Fabian</p> https://vulnerability.circl.lu/vuln/ghsa-vmg4-6gfg-83qx