PT-2026-46881

Name of the Vulnerable Software and Affected Versions Nhost CLI affected versions not specified Description The hidden configserver used by nhost dev exposes the Mimir GraphQL API with permissive CORS and dummy authorization directives. This allows any process capable of reaching the developer's...

CVE-2026-47706: Uncontrolled Resource Consumption

Strawberry GraphQL is a library for creating GraphQL APIs. In versions 0.71.0 through 0.315.6, the QueryDepthLimiter extension is vulnerable to an Application-level DOS due to a lack of cycle detection in fragment spreads. When a query contains circular fragment references the determinedepth...

PT-2026-46250

Name of the Vulnerable Software and Affected Versions Strawberry GraphQL versions 0.172.0 through 0.315.6 Description The MaxAliasesLimiter extension fails to account for the multiplicative effect of FragmentSpreadNode. While static aliases within the Abstract Syntax Tree AST are counted, the...

Strawberry GraphQL security vulnerability

Strawberry GraphQL is an open-source Python GraphQL library that utilizes type annotations. Versions 0.172.0 to 0.315.6 of Strawberry GraphQL contain security vulnerabilities. These vulnerabilities stem from the MaxAliasesLimiter extension not taking into account the multiplicative amplification...

CVE-2026-47707: Uncontrolled Resource Consumption

Strawberry GraphQL is a library for creating GraphQL APIs. In versions 0.172.0 through0.315.6, the MaxAliasesLimiter extension in Strawberry fails to account for the multiplicative/amplification effect of FragmentSpreadNode. While it correctly counts static aliases within the AST it does not...

PT-2026-46848

Summary The hidden nhost configserver used by nhost dev exposes the Mimir GraphQL API with dummy authorization directives and permissive CORS. When a developer is running the local development environment, any process that can reach the developer's localhost service, including a web page loaded...

Keystone security vulnerabilities

Keystone is a powerful CMS developed by OpenStack. It helps you build and expand faster than any other CMS or application framework. Keystone versions prior to 20260319 have security vulnerabilities. These vulnerabilities stem from unknown code in the...

CVE-2026-45739: Exposure of Sensitive Information to an Unauthorized Actor

Strawberry GraphQL is a library for creating GraphQL APIs. In versions 0.288.4 through 0.315.3, Strawberry's bundled GraphiQL template wrote values from the GraphiQL headers editor into the browser URL query string. If a user entered a sensitive header, such as Authorization: Bearer , the value...

Strawberry GraphQL security vulnerability

Strawberry GraphQL is an open-source Python GraphQL library that utilizes type annotations. Versions 0.288.4 to 0.315.3 of Strawberry GraphQL contain security vulnerabilities. These vulnerabilities stem from the GraphiQL template writing values from the header editor into the browser URL query...

PT-2026-46249

Name of the Vulnerable Software and Affected Versions Strawberry GraphQL versions 0.71.0 through 0.315.6 Description The QueryDepthLimiter extension is susceptible to an application-level Denial of Service DoS. This occurs because the determine depth function in query depth limiter.py lacks cycle...

alcali (>=2018.3.3, <=2019.2.3), ambition-edc (0.3.62) +7 more potentially affected by CVE-2026-8404 via django (2.2.8)

django PYPI version 2.2.8 is affected by a known vulnerability. The following packages have a transitive dependency on django and may be impacted: - alcali =2018.3.3, =0.0.2, =7.2.0, =7.2.1 - seed-auth-api 0.9.8 - seed-control-interface 0.9.18 Source cves: CVE-2026-8404 Source advisory:...

alcali (>=2018.3.3, <=2019.2.3), ambition-edc (0.3.62) +7 more potentially affected by CVE-2026-48587 via django (2.2.8)

django PYPI version 2.2.8 is affected by a known vulnerability. The following packages have a transitive dependency on django and may be impacted: - alcali =2018.3.3, =0.0.2, =7.2.0, =7.2.1 - seed-auth-api 0.9.8 - seed-control-interface 0.9.18 Source cves: CVE-2026-48587 Source advisory:...

alexa-browser-client (3.3.0), channels (>=1.1.2, <=2.1.7) +7 more potentially affected by CVE-2026-44545 via daphne (2.2.5)

daphne PYPI version 2.2.5 is affected by a known vulnerability. The following packages have a transitive dependency on daphne and may be impacted: - alexa-browser-client 3.3.0 - channels =1.1.2, =0.2.0, =2.0.1, =0.1.1, =0.1.2, =4.0.0a1, =0.9.0a1, =16.0.0a4, =16.0.0a5 Source cves: CVE-2026-44545...

alexa-browser-client (3.3.0), channels (>=1.1.2, <=2.1.7) +7 more potentially affected by CVE-2026-44546 via daphne (2.2.5)

daphne PYPI version 2.2.5 is affected by a known vulnerability. The following packages have a transitive dependency on daphne and may be impacted: - alexa-browser-client 3.3.0 - channels =1.1.2, =0.2.0, =2.0.1, =0.1.1, =0.1.2, =4.0.0a1, =0.9.0a1, =16.0.0a4, =16.0.0a5 Source cves: CVE-2026-44546...

Malicious Package

Overview json-to-simple-graphql-schema is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this...

Malicious code in @redhat-cloud-services/remediations-client (npm)

Part of the "Mini Shai-Hulud" supply chain worm campaign that compromised the GitHub Actions OIDC trusted publisher shared by Red Hat Cloud Services npm packages. The attacker injected a preinstall hook into this and 31 other packages in the @redhat-cloud-services scope. The hook delivers a...

GHSA-8CPH-RGR4-G5VJ Parse Server's GraphQL "Did you mean ...?" validation suggestions disclose schema to unauthenticated callers

Impact Parse Server's GraphQL endpoint discloses schema metadata to unauthenticated callers through Did you mean ...? suggestions embedded in GraphQL validation-error messages. An unauthenticated caller who knows only the public application id can iteratively send malformed queries to reconstruct...

Parse Server's GraphQL "Did you mean ...?" validation suggestions disclose schema to unauthenticated callers

Impact Parse Server's GraphQL endpoint discloses schema metadata to unauthenticated callers through Did you mean ...? suggestions embedded in GraphQL validation-error messages. An unauthenticated caller who knows only the public application id can iteratively send malformed queries to reconstruct...

Information Exposure

Overview parse-server is a version of the Parse backend that can be deployed to any infrastructure that can run Node.js. Affected versions of this package are vulnerable to Information Exposure via the Did you mean ...? suggestions in GraphQL validation-error messages. An attacker can enumerate...

PT-2026-45045

Name of the Vulnerable Software and Affected Versions Parse Server versions prior to 8.6.78 Parse Server versions prior to 9.9.1-alpha.2 Description The GraphQL endpoint discloses schema metadata to unauthenticated callers via "Did you mean ...?" suggestions within GraphQL validation-error...