CVE-2026-46515 Frogman: Multiple read-tier tools expose admin-grade data and arbitrary GraphQL execution

Frogman provides headless PBX control through MCP and HTTP API. Prior to 1.6.3, PERMREAD access was sufficient to call fmlistmanagers, fmlistpinsets, fmshowcontext, fmgetmcpconfig, fmbackupstatus, fmwhoscalling, fmrunsavedquery, and fmdiagnosetrunk, exposing AMI manager secrets, outbound dial PIN...

CVE-2026-46515

Frogman provides headless PBX control through MCP and HTTP API. Prior to 1.6.3, PERMREAD access was sufficient to call fmlistmanagers, fmlistpinsets, fmshowcontext, fmgetmcpconfig, fmbackupstatus, fmwhoscalling, fmrunsavedquery, and fmdiagnosetrunk, exposing AMI manager secrets, outbound dial PIN...

PT-2026-60570

Name of the Vulnerable Software and Affected Versions genql versions prior to 6.3.4 Description An authenticated attacker who can control the GraphQL schema passed to genql can inject arbitrary JavaScript or TypeScript. This malicious code is inserted into the generated schema.ts file and is...

CVE-2026-63397: Improper Encoding or Escaping of Output

remorses/genql before version 6.3.4 allows an authenticated attacker with control of the GraphQL schema that is passed to genql to inject arbitrary JavaScript or TypeScript. The malicious code is injected into the generated schema.ts file and executes when the genql client is bundled and imported...

PT-2026-76007

remorses/genql before version 6.3.4 allows an authenticated attacker with control of the GraphQL schema that is passed to genql to inject arbitrary JavaScript or TypeScript. The malicious code is injected into the generated schema.ts file and executes when the genql client is bundled and imported...

oxo v2.9.1

OXO Scan Orchestration Engine OXO is a security scanning framework built for modularity, scalability, and simplicity. OXO Engine combines specialized tools to work cohesively to find vulnerabilities and perform actions like recon, enumeration, and fingerprinting. Documentation Agents Store CLI...

MAL-2026-10487 Malicious code in @outsmartly/metaobjects (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9ede306bb744e7248af8ac267412edc6cb95f6720dc3fd6f6766b7c3ce915853 On import of the package main, dist/graphql-client.js constructs a singleton CustomGraphQLClient that takes the Shopify API URL built from the caller...

MLflow authenticated users can enumerate any registered model versions due to lack of per-model permissions checks

In mlflow/mlflow versions up to 3.9.0, the SearchModelVersions REST API endpoint and the mlflowSearchModelVersions GraphQL query lack proper per-model authorization checks when basic authentication is enabled. This allows any authenticated user to enumerate all model versions across all registere...

PYSEC-2026-2660 MLflow authenticated users can enumerate any registered model versions due to lack of per-model permissions checks

In mlflow/mlflow versions up to 3.9.0, the SearchModelVersions REST API endpoint and the mlflowSearchModelVersions GraphQL query lack proper per-model authorization checks when basic authentication is enabled. This allows any authenticated user to enumerate all model versions across all registere...

kedro-azureml (0.9.0), kedro-graphql (>=1.1.0, <=1.5.1) +4 more potentially affected by CVE-2026-111170 +1 more via kedro-datasets (7.0.0)

kedro-datasets PYPI version 7.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on kedro-datasets and may be impacted: - kedro-azureml 0.9.0 - kedro-graphql =1.1.0, =0.12.2, =0.7.0, =0.1.0, =0.1.3 Source cves: CVE-2026-111170, CVE-2026-35492 Source...

kedro-graphql (>=0.1.2, <=0.4.0), kedro-snowflake (>=0.1.0, <=0.1.1) potentially affected by CVE-2026-111170 +1 more via kedro-datasets (1.2.0)

kedro-datasets PYPI version 1.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on kedro-datasets and may be impacted: - kedro-graphql =0.1.2, =0.1.0, =0.1.1 Source cves: CVE-2026-111170, CVE-2026-35492 Source advisory: OSV:PYSEC-2026-2545...

dbt-duckdb-kedro-datasets (>=0.1.0, <=0.1.2), kedro-graphql (>=0.5.0, <=0.5.1) +1 more potentially affected by CVE-2026-111170 +1 more via kedro-datasets (3.0.1)

kedro-datasets PYPI version 3.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on kedro-datasets and may be impacted: - dbt-duckdb-kedro-datasets =0.1.0, =0.5.0, =0.2.0, =0.3.0rc1 Source cves: CVE-2026-111170, CVE-2026-35492 Source advisory:...

BIT-GITLAB-2026-6352 Incorrect Authorization in GitLab

GitLab has remediated an issue in GitLab EE affecting all versions from 18.2 before 18.11.7, 19.0 before 19.0.4, and 19.1 before 19.1.2 that under certain conditions could have allowed an authenticated user with auditor-level access to modify compliance violation records due to improper...

PT-2026-58989

Description A JWT issued to an Org 1 account is accepted on the Org 2 API and can read the admin-only GraphQL participantDetails field for an Org 2 participant. The same trust-boundary problem also affects API-user authentication: an Org 1 API user can use a JWT on the Org 1 host and replay that...

PT-2026-59309

In mlflow/mlflow versions up to 3.9.0, the SearchModelVersions REST API endpoint and the mlflowSearchModelVersions GraphQL query lack proper per-model authorization checks when basic authentication is enabled. This allows any authenticated user to enumerate all model versions across all registere...

GraphQL Introspection Abuse

Confirm GraphQL introspection, enumerate schema types/fields, and flag sensitive queries users, admin, secrets for follow-up exploitation. !/usr/bin/env python3 -- coding: utf-8 -- """ GraphQL introspection and lightweight abuse probe. Runs full introspection when enabled, surfaces sensitive...

K000162179: Spring for GraphQL vulnerability CVE-2026-41700

Security Advisory Description Spring for GraphQL applications that have enabled the WebSocket transport are vulnerable to Cross-Site WebSocket Hijacking. An attacker can trick an authenticated user into visiting a malicious page, allowing the attacker to execute arbitrary GraphQL operations with...

K000162177: Spring Framework vulnerability CVE-2026-41699

Security Advisory Description Spring for GraphQL applications are vulnerable to Unsafe Deserialization when processing paginated GraphQL queries. An attacker can craft a malicious GraphQL request that can lead to Remote Code Execution when the application exposes a paginated Connection field and...

ROOT-APP-PYPI-CVE-2026-47706 CVE-2026-47706 in rootio-strawberry-graphql - Patched by Root

Root has patched CVE-2026-47706 in the rootio-strawberry-graphql package for Root:PyPI. Multiple fixed versions available...

ROOT-APP-PYPI-CVE-2026-47707 CVE-2026-47707 in rootio-strawberry-graphql - Patched by Root

Root has patched CVE-2026-47707 in the rootio-strawberry-graphql package for Root:PyPI. Multiple fixed versions available...