PT-2026-46318

Iris is a web collaborative platform that helps incident responders share technical details during investigations. Prior to version 2.4.28, DFIR-IRIS exposes an optional GraphQL endpoint at /graphql that does not enforce the same authorization checks as the REST API. Any authenticated user can...

PT-2026-46848

Summary The hidden nhost configserver used by nhost dev exposes the Mimir GraphQL API with dummy authorization directives and permissive CORS. When a developer is running the local development environment, any process that can reach the developer's localhost service, including a web page loaded...

PT-2026-46881

Name of the Vulnerable Software and Affected Versions Nhost CLI affected versions not specified Description The hidden configserver used by nhost dev exposes the Mimir GraphQL API with permissive CORS and dummy authorization directives. This allows any process capable of reaching the developer's...

Keystone security vulnerabilities

Keystone is a powerful CMS developed by OpenStack. It helps you build and expand faster than any other CMS or application framework. Keystone versions prior to 20260319 have security vulnerabilities. These vulnerabilities stem from unknown code in the...

Strawberry GraphQL security vulnerability

Strawberry GraphQL is an open-source Python GraphQL library that utilizes type annotations. Versions 0.71.0 to 0.315.6 of Strawberry GraphQL contain security vulnerabilities. These vulnerabilities stem from the QueryDepthLimiter extension’s lack of loop detection in fragment extensions, which cou...

Strawberry GraphQL security vulnerability

Strawberry GraphQL is an open-source Python GraphQL library that utilizes type annotations. Versions 0.288.4 to 0.315.3 of Strawberry GraphQL contain security vulnerabilities. These vulnerabilities stem from the GraphiQL template writing values from the header editor into the browser URL query...

Strawberry GraphQL security vulnerability

Strawberry GraphQL is an open-source Python GraphQL library that utilizes type annotations. Versions 0.172.0 to 0.315.6 of Strawberry GraphQL contain security vulnerabilities. These vulnerabilities stem from the MaxAliasesLimiter extension not taking into account the multiplicative amplification...

CVE-2026-41522: Improper Authorization

Iris is a web collaborative platform that helps incident responders share technical details during investigations. Prior to version 2.4.28, DFIR-IRIS exposes an optional GraphQL endpoint at /graphql that does not enforce the same authorization checks as the REST API. Any authenticated user can...

CVE-2026-47707: Uncontrolled Resource Consumption

Strawberry GraphQL is a library for creating GraphQL APIs. In versions 0.172.0 through0.315.6, the MaxAliasesLimiter extension in Strawberry fails to account for the multiplicative/amplification effect of FragmentSpreadNode. While it correctly counts static aliases within the AST it does not...

CVE-2026-47706: Uncontrolled Resource Consumption

Strawberry GraphQL is a library for creating GraphQL APIs. In versions 0.71.0 through 0.315.6, the QueryDepthLimiter extension is vulnerable to an Application-level DOS due to a lack of cycle detection in fragment spreads. When a query contains circular fragment references the determinedepth...

CVE-2026-45739: Exposure of Sensitive Information to an Unauthorized Actor

Strawberry GraphQL is a library for creating GraphQL APIs. In versions 0.288.4 through 0.315.3, Strawberry's bundled GraphiQL template wrote values from the GraphiQL headers editor into the browser URL query string. If a user entered a sensitive header, such as Authorization: Bearer , the value...

CVE-2026-10802: Uncontrolled Resource Consumption

A vulnerability was detected in keystonejs keystone up to 20260319. This vulnerability affects unknown code in the library packages/core/src/lib/core/queries/output-field.ts of the component GraphQL API Endpoint. The manipulation results in resource consumption. It is possible to launch the attac...

PT-2026-58943

A vulnerability was detected in keystonejs keystone up to 20260319. This vulnerability affects unknown code in the library packages/core/src/lib/core/queries/output-field.ts of the component GraphQL API Endpoint. The manipulation results in resource consumption. It is possible to launch the attac...

alcali (>=2018.3.3, <=2019.2.3), ambition-edc (0.3.62) +7 more potentially affected by CVE-2026-8404 via django (2.2.8)

django PYPI version 2.2.8 is affected by a known vulnerability. The following packages have a transitive dependency on django and may be impacted: - alcali =2018.3.3, =0.0.2, =7.2.0, =7.2.1 - seed-auth-api 0.9.8 - seed-control-interface 0.9.18 Source cves: CVE-2026-8404 Source advisory:...

alcali (>=2018.3.3, <=2019.2.3), ambition-edc (0.3.62) +7 more potentially affected by CVE-2026-48587 via django (2.2.8)

django PYPI version 2.2.8 is affected by a known vulnerability. The following packages have a transitive dependency on django and may be impacted: - alcali =2018.3.3, =0.0.2, =7.2.0, =7.2.1 - seed-auth-api 0.9.8 - seed-control-interface 0.9.18 Source cves: CVE-2026-48587 Source advisory:...

alexa-browser-client (3.3.0), channels (>=1.1.2, <=2.1.7) +7 more potentially affected by CVE-2026-44545 via daphne (2.2.5)

daphne PYPI version 2.2.5 is affected by a known vulnerability. The following packages have a transitive dependency on daphne and may be impacted: - alexa-browser-client 3.3.0 - channels =1.1.2, =0.2.0, =2.0.1, =0.1.1, =0.1.2, =4.0.0a1, =0.9.0a1, =16.0.0a4, =16.0.0a5 Source cves: CVE-2026-44545...

alexa-browser-client (3.3.0), channels (>=1.1.2, <=2.1.7) +7 more potentially affected by CVE-2026-44546 via daphne (2.2.5)

daphne PYPI version 2.2.5 is affected by a known vulnerability. The following packages have a transitive dependency on daphne and may be impacted: - alexa-browser-client 3.3.0 - channels =1.1.2, =0.2.0, =2.0.1, =0.1.1, =0.1.2, =4.0.0a1, =0.9.0a1, =16.0.0a4, =16.0.0a5 Source cves: CVE-2026-44546...

Malware in json-to-simple-graphql-schema

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malicious Package

Overview json-to-simple-graphql-schema is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this...

Malicious code in @redhat-cloud-services/remediations-client (npm)

Part of the "Mini Shai-Hulud" supply chain worm campaign that compromised the GitHub Actions OIDC trusted publisher shared by Red Hat Cloud Services npm packages. The attacker injected a preinstall hook into this and 31 other packages in the @redhat-cloud-services scope. The hook delivers a...