CVE-2026-55414 NL Portal Backend Libraries: Unauthenticated form resolver forwards the privileged Objecten-API token to a caller-supplied URL (SSRF)

NL Portal Backend Libraries provide backend components for Dutch government portals that interact with residents, customers, suppliers, and partner organizations. From 1.1.0 until 3.0.4, and in 3.1.0, the public getFormDefinitionByObjectenApiUrl and deprecated getFormDefinitionById GraphQL...

CVE-2026-55414

The NL Portal Backend Libraries are vulnerable to a Server-Side Request Forgery (SSRF) due to unauthenticated GraphQL resolvers, getFormDefinitionByObjectenApiUrl and getFormDefinitionById, forwarding a caller-influenced URL. These resolvers lack CommonGroundAuthentication and forward the privile...

CVE-2026-55414 NL Portal Backend Libraries: Unauthenticated form resolver forwards the privileged Objecten-API token to a caller-supplied URL (SSRF)

NL Portal Backend Libraries provide backend components for Dutch government portals that interact with residents, customers, suppliers, and partner organizations. From 1.1.0 until 3.0.4, and in 3.1.0, the public getFormDefinitionByObjectenApiUrl and deprecated getFormDefinitionById GraphQL...

CVE-2026-54683

The NL Portal Backend Libraries are vulnerable to an authorization bypass in the nl.nl-portal:documenten-api component (versions prior to 3.0.3 ). The flaw allows any authenticated user to retrieve the contents of any document without verifying ownership or an authorized relationship. This occurs...

CVE-2026-54683 NL Portal Backend Libraries: Document contents remained downloadable by any logged-in user until 3.0.3 (incomplete fix of CVE-2026-49463)

NL Portal Backend Libraries provide backend components for Dutch government portals that interact with residents, customers, suppliers, and partner organizations. Prior to 3.0.3, both the getDocumentContent GraphQL query and GET /api/documentapi/documentapi/document/documentId/content REST route...

PYSEC-2026-4302 Strawberry legacy graphql-ws retains naturally completed subscription slots

Summary Strawberry's legacy graphql-ws subscription handler can retain task and subscription bookkeeping after a one-shot subscription has naturally sent its complete message. When the application configures maxsubscriptionsperconnection, the handler counts those completed operations in...

PYSEC-2026-4303 Strawberry GraphQL: Synchronous permission checks can treat an awaitable authorization result as truthy

Summary PermissionExtension.resolve evaluates the return value of haspermission for truthiness on the synchronous path. supportssync only classifies a permission as asynchronous when haspermission is declared with async def via inspect.iscoroutinefunction, so a plain def that returns an awaitable...

ROOT-APP-PYPI-CVE-2026-107728 CVE-2026-107728 in strawberry-graphql - Patched by Root

Root has patched CVE-2026-107728 in the strawberry-graphql package for Root:PyPI. Multiple fixed versions available...

GitLab 19.2 < 19.2.8 / 19.3 < 19.3.5 / 19.4 < 19.4.2 (CVE-2026-85529)

The version of GitLab installed on the remote host is affected by a vulnerability, as follows: - GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.2 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an...

CVE-2026-93637

An authentication rate-limit bypass in Zimbra Collaboration Suite 10.1.0 through 10.1.21 allows unauthenticated attackers to make repeated password guesses through GraphQL without incrementing Zimbra’s source-IP failure counter. GraphQL aliases allow multiple authentication attempts in one HTTP...

CVE-2026-93637

CVE-2026-93637 is an authentication rate-limit bypass in Zimbra Collaboration Suite versions 10.1.0 through 10.1.21 . The vulnerability exists because the GraphQL extension processes authentication requests through a path that bypasses the SoapEngine 's failure handling logic. Consequently, faile...

CVE-2026-93637 Zimbra Collaboration Suite GraphQL Batched Authentication Bypasses Pre-Auth Rate Limiting

An authentication rate-limit bypass in Zimbra Collaboration Suite 10.1.0 through 10.1.21 allows unauthenticated attackers to make repeated password guesses through GraphQL without incrementing Zimbra’s source-IP failure counter. GraphQL aliases allow multiple authentication attempts in one HTTP...

EUVD-2026-101460

An authentication rate-limit bypass in Zimbra Collaboration Suite 10.1.0 through 10.1.21 allows unauthenticated attackers to make repeated password guesses through GraphQL without incrementing Zimbra’s source-IP failure counter. GraphQL aliases allow multiple authentication attempts in one HTTP...

From One Account to Every Mailbox: Breaking Zimbra's Identity Boundaries (Part 1)

An enterprise mail server authenticates users, stores private communications, delivers recovery links, runs calendars, and sends mail that employees and other systems trust. Compromising it can therefore expose both email and the identities and workflows built around it. During a broader assessme...

ROOT-APP-NPM-CVE-2026-104852 CVE-2026-104852 in @graphql-tools/utils - Patched by Root

Root has patched CVE-2026-104852 in the @graphql-tools/utils package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2026-103921 CVE-2026-103921 in @graphql-tools/executor-legacy-ws - Patched by Root

Root has patched CVE-2026-103921 in the @graphql-tools/executor-legacy-ws package for Root:npm. Multiple fixed versions available...

CVE-2026-93637: Improper Restriction of Excessive Authentication Attempts

An authentication rate-limit bypass in Zimbra Collaboration Suite 10.1.0 through 10.1.21 allows unauthenticated attackers to make repeated password guesses through GraphQL without incrementing Zimbra’s source-IP failure counter. GraphQL aliases allow multiple authentication attempts in one HTTP...

CVE-2026-110210 Phase Console through 2.77.3 Missing Authorization via secretHistory GraphQL Query

Phase Console through 2.77.3 contains a missing authorization vulnerability that allows organisation members without Secrets read permission to read secret history via the secretHistory GraphQL query. Attackers holding an environment key can supply a known secret identifier to retrieve encrypted...

CVE-2026-85529

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.2 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an unauthenticated user to read internal notes and confidential system notes on public projects due to...

CVE-2026-85529

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.2 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an unauthenticated user to read internal notes and confidential system notes on public projects due to...