CVE-2026-64627

Parse Server versions 9.0.0–8.6.84/9.0.0–9.10.0-alpha.3 contain a schema disclosure vulnerability where, when GraphQL public introspection is disabled, error messages during variable coercion reveal hidden schema identifiers (e.g., Cloud Code function names, Parse class/field names) to an unauthe...

oxo v2.9.7

OXO Scan Orchestration Engine OXO is a security scanning framework built for modularity, scalability, and simplicity. OXO Engine combines specialized tools to work cohesively to find vulnerabilities and perform actions like recon, enumeration, and fingerprinting. Documentation Agents Store CLI...

CVE-2026-47671: Missing Authentication for Critical Function

Nhost is an open source Firebase alternative with GraphQL. In versions of Nhost CLI prior to 1.46.0, the hidden nhost configserver used by nhost dev exposes the Mimir GraphQL API with dummy authorization directives and permissive CORS. When a developer is running the local development environment...

CVE-2026-64627: Generation of Error Message Containing Sensitive Information

Parse Server versions = 9.0.0 before 9.10.0-alpha.4 and versions before 8.6.85 contain a schema disclosure vulnerability. When the GraphQL API is mounted with public introspection disabled graphQLPublicIntrospection: false, the default, schema-derived 'Did you mean ...?' suggestions were still...

oxo v2.9.3

OXO Scan Orchestration Engine OXO is a security scanning framework built for modularity, scalability, and simplicity. OXO Engine combines specialized tools to work cohesively to find vulnerabilities and perform actions like recon, enumeration, and fingerprinting. Documentation Agents Store CLI...

K000162321: Spring Framework vulnerability CVE-2026-41699

Security Advisory Description Spring for GraphQL applications are vulnerable to Unsafe Deserialization when processing paginated GraphQL queries. An attacker can craft a malicious GraphQL request that can lead to Remote Code Execution when the application exposes a paginated Connection field and...

GHSA-W757-XVVV-VGFW Genql: inject arbitrary JavaScript or TypeScript via a GraphQL schema

remorses/genql before version 6.3.4 allows an authenticated attacker with control of the GraphQL schema that is passed to genql to inject arbitrary JavaScript or TypeScript. The malicious code is injected into the generated schema.ts file and executes when the genql client is bundled and imported...

Genql: inject arbitrary JavaScript or TypeScript via a GraphQL schema

remorses/genql before version 6.3.4 allows an authenticated attacker with control of the GraphQL schema that is passed to genql to inject arbitrary JavaScript or TypeScript. The malicious code is injected into the generated schema.ts file and executes when the genql client is bundled and imported...

com.arcadedb:arcadedb-coverage (23.7.1), com.arcadedb:arcadedb-graphql (23.7.1) +4 more potentially affected by CVE-2026-67342 via com.arcadedb:arcadedb-server (23.7.1)

com.arcadedb:arcadedb-server MAVEN version 23.7.1 is affected by a known vulnerability. The following packages have a transitive dependency on com.arcadedb:arcadedb-server and may be impacted: - com.arcadedb:arcadedb-coverage 23.7.1 - com.arcadedb:arcadedb-graphql 23.7.1 -...

com.arcadedb:arcadedb-coverage (24.10.1), com.arcadedb:arcadedb-graphql (24.10.1) +3 more potentially affected by CVE-2026-67342 via com.arcadedb:arcadedb-server (24.10.1)

com.arcadedb:arcadedb-server MAVEN version 24.10.1 is affected by a known vulnerability. The following packages have a transitive dependency on com.arcadedb:arcadedb-server and may be impacted: - com.arcadedb:arcadedb-coverage 24.10.1 - com.arcadedb:arcadedb-graphql 24.10.1 -...

com.arcadedb:arcadedb-coverage (25.4.1), com.arcadedb:arcadedb-graphql (25.4.1) +6 more potentially affected by CVE-2026-67342 via com.arcadedb:arcadedb-server (25.4.1)

com.arcadedb:arcadedb-server MAVEN version 25.4.1 is affected by a known vulnerability. The following packages have a transitive dependency on com.arcadedb:arcadedb-server and may be impacted: - com.arcadedb:arcadedb-coverage 25.4.1 - com.arcadedb:arcadedb-graphql 25.4.1 -...

com.arcadedb:arcadedb-coverage (24.5.1), com.arcadedb:arcadedb-graphql (24.5.1) +3 more potentially affected by CVE-2026-67342 via com.arcadedb:arcadedb-server (24.5.1)

com.arcadedb:arcadedb-server MAVEN version 24.5.1 is affected by a known vulnerability. The following packages have a transitive dependency on com.arcadedb:arcadedb-server and may be impacted: - com.arcadedb:arcadedb-coverage 24.5.1 - com.arcadedb:arcadedb-graphql 24.5.1 -...

com.arcadedb:arcadedb-coverage (24.4.1), com.arcadedb:arcadedb-graphql (24.4.1) +4 more potentially affected by CVE-2026-67342 via com.arcadedb:arcadedb-server (24.4.1)

com.arcadedb:arcadedb-server MAVEN version 24.4.1 is affected by a known vulnerability. The following packages have a transitive dependency on com.arcadedb:arcadedb-server and may be impacted: - com.arcadedb:arcadedb-coverage 24.4.1 - com.arcadedb:arcadedb-graphql 24.4.1 -...

com.arcadedb:arcadedb-coverage (24.2.1), com.arcadedb:arcadedb-graphql (24.2.1) +4 more potentially affected by CVE-2026-67342 via com.arcadedb:arcadedb-server (24.2.1)

com.arcadedb:arcadedb-server MAVEN version 24.2.1 is affected by a known vulnerability. The following packages have a transitive dependency on com.arcadedb:arcadedb-server and may be impacted: - com.arcadedb:arcadedb-coverage 24.2.1 - com.arcadedb:arcadedb-graphql 24.2.1 -...

com.arcadedb:arcadedb-coverage (23.12.1), com.arcadedb:arcadedb-graphql (23.12.1) +4 more potentially affected by CVE-2026-67342 via com.arcadedb:arcadedb-server (23.12.1)

com.arcadedb:arcadedb-server MAVEN version 23.12.1 is affected by a known vulnerability. The following packages have a transitive dependency on com.arcadedb:arcadedb-server and may be impacted: - com.arcadedb:arcadedb-coverage 23.12.1 - com.arcadedb:arcadedb-graphql 23.12.1 -...

com.arcadedb:arcadedb-coverage (22.1.2), com.arcadedb:arcadedb-graphql (22.1.2) +3 more potentially affected by CVE-2026-67342 via com.arcadedb:arcadedb-server (22.1.2)

com.arcadedb:arcadedb-server MAVEN version 22.1.2 is affected by a known vulnerability. The following packages have a transitive dependency on com.arcadedb:arcadedb-server and may be impacted: - com.arcadedb:arcadedb-coverage 22.1.2 - com.arcadedb:arcadedb-graphql 22.1.2 -...

com.arcadedb:arcadedb-coverage (21.12.1), com.arcadedb:arcadedb-graphql (21.12.1) +1 more potentially affected by CVE-2026-67342 via com.arcadedb:arcadedb-server (21.12.1)

com.arcadedb:arcadedb-server MAVEN version 21.12.1 is affected by a known vulnerability. The following packages have a transitive dependency on com.arcadedb:arcadedb-server and may be impacted: - com.arcadedb:arcadedb-coverage 21.12.1 - com.arcadedb:arcadedb-graphql 21.12.1 -...

com.arcadedb:arcadedb-coverage (22.1.1), com.arcadedb:arcadedb-graphql (22.1.1) +3 more potentially affected by CVE-2026-67342 via com.arcadedb:arcadedb-server (22.1.1)

com.arcadedb:arcadedb-server MAVEN version 22.1.1 is affected by a known vulnerability. The following packages have a transitive dependency on com.arcadedb:arcadedb-server and may be impacted: - com.arcadedb:arcadedb-coverage 22.1.1 - com.arcadedb:arcadedb-graphql 22.1.1 -...

com.arcadedb:arcadedb-coverage (23.2.1), com.arcadedb:arcadedb-graphql (23.2.1) +4 more potentially affected by CVE-2026-67342 via com.arcadedb:arcadedb-server (23.2.1)

com.arcadedb:arcadedb-server MAVEN version 23.2.1 is affected by a known vulnerability. The following packages have a transitive dependency on com.arcadedb:arcadedb-server and may be impacted: - com.arcadedb:arcadedb-coverage 23.2.1 - com.arcadedb:arcadedb-graphql 23.2.1 -...

com.arcadedb:arcadedb-bolt (>=26.2.1, <=26.7.1), com.arcadedb:arcadedb-graphql (>=26.1.1, <=26.7.1) +11 more potentially affected by CVE-2026-67342 via com.arcadedb:arcadedb-server (>=26.1.1, <=26.7.1)

com.arcadedb:arcadedb-server MAVEN version =26.1.1, =26.2.1, =26.1.1, =26.1.1, =26.1.1, =26.4.2, =26.1.1, =26.1.1, =26.1.1, =26.1.1, =26.1.1, =26.1.1, =26.5.1 - com.arcadedb:arcadedb-tracing 26.7.1 - io.github.mdre:adbogm 0.9.0.6 Source cves: CVE-2026-67342 Source advisory: OSV:GHSA-X8MG-6R4P-87P...