CVE-2026-6352: Incorrect Authorization

GitLab has remediated an issue in GitLab EE affecting all versions from 18.2 before 18.11.7, 19.0 before 19.0.4, and 19.1 before 19.1.2 that under certain conditions could have allowed an authenticated user with auditor-level access to modify compliance violation records due to improper...

PT-2026-56602

Name of the Vulnerable Software and Affected Versions OpenCTI versions prior to 7.260401.0 Description The GraphQL API exposes a script filter operator within its FilterOperator enum. This allows authenticated users with the KNOWLEDGE capability to submit Elasticsearch Painless script values into...

PT-2026-60054

OpenCTI is an open source platform for managing cyber threat intelligence knowledge and observables. Prior to 7.260401.0, the OpenCTI GraphQL API exposes a script filter operator in its FilterOperator enum that allows any authenticated user with the KNOWLEDGE capability to pass user-supplied...

CVE-2026-59262: Missing Authorization

AFFiNE's histories GraphQL field fails to validate Doc.Read permission before exposing document edit history, allowing authenticated workspace members to retrieve restricted content timelines. Attackers can supply arbitrary document GUIDs to access full edit histories including user names, emails...

@absinthe/graphql-playground (>=1.3.1, <=1.3.5), @absinthe/socket (>=0.1.0, <=0.2.0) +52 more potentially affected by CVE-2026-56812 via phoenix (>=1.3.0, <=1.5.12)

phoenix NPM version =1.3.0, =1.3.1, =0.1.0, =0.1.2, =0.1.0, =0.1.2, =1.7.5, =1.5.1, =1.7.5, =1.8.1, =1.0.0, =1.5.6, =1.8.1, =1.8.1, =1.7.26, =1.7.26, =1.16.6-beta-eaa4d39d and more Source cves: CVE-2026-56812 Source advisory: SNYK:JS-PHOENIX-17889828...

alcali (>=2018.3.3, <=2019.2.3), ambition-edc (0.3.62) +7 more potentially affected by CVE-2026-53878 via django (2.2.8)

django PYPI version 2.2.8 is affected by a known vulnerability. The following packages have a transitive dependency on django and may be impacted: - alcali =2018.3.3, =0.0.2, =7.2.0, =7.2.1 - seed-auth-api 0.9.8 - seed-control-interface 0.9.18 Source cves: CVE-2026-53878 Source advisory:...

alcali (>=2018.3.3, <=2019.2.3), ambition-edc (0.3.62) +7 more potentially affected by CVE-2026-53877 via django (2.2.8)

django PYPI version 2.2.8 is affected by a known vulnerability. The following packages have a transitive dependency on django and may be impacted: - alcali =2018.3.3, =0.0.2, =7.2.0, =7.2.1 - seed-auth-api 0.9.8 - seed-control-interface 0.9.18 Source cves: CVE-2026-53877 Source advisory:...

GO-2026-5779 GitHub MCP Server: Lockdown mode singleton in HTTP server causes cross-user GraphQL client confusion in github.com/github/github-mcp-server

GitHub MCP Server: Lockdown mode singleton in HTTP server causes cross-user GraphQL client confusion in github.com/github/github-mcp-server...

@absinthe/graphql-playground (>=1.3.1, <=1.3.5), @absinthe/socket (>=0.1.0, <=0.2.0) +52 more potentially affected by CVE-2026-56812 via phoenix (>=1.3.0, <=1.5.12)

phoenix NPM version =1.3.0, =1.3.1, =0.1.0, =0.1.2, =0.1.0, =0.1.2, =1.7.5, =1.5.1, =1.7.5, =1.8.1, =1.0.0, =1.5.6, =1.8.1, =1.8.1, =1.7.26, =1.7.26, =1.16.6-beta-eaa4d39d and more Source cves: CVE-2026-56812 Source advisory: OSV:EEF-CVE-2026-56812...

PYSEC-2026-1637 MLflow Uncontrolled Resource Consumption vulnerability

In mlflow/mlflow version 2.17.2, the /graphql endpoint is vulnerable to a denial of service attack. An attacker can create large batches of queries that repeatedly request all runs from a given experiment. This can tie up all the workers allocated by MLFlow, rendering the application unable to...

MLflow Uncontrolled Resource Consumption vulnerability

In mlflow/mlflow version 2.17.2, the /graphql endpoint is vulnerable to a denial of service attack. An attacker can create large batches of queries that repeatedly request all runs from a given experiment. This can tie up all the workers allocated by MLFlow, rendering the application unable to...

PYSEC-2026-1946 Strawberry GraphQL has type resolution vulnerability in node interface that allows potential data leakage through incorrect type resolution

Vulnerability Summary A type confusion vulnerability exists in Strawberry GraphQL's relay integration that affects multiple ORM integrations Django, SQLAlchemy, Pydantic. The vulnerability occurs when multiple GraphQL types are mapped to the same underlying model while using the relay node...

Strawberry GraphQL has type resolution vulnerability in node interface that allows potential data leakage through incorrect type resolution

Vulnerability SummaryA type confusion vulnerability exists in Strawberry GraphQL's relay integration that affects multiple ORM integrations Django, SQLAlchemy, Pydantic. The vulnerability occurs when multiple GraphQL types are mapped to the same underlying model while using the relay node...

aas2openapi (>=0.2.0, <=0.2.4), arize-phoenix (>=0.0.33rc5, <=2.11.1) +38 more potentially affected by CVE-2025-22151 via strawberry-graphql (>=0.186.3, <=0.256.1)

strawberry-graphql PYPI version =0.186.3, =0.2.0, =0.0.33rc5, =1.2.0, =0.4.0, =0.2.4, =0.2.6, =0.0.7, =0.1.1, =0.5.0, =0.0.1, =0.0.1, =0.23.15, =0.26.0 and more Source cves: CVE-2025-22151 Source advisory: OSV:PYSEC-2026-1946...

PYSEC-2026-1687 Unauthenticated views may expose information to anonymous users

Impact A number of Nautobot URL endpoints were found to be improperly accessible to unauthenticated anonymous users, including the following: - /api/graphql/ 1 - /api/users/users/session/ Nautobot 2.x only; the only information exposed to an anonymous user is which authentication backend classes...

CVE-2026-9165

A flaw was found in Red Hat Advanced Cluster Security for Kubernetes RHACS. Central does not limit the depth of GraphQL queries served on the authenticated GraphQL API. An authenticated user with a valid API token can send deeply nested queries that cause excessive resource consumption in Central...

CVE-2026-9165 Stackrox: stackrox: unbounded graphql query depth allows authenticated denial of service

A flaw was found in Red Hat Advanced Cluster Security for Kubernetes RHACS. Central does not limit the depth of GraphQL queries served on the authenticated GraphQL API. An authenticated user with a valid API token can send deeply nested queries that cause excessive resource consumption in Central...

CVE-2026-9165

A flaw was found in Red Hat Advanced Cluster Security for Kubernetes RHACS. Central does not limit the depth of GraphQL queries served on the authenticated GraphQL API. An authenticated user with a valid API token can send deeply nested queries that cause excessive resource consumption in Central...

CVE-2026-9165 Stackrox: stackrox: unbounded graphql query depth allows authenticated denial of service

A flaw was found in Red Hat Advanced Cluster Security for Kubernetes RHACS. Central does not limit the depth of GraphQL queries served on the authenticated GraphQL API. An authenticated user with a valid API token can send deeply nested queries that cause excessive resource consumption in Central...

CVE-2026-9165: Uncontrolled Resource Consumption

A flaw was found in Red Hat Advanced Cluster Security for Kubernetes RHACS. Central does not limit the depth of GraphQL queries served on the authenticated GraphQL API. An authenticated user with a valid API token can send deeply nested queries that cause excessive resource consumption in Central...