{
 "version": "https://jsonfeed.org/version/1.1",
 "title": "@apostrophecms mport-export: all CVE events",
 "home_page_url": "https://patchwire.jonathanross.dev/products/apostrophecms--mport-export/",
 "feed_url": "https://patchwire.jonathanross.dev/feeds/products/apostrophecms--mport-export/all.json",
 "authors": [
  {
   "name": "Patchwire"
  }
 ],
 "language": "en",
 "items": [
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-112956/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-112956/",
   "title": "CVE-2026-112956 · apostrophecms apostrophe · disclosed",
   "content_text": "ApostropheCMS is an open-source Node.js content management system. Prior to 3.7.1 of the import-export module, duplicate-import continuation accepts client-controlled replacement choices without binding them to a user-owned server-side analysis or authorizing the canonical target. On an import-enabled localized type, a contributor with draft editing authority can cross the publication boundary by selecting a published document for replacement, although the current assessment is based on remediation review rather than a repeated end-to-end reproduction. This issue is fixed in version 3.7.1.",
   "date_published": "2026-10-20T15:57:27Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-112956/fixed/npm",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-112956/",
   "title": "CVE-2026-112956 · apostrophecms apostrophe · fixed upstream (npm)",
   "content_text": "Fixed versions: @apostrophecms/import-export 3.7.1.",
   "date_published": "2026-10-20T15:57:27Z"
  }
 ]
}