GraphCrawler

GraphCrawler THE GraphQL automated testing tookit Graph Crawler is the most powerful automated testing toolkit for any GraphQL endpoint. Version 1.2 is out!! NEW: Can search for endpoints for you using Escape Technology's powerful Graphinder tool. Just point it towards a domain and add the '-e'...

BIT-PARSE-2026-109302 Parse Server 8.2.2 before 8.6.94 and 9.0.0 before 9.10.1 GraphQL Schema Disclosure via Persisted Queries

Parse Server 8.2.2 before 8.6.94 and 9.0.0 before 9.10.1 applies its GraphQL introspection control only to operation text sent directly with a request, not to operations resolved from Apollo Server's automatic persisted query cache. Unauthenticated attackers holding the public Application Id and...

CVE-2026-109302

Parse Server 8.2.2 before 8.6.94 and 9.0.0 before 9.10.1-alpha.14 applies its GraphQL introspection control only to operation text sent directly with a request, not to operations resolved from Apollo Server's automatic persisted query cache. Unauthenticated attackers holding the public Applicatio...

CVE-2026-109302

Parse Server 8.2.2 before 8.6.94 and 9.0.0 before 9.10.1-alpha.14 applies its GraphQL introspection control only to operation text sent directly with a request, not to operations resolved from Apollo Server's automatic persisted query cache. Unauthenticated attackers holding the public Applicatio...

CVE-2026-109302 Parse Server 8.2.2 before 8.6.94 and 9.0.0 before 9.10.1-alpha.14 GraphQL Schema Disclosure via Persisted Queries

Parse Server 8.2.2 before 8.6.94 and 9.0.0 before 9.10.1-alpha.14 applies its GraphQL introspection control only to operation text sent directly with a request, not to operations resolved from Apollo Server's automatic persisted query cache. Unauthenticated attackers holding the public Applicatio...

CVE-2026-109302: Incorrect Authorization

Parse Server 8.2.2 before 8.6.94 and 9.0.0 before 9.10.1-alpha.14 applies its GraphQL introspection control only to operation text sent directly with a request, not to operations resolved from Apollo Server's automatic persisted query cache. Unauthenticated attackers holding the public Applicatio...

Malicious code in cdo-apollo-server (npm)

The package cdo-apollo-server was found to contain malicious code. --- Credit: OpenSSF source...

ROOT-APP-NPM-CVE-2026-23897 CVE-2026-23897 in @apollo/server - Patched by Root

Root has patched CVE-2026-23897 in the @apollo/server package for Root:npm. Multiple fixed versions available...

Malicious code in apollo-server-terser-webpack-plugin-quantum (npm)

Source: amazon-inspector 242351a23e7cfbb27df8dcfbf0a3ce9e20b76ec9c4b6267b770b2fa7c8a05448 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Apollo Server GraphQL Introspection - Detect

Apollo Server GraphQL introspection was detected. !/usr/bin/env python3 -- coding: utf-8 -- """Apollo Server GraphQL introspection was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Apollo Server GraphQL...

ROOT-APP-NPM-GHSA-9Q82-XGWF-VJ6H GHSA-9q82-xgwf-vj6h in @rootio/apollo__server - Patched by Root

Root has patched GHSA-9q82-xgwf-vj6h in the @rootio/apolloserver package for Root:npm. Multiple fixed versions available...

WS-2020-0116

Apollo-server-lambda before 2.4.12 is vulnerable to Information Exposure. The package does not properly enforce validation rules when creating subscription servers, which includes a NoInstrospection rule for the Websocket. This leaks the GraphQL schema types, their relations and human-readable...

8base-cli (>=0.0.80, <=0.0.90), @awoyotoyin/ts-graphql-yoga-express-starter (1.0.0) +133 more potentially affected by unknown CVE via apollo-server-lambda (>=1.3.2, <=2.11.0)

apollo-server-lambda NPM version =1.3.2, =0.0.80, =0.1.0-latest.30e51283, =0.1.0, =0.1.1, =1.0.0, =0.0.1-beta, =1.0.0, =1.7.0, =0.0.4, =0.0.1, =0.0.1-alpha.13, =0.0.1-alpha.12, =0.0.1-alpha.12.5 and more Source cves: unknown CVE Source advisory: MEND:WS-2020-0116...

WS-2020-0115

Apollo-server-micro before 2.4.12 is vulnerable to Information Exposure. The package does not properly enforce validation rules when creating subscription servers, which includes a NoInstrospection rule for the Websocket. This leaks the GraphQL schema types, their relations and human-readable nam...

codelift (>=0.6.3-canary.85.acbf24c.0, <=1.0.15-canary.394.652cc97.0), graphql-server-micro (>=1.0.2, <=1.4.1) +8 more potentially affected by unknown CVE via apollo-server-micro (>=1.4.0, <=2.14.1)

apollo-server-micro NPM version =1.4.0, =0.6.3-canary.85.acbf24c.0, =1.0.2, =1.0.0, =1.0.0, =2.0.0, =1.5.8, =0.1.0, =0.1.0, =1.0.0-rc.3, =1.0.0-rc.5 Source cves: unknown CVE Source advisory: MEND:WS-2020-0115...

WS-2020-0114

Apollo-server-koa before 2.4.12 is vulnerable to Information Exposure. The package does not properly enforce validation rules when creating subscription servers, which includes a NoInstrospection rule for the Websocket. This leaks the GraphQL schema types, their relations and human-readable names...

@axelspringer/mango-api (>=0.0.1-alpha, <=1.0.0-beta.75), @carlosbajo/graphql-gateway (>=1.2.0, <=2.4.62) +49 more potentially affected by unknown CVE via apollo-server-koa (>=1.3.6, <=2.9.12)

apollo-server-koa NPM version =1.3.6, =0.0.1-alpha, =1.2.0, =2.8.1, =2.4.8, =0.2.1, =0.5.1, =0.2.1, =0.5.1, =0.2.6, =0.1.2, =0.1.6, =0.3.10, =0.3.10, =6.1.0, =1.0.1, =1.0.2 and more Source cves: unknown CVE Source advisory: MEND:WS-2020-0114...

WS-2020-0113

Apollo-server-hapi before 2.4.12 is vulnerable to Information Exposure. The package does not properly enforce validation rules when creating subscription servers, which includes a NoInstrospection rule for the Websocket. This leaks the GraphQL schema types, their relations and human-readable name...

@bakjs/graphql (>=2.0.0, <=2.2.0), @clevyr/pavo-hapi-graphql (>=0.0.1, <=0.0.5) +14 more potentially affected by unknown CVE via apollo-server-hapi (>=1.2.0, <=1.4.0)

apollo-server-hapi NPM version =1.2.0, =2.0.0, =0.0.1, =0.1.0, =1.0.0, =0.0.51, =3.0.0, =1.0.2, =1.0.1, =0.2.2, =0.2.37 - trailpack-apollo 3.0.0-alpha.0 and more Source cves: unknown CVE Source advisory: MEND:WS-2020-0113...

WS-2020-0112

Apollo-server-fastify before 2.4.12 is vulnerable to Information Exposure. The package does not properly enforce validation rules when creating subscription servers, which includes a NoInstrospection rule for the Websocket. This leaks the GraphQL schema types, their relations and human-readable...