piccolo-admin (0.6.0), piccolo-api (0.7.0) +2 more potentially affected by CVE-2026-48710 via starlette (0.13.3)

starlette PYPI version 0.13.3 is affected by a known vulnerability. The following packages have a transitive dependency on starlette and may be impacted: - piccolo-admin 0.6.0 - piccolo-api 0.7.0 - starlette-graphql-zifulu =0.0.1a3, =0.22.0, =0.24.1 Source cves: CVE-2026-48710 Source advisory:...

aiida-graphql (>=0.0.1, <=0.0.2), postblog (>=0.4.1, <=0.5.2) +1 more potentially affected by CVE-2026-48710 via starlette (0.12.10)

starlette PYPI version 0.12.10 is affected by a known vulnerability. The following packages have a transitive dependency on starlette and may be impacted: - aiida-graphql =0.0.1, =0.4.1, =0.16.5, =0.18.1 Source cves: CVE-2026-48710 Source advisory: OSV:GHSA-86QP-5C8J-P5MR...

aioboot (0.3.0), dms (0.0.3) +3 more potentially affected by CVE-2026-48710 via starlette (0.13.0)

starlette PYPI version 0.13.0 is affected by a known vulnerability. The following packages have a transitive dependency on starlette and may be impacted: - aioboot 0.3.0 - dms 0.0.3 - piccolo-admin =0.3.1, =0.4.2, =0.18.2, =0.21.1 Source cves: CVE-2026-48710 Source advisory: OSV:GHSA-86QP-5C8J-P5...

faastapi (>=0.1.2, <=0.3.4), fastapi (>=0.23.0, <=0.33.0) +1 more potentially affected by CVE-2026-48710 via starlette (0.12.0)

starlette PYPI version 0.12.0 is affected by a known vulnerability. The following packages have a transitive dependency on starlette and may be impacted: - faastapi =0.1.2, =0.23.0, =0.33.0 - strawberry-graphql 0.12.0 Source cves: CVE-2026-48710 Source advisory: OSV:GHSA-86QP-5C8J-P5MR...

balto (>=0.1.5, <=0.3.0), fastapi (>=0.34.0, <=0.37.0) +3 more potentially affected by CVE-2026-48710 via starlette (0.12.7)

starlette PYPI version 0.12.7 is affected by a known vulnerability. The following packages have a transitive dependency on starlette and may be impacted: - balto =0.1.5, =0.34.0, =0.1.7, =0.14.0, =0.14.3 Source cves: CVE-2026-48710 Source advisory: OSV:GHSA-86QP-5C8J-P5MR...

bocadillo (>=0.12.3, <=0.14.2), starlette-jsonrpc (>=0.1.0, <=0.2.0) +2 more potentially affected by CVE-2026-48710 via starlette (0.11.4)

starlette PYPI version 0.11.4 is affected by a known vulnerability. The following packages have a transitive dependency on starlette and may be impacted: - bocadillo =0.12.3, =0.1.0, =0.1.0, =0.11.0 - termpair 0.0.0.2 Source cves: CVE-2026-48710 Source advisory: OSV:GHSA-86QP-5C8J-P5MR...

Keystone: GraphQL API Endpoint Lacks Query Depth Limits

A vulnerability was detected in keystonejs keystone up to 20260319. This vulnerability affects unknown code in the library packages/core/src/lib/core/queries/output-field.ts of the component GraphQL API Endpoint. The manipulation results in resource consumption. It is possible to launch the attac...

GHSA-45JQ-C8XM-JFW9 Keystone: GraphQL API Endpoint Lacks Query Depth Limits

A vulnerability was detected in keystonejs keystone up to 20260319. This vulnerability affects unknown code in the library packages/core/src/lib/core/queries/output-field.ts of the component GraphQL API Endpoint. The manipulation results in resource consumption. It is possible to launch the attac...

CVE-2026-10802

A vulnerability was detected in keystonejs keystone up to 20260319. This vulnerability affects unknown code in the library packages/core/src/lib/core/queries/output-field.ts of the component GraphQL API Endpoint. The manipulation results in resource consumption. It is possible to launch the attac...

EUVD-2026-34244

A vulnerability was detected in keystonejs keystone up to 20260319. This vulnerability affects unknown code in the library packages/core/src/lib/core/queries/output-field.ts of the component GraphQL API Endpoint. The manipulation results in resource consumption. It is possible to launch the attac...

CVE-2026-10802 keystonejs keystone GraphQL API Endpoint output-field.ts resource consumption

A vulnerability was detected in keystonejs keystone up to 20260319. This vulnerability affects unknown code in the library packages/core/src/lib/core/queries/output-field.ts of the component GraphQL API Endpoint. The manipulation results in resource consumption. It is possible to launch the attac...

CVE-2026-10802

The CVE-2026-10802 impact is in keystonejs keystone’s GraphQL API Endpoint, specifically in packages/core/src/lib/core/queries/output-field.ts. The vulnerability arises from a manipulation that causes resource consumption and can be exploited remotely. Public exploitation is reported, and a fix i...

CVE-2026-10802 keystonejs keystone GraphQL API Endpoint output-field.ts resource consumption

A vulnerability was detected in keystonejs keystone up to 20260319. This vulnerability affects unknown code in the library packages/core/src/lib/core/queries/output-field.ts of the component GraphQL API Endpoint. The manipulation results in resource consumption. It is possible to launch the attac...

CVE-2026-10802: Uncontrolled Resource Consumption

A vulnerability was detected in keystonejs keystone up to 20260319. This vulnerability affects unknown code in the library packages/core/src/lib/core/queries/output-field.ts of the component GraphQL API Endpoint. The manipulation results in resource consumption. It is possible to launch the attac...

Strawberry GraphQL security vulnerability

Strawberry GraphQL is an open-source Python GraphQL library that utilizes type annotations. Versions 0.71.0 to 0.315.6 of Strawberry GraphQL contain security vulnerabilities. These vulnerabilities stem from the QueryDepthLimiter extension’s lack of loop detection in fragment extensions, which cou...

PT-2026-58943

A vulnerability was detected in keystonejs keystone up to 20260319. This vulnerability affects unknown code in the library packages/core/src/lib/core/queries/output-field.ts of the component GraphQL API Endpoint. The manipulation results in resource consumption. It is possible to launch the attac...

PT-2026-46318

Iris is a web collaborative platform that helps incident responders share technical details during investigations. Prior to version 2.4.28, DFIR-IRIS exposes an optional GraphQL endpoint at /graphql that does not enforce the same authorization checks as the REST API. Any authenticated user can...

CVE-2026-41522: Improper Authorization

Iris is a web collaborative platform that helps incident responders share technical details during investigations. Prior to version 2.4.28, DFIR-IRIS exposes an optional GraphQL endpoint at /graphql that does not enforce the same authorization checks as the REST API. Any authenticated user can...

PT-2026-46881

Name of the Vulnerable Software and Affected Versions Nhost CLI affected versions not specified Description The hidden configserver used by nhost dev exposes the Mimir GraphQL API with permissive CORS and dummy authorization directives. This allows any process capable of reaching the developer's...

CVE-2026-47706: Uncontrolled Resource Consumption

Strawberry GraphQL is a library for creating GraphQL APIs. In versions 0.71.0 through 0.315.6, the QueryDepthLimiter extension is vulnerable to an Application-level DOS due to a lack of cycle detection in fragment spreads. When a query contains circular fragment references the determinedepth...