CVE-2026-109302: Incorrect Authorization

Parse Server 8.2.2 before 8.6.94 and 9.0.0 before 9.10.1-alpha.14 applies its GraphQL introspection control only to operation text sent directly with a request, not to operations resolved from Apollo Server's automatic persisted query cache. Unauthenticated attackers holding the public Applicatio...

cn.vertxup:up-apollo (>=0.4.2, <=0.4.4), cn.vertxup:up-atlas (>=0.4.2, <=0.4.4) +45 more potentially affected by CVE-2026-107725 via com.hazelcast:hazelcast (3.9.1)

com.hazelcast:hazelcast MAVEN version 3.9.1 is affected by a known vulnerability. The following packages have a transitive dependency on com.hazelcast:hazelcast and may be impacted: - cn.vertxup:up-apollo =0.4.2, =0.4.2, =0.4.2, =0.4.2, =0.4.2, =0.4.2, =0.4.2, =0.4.2, =0.4.2, =0.4.2, =0.4.2,...

GHSA-6W6G-HM98-MHGM vulnerabilities

Vulnerabilities for packages: komodo, ntpd-rs, apollo-router, sccache, vector, linkerd2-proxy, shadowsocks-rust...

GHSA-5J98-2G5X-46V6 vulnerabilities

Vulnerabilities for packages: komodo, ntpd-rs, apollo-router, sccache, vector, linkerd2-proxy, shadowsocks-rust...

GHSA-6F2X-V7Q7-M7M5 vulnerabilities

Vulnerabilities for packages: komodo, ntpd-rs, apollo-router, sccache, vector, linkerd2-proxy, shadowsocks-rust...

WyreStorm Apollo VX20 Config Leak (CVE-2024-25735)

Exploits CVE-2024-25735 in WyreStorm Apollo VX20 1.3.58: unauthenticated GET /device/config exposes SoftAP router credentials in JSON. !/usr/bin/env python3 -- coding: utf-8 -- """WyreStorm Apollo VX20 config leak CVE-2024-25735.""" from kittysploit import from lib.protocols.http.httpclient impor...

apollo-sdk (>=0.1.1, <=0.1.6), bell-nozzle-master (1.0.8) +5 more potentially affected by CVE-2026-15307 via django (4.1.2)

django PYPI version 4.1.2 is affected by a known vulnerability. The following packages have a transitive dependency on django and may be impacted: - apollo-sdk =0.1.1, =3.11.6, =0.61.0, =0.62.0 Source cves: CVE-2026-15307 Source advisory: OSV:PYSEC-2026-4035...

CLSA-2026-1790706458 TuxCare security update for @apollo (1 CVE)

TuxCare rebuilt 2 @apollo packages to address 1 CVE. Fixed in 4.13.0-tuxcare.1...

PT-2026-109332

TuxCare rebuilt 2 @apollo packages to address 1 CVE. Fixed in 4.13.0-tuxcare.1...

ROOT-APP-NPM-CVE-2025-64530 CVE-2025-64530 in @apollo/composition - Patched by Root

Root has patched CVE-2025-64530 in the @apollo/composition package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-GHSA-M8JR-FXQX-8XX6 GHSA-m8jr-fxqx-8xx6 in @apollo/composition - Patched by Root

Root has patched GHSA-m8jr-fxqx-8xx6 in the @apollo/composition package for Root:npm. Multiple fixed versions available...

Malicious code in library-metalsmith-apollo-protractor (npm)

The package library-metalsmith-apollo-protractor was found to contain malicious code. --- Credit: OpenSSF source...

Malicious code in library-cassini-apollo-request (npm)

Source: amazon-inspector 80554e528c2a2f596f1e60989a7b44f1288d8ee48a9cbc1fb9477c1c18324a75 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in library-apollo-sagitta-relay (npm)

Source: amazon-inspector 2a145c3f36268692e8ce0afac7243096912fcd83420501e41bb6a4862e17a788 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in less-loader-stream-apollo-impulse (npm)

Source: amazon-inspector 8d4c3f57d021643f309881fcfec23ca4ac61c886fc4619fcba72039358590d00 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in kronos-apollo-changelog-eslint-plugin (npm)

Source: amazon-inspector 79df635064750b12fad3f8cd2dad32e8df6e3422782ac162ad599d7e8a5a5c1f This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in kinetic-module-apollo-pm2 (npm)

Source: amazon-inspector 4b5cb804d1f1fc283f2f095cb16ea1efc39e0c5c01069f6c181acce93aa56ff9 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in jwt-ursa-apollo-fornax (npm)

Source: amazon-inspector b147dcd87db56bc5a5d09342b9ed22ecc8341125e96639fec4258dca2c485025 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in json-apollo-rate-limiter-cross-env (npm)

Source: amazon-inspector 4041eaf381f192fe6b5f0fa41e0d62e7c44bdd9c3dca76d45a758c432e541b9f This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in jasmine-iota-apollo-postcss (npm)

Source: amazon-inspector abb148d7fe3af5383c5182391ac79de62170ac8d4404462c54639a8bc134a119 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...