PT-2025-50576

Name of the Vulnerable Software and Affected Versions GitLab EE versions 13.2 through 18.4.5 GitLab EE versions 18.5 through 18.5.3 GitLab EE versions 18.6 through 18.6.1 Description An authenticated user could potentially disclose sensitive information from private projects by executing...

Enjin: Unauthenticated GraphQL access by prepending __schema to private operations

A security vulnerability was identified in the GraphQL schema of the Enjin Platform. The vulnerability allowed unauthorized access to the GraphQL schema by prepending "schema" to private operations. The vulnerability was discovered and reported by a security researcher. The specific location of t...

Liferay Portal GraphQL Schema Detected

This is an informational plugin to inform the user that the scanner has detected that the target Liferay instance publicly exposes its GraphQL schema. No source data...

CVE-2025-9825

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 13.7 to 18.2.8, 18.3 before 18.3.4, and 18.4 before 18.4.2 that could have allowed authenticated users without project membership to view sensitive manual CI/CD variables by querying the GraphQL API...

CVE-2025-9825 Missing Authorization in GitLab

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 13.7 to 18.2.8, 18.3 before 18.3.4, and 18.4 before 18.4.2 that could have allowed authenticated users without project membership to view sensitive manual CI/CD variables by querying the GraphQL API...

RHEL 8 / 9 : Satellite 6.16.5.6 Async Update (Moderate) (RHSA-2025:21894)

The remote Redhat Enterprise Linux 8 / 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:21894 advisory. Red Hat Satellite is a system management solution that allows organizations to configure and maintain their systems without the necessity to...

foreman: Satellite: GraphQL API permission bypass leads to information disclosure

n authorization flaw in Foreman's GraphQL API allows low-privileged users to access metadata beyond their assigned permissions. Unlike the REST API, which correctly enforces access controls, the GraphQL endpoint does not apply proper filtering, leading to an authorization bypass...

foreman: Satellite: GraphQL API permission bypass leads to information disclosure

n authorization flaw in Foreman's GraphQL API allows low-privileged users to access metadata beyond their assigned permissions. Unlike the REST API, which correctly enforces access controls, the GraphQL endpoint does not apply proper filtering, leading to an authorization bypass...

The vulnerability of the GraphQL API interface of a software platform based on Git for collaborative code development on GitLab allows a hacker to gain read, modify, or delete access to data.

The vulnerability of the GraphQL API interface of the Git-based software development platform for collaborative code editing on GitLab is related to deficiencies in the authentication mechanism. Exploiting this vulnerability could allow an attacker to gain read, edit, or delete access to data...

The vulnerability of the GraphQL API interface of the software platform based on git for collaborative code development on GitLab allows a hacker to trigger a service failure.

The vulnerability of the GraphQL API interface of a software platform based on Git for collaborative code development on GitLab is related to unlimited resource distribution. Exploiting this vulnerability can allow an attacker, operating remotely, to cause service failures...

CVE-2025-56643

Requarks Wiki.js version 2.5.307 contains a vulnerability where active JWT tokens are not properly revoked or invalidated upon user logout. This flaw exists within the authentication resolver logic , specifically impacting the GraphQL endpoint and the logout mechanism (both UI and backend). Becau...

CVE-2025-2615

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 16.7 before 18.3.6, 18.4 before 18.4.4, and 18.5 before 18.5.2, that could have allowed a blocked user to access sensitive information by establishing GraphQL subscriptions through WebSocket connections...

CVE-2025-2615 Insertion of Sensitive Information Into Sent Data in GitLab

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 16.7 before 18.3.6, 18.4 before 18.4.4, and 18.5 before 18.5.2, that could have allowed a blocked user to access sensitive information by establishing GraphQL subscriptions through WebSocket connections...

GitLab 安全漏洞

GitLab is an open source, end-to-end software development platform from GitLab, Inc. with built-in version control, issue tracking, code review, CI/CD continuous integration and continuous delivery, and other features. A security vulnerability in GitLab CE and EE versions 16.7 through 18.3.6 prio...

EUVD-2025-111328

Malicious code in meissa-alphard-xanadu-graphql npm...

EUVD-2025-113115

Malicious code in graphql-chai-schema-elara npm...

EUVD-2025-113114

Malicious code in graphql-chakra-ui-luna-proxima npm...

The vulnerability of the GraphQL-API interface of the SuiteCRM customer relationship management system allows a perpetrator to gain unauthorized access to protected information.

The vulnerability of the GraphQL-API interface of the SuiteCRM customer relationship management system is related to the lack of measures taken to protect the SQL query structure. Exploiting this vulnerability can allow an attacker, operating remotely, to gain unauthorized access to protected...

This Week in Spring - November 10th, 2025

Hi, Spring fans! Welcome to another installment of This Week in Spring! As I write this I am preparing for a flight to North Carolina first in flight!. This week's going to be busy, but next week even busier still! I'll be at AI By The Bay in San Francisco, AI Native Dev Con in NYC, and QCon SF i...

PT-2025-45526

Name of the Vulnerable Software and Affected Versions SuiteCRM versions 8.6.0 through 8.9.0 Description SuiteCRM is an open-source, enterprise-ready Customer Relationship Management CRM software application. Versions 8.6.0 through 8.9.0 are susceptible to an authenticated, blind time-based...