CVE-2026-44840-poc

CVE-2026-44840 — PoC: Dgraph DQL Injection via checkUserPassword GraphQL Laboratorio Docker que reproduce una inyeccion real en Dgraph: Vulnerable : dgraph/dgraph:v25.3.3 Parcheado : dgraph/dgraph:v25.3.4 CVE real de 2026 · CVSS 3.1 7.5 High · CWE-943 Improper Neutralization in Data Query Logic ·...

CVE-2026-63460

Vendure is an open-source headless commerce platform. Prior to 3.6.5, the public Shop GraphQL API allows an unauthenticated caller to supply a catastrophically backtracking pattern through StringOperators.regex. packages/core/src/service/helpers/list-query-builder/parse-filter-params.ts passes th...

EUVD-2026-81667

Vendure is an open-source headless commerce platform. Prior to 3.6.5, the public Shop GraphQL API allows an unauthenticated caller to supply a catastrophically backtracking pattern through StringOperators.regex. packages/core/src/service/helpers/list-query-builder/parse-filter-params.ts passes th...

CVE-2025-55817

Vulnerability Type Cross Site Scripting XSS Affected Component The Connection Settings of the Nitro GraphQL by Chillicream, contain 3 different input locations vulnerable to Cross Site Scripting XSS. Vulnerable Parameters : SDL Schema Endpoint, Subscription Endpoint, SSE Subscription Endpoint...

Exploit for CVE-2026-44840

CVE-2026-44840 — PoC: Dgraph DQL Injection via checkUserPassw...

EUVD-2026-81294

Craft CMS 5.0.0-RC1 through versions before 5.11.0 incorrectly authorize the GraphQL draftCreator and revisionCreator fields: instead of requiring the user-data scope enforced by Gql::canQueryUsers usergroups.:read, these fields are gated only on the elements.drafts:read / elements.revisions:read...

CVE-2026-92594

Craft CMS 5.0.0-RC1 through versions before 5.11.0 incorrectly authorize the GraphQL draftCreator and revisionCreator fields: instead of requiring the user-data scope enforced by Gql::canQueryUsers usergroups.:read, these fields are gated only on the elements.drafts:read / elements.revisions:read...

CVE-2026-92594 Craft CMS before 5.11.0 Unauthenticated PII Disclosure via GraphQL

Craft CMS 5.0.0-RC1 through versions before 5.11.0 incorrectly authorize the GraphQL draftCreator and revisionCreator fields: instead of requiring the user-data scope enforced by Gql::canQueryUsers usergroups.:read, these fields are gated only on the elements.drafts:read / elements.revisions:read...

CVE-2026-92594 Craft CMS before 5.11.0 Unauthenticated PII Disclosure via GraphQL

Craft CMS 5.0.0-RC1 through versions before 5.11.0 incorrectly authorize the GraphQL draftCreator and revisionCreator fields: instead of requiring the user-data scope enforced by Gql::canQueryUsers usergroups.:read, these fields are gated only on the elements.drafts:read / elements.revisions:read...

CVE-2026-92594

Craft CMS versions 5.0.0-RC1 through before 5.11.0 contain an authorization flaw in the GraphQL API's draftCreator and revisionCreator fields. Instead of requiring the usergroups.*:read scope enforced by Gql::canQueryUsers(), these fields are gated only on elements.drafts:read or elements.revisio...

CVE-2026-92594 Craft CMS before 5.11.0 Unauthenticated PII Disclosure via GraphQL

Craft CMS 5.0.0-RC1 through versions before 5.11.0 incorrectly authorize the GraphQL draftCreator and revisionCreator fields: instead of requiring the user-data scope enforced by Gql::canQueryUsers usergroups.:read, these fields are gated only on the elements.drafts:read / elements.revisions:read...

CVE-2026-92774

Wiki.js through 2.5.314 omits page tags from authorization checks in multiple GraphQL resolvers, allowing tag-based access restrictions to be bypassed. Attackers can query the list, tree, tags, searchTags, and links resolvers to retrieve restricted page metadata including titles, descriptions,...

CVE-2026-92771

Twenty before 2.35.0 fails to validate field and row permissions in the groupBy-with-records GraphQL resolver, allowing authenticated users to bypass permission checks. Attackers with canReadObjectRecords permission but canReadFieldValue false can retrieve restricted field values through the...

CVE-2026-92774 Wiki.js through 2.5.314 Authorization Bypass via GraphQL Tag Omission

Wiki.js through 2.5.314 omits page tags from authorization checks in multiple GraphQL resolvers, allowing tag-based access restrictions to be bypassed. Attackers can query the list, tree, tags, searchTags, and links resolvers to retrieve restricted page metadata including titles, descriptions,...

CVE-2026-92774 Wiki.js through 2.5.314 Authorization Bypass via GraphQL Tag Omission

Wiki.js through 2.5.314 omits page tags from authorization checks in multiple GraphQL resolvers, allowing tag-based access restrictions to be bypassed. Attackers can query the list, tree, tags, searchTags, and links resolvers to retrieve restricted page metadata including titles, descriptions,...

EUVD-2026-81038

Wiki.js through 2.5.314 omits page tags from authorization checks in multiple GraphQL resolvers, allowing tag-based access restrictions to be bypassed. Attackers can query the list, tree, tags, searchTags, and links resolvers to retrieve restricted page metadata including titles, descriptions,...

CVE-2026-92774 Wiki.js through 2.5.314 Authorization Bypass via GraphQL Tag Omission

Wiki.js through 2.5.314 omits page tags from authorization checks in multiple GraphQL resolvers, allowing tag-based access restrictions to be bypassed. Attackers can query the list, tree, tags, searchTags, and links resolvers to retrieve restricted page metadata including titles, descriptions,...

CVE-2026-92774

Wiki.js through version 2.5.314 is affected by an authorization bypass in its GraphQL API. The root cause is the omission of page tags from authorization checks in multiple resolvers (list , tree , tags , searchTags , and links ), allowing attackers with low privileges to bypass tag-based access ...

CVE-2026-92771 Twenty before 2.35.0 Permission Bypass via groupBy-with-records Query

Twenty before 2.35.0 fails to validate field and row permissions in the groupBy-with-records GraphQL resolver, allowing authenticated users to bypass permission checks. Attackers with canReadObjectRecords permission but canReadFieldValue false can retrieve restricted field values through the...

CVE-2026-92771 Twenty before 2.35.0 Permission Bypass via groupBy-with-records Query

Twenty before 2.35.0 fails to validate field and row permissions in the groupBy-with-records GraphQL resolver, allowing authenticated users to bypass permission checks. Attackers with canReadObjectRecords permission but canReadFieldValue false can retrieve restricted field values through the...