Parse Server's GraphQL "Did you mean ...?" validation suggestions disclose schema to unauthenticated callers

Impact Parse Server's GraphQL endpoint discloses schema metadata to unauthenticated callers through Did you mean ...? suggestions embedded in GraphQL validation-error messages. An unauthenticated caller who knows only the public application id can iteratively send malformed queries to reconstruct...

GHSA-8CPH-RGR4-G5VJ Parse Server's GraphQL "Did you mean ...?" validation suggestions disclose schema to unauthenticated callers

Impact Parse Server's GraphQL endpoint discloses schema metadata to unauthenticated callers through Did you mean ...? suggestions embedded in GraphQL validation-error messages. An unauthenticated caller who knows only the public application id can iteratively send malformed queries to reconstruct...

Information Exposure

Overview parse-server is a version of the Parse backend that can be deployed to any infrastructure that can run Node.js. Affected versions of this package are vulnerable to Information Exposure via the Did you mean ...? suggestions in GraphQL validation-error messages. An attacker can enumerate...

WS-2022-0380

Impact Unauthenticated GraphQL queries for user accounts can expose password hashes of users that have created or modified content, typically but not necessarily limited to administrators and editors. Patches Affected versions: Ibexa DXP v3.3., v4.2., eZ Platform v2.5. Resolving versions: Ibexa D...

PT-2026-45045

Name of the Vulnerable Software and Affected Versions Parse Server versions prior to 8.6.78 Parse Server versions prior to 9.9.1-alpha.2 Description The GraphQL endpoint discloses schema metadata to unauthenticated callers via "Did you mean ...?" suggestions within GraphQL validation-error...

GHSA-Q537-QHJ4-WCJX OpenCTI: Privilege escalation via graphQL API is abusable by organization admins, due to incorrect ACL on userEdit relationAdd

Summary An organization admin can escalate their privileges by adding a user from a different organization with higher privileges, to their own organization. Impact Full platform access, access to sensitive or proprietary information...

ANT-2026-NDBADAT0 · sentinelone/purple-mcp · Algorithmic Complexity Denial of Service

denial-of-service high Severity Claude high · Security research firm - · Maintainer - Discovered by Claude Mythos Preview REPORT Anthropic's analysis of this finding, sealed at approval. ANT-2026-NDBADAT0: Algorithmic Complexity DoS The MCP tools for alerts, misconfigurations, and vulnerabilities...

CVE-2026-44730 OpenCTI: Privilege escalation via graphQL API abusable by organization admins, due to incorrect ACL on userEdit relationAdd

OpenCTI is an open source platform for managing cyber threat intelligence knowledge and observables. Prior to 6.9.7, an organization admin can escalate their privileges by adding a user from a different organization with higher privileges, to their own organization. This is due to incorrect ACL o...

Broken Object Level Authorization in the Wild: An Empirical Taxonomy from 100+ Bug Bounty Disclosures

Broken Object Level Authorization BOLA is consistently ranked the most critical API security vulnerability, yet the existing literature remains almost entirely conceptual. This paper presents one of the first large-scale empirical analyses of BOLA in publicly disclosed bug bounty reports. We...

bocadillo (>=0.12.3, <=0.14.2), starlette-jsonrpc (>=0.1.0, <=0.2.0) +2 more potentially affected by CVE-2026-48710 via starlette (0.11.4)

starlette PYPI version 0.11.4 is affected by a known vulnerability. The following packages have a transitive dependency on starlette and may be impacted: - bocadillo =0.12.3, =0.1.0, =0.1.0, =0.11.0 - termpair 0.0.0.2 Source cves: CVE-2026-48710 Source advisory: OSV:PYSEC-2026-161...

faastapi (>=0.1.2, <=0.3.4), fastapi (>=0.23.0, <=0.33.0) +1 more potentially affected by CVE-2026-48710 via starlette (0.12.0)

starlette PYPI version 0.12.0 is affected by a known vulnerability. The following packages have a transitive dependency on starlette and may be impacted: - faastapi =0.1.2, =0.23.0, =0.33.0 - strawberry-graphql 0.12.0 Source cves: CVE-2026-48710 Source advisory: OSV:PYSEC-2026-161...

strawberry-graphql (>=0.13.0, <=0.13.1) potentially affected by CVE-2026-48710 via starlette (0.12.1)

starlette PYPI version 0.12.1 is affected by a known vulnerability. The following packages have a transitive dependency on starlette and may be impacted: - strawberry-graphql =0.13.0, =0.13.1 Source cves: CVE-2026-48710 Source advisory: OSV:PYSEC-2026-161...

strawberry-graphql (>=0.13.2, <=0.13.4) potentially affected by CVE-2026-48710 via starlette (0.12.4)

starlette PYPI version 0.12.4 is affected by a known vulnerability. The following packages have a transitive dependency on starlette and may be impacted: - strawberry-graphql =0.13.2, =0.13.4 Source cves: CVE-2026-48710 Source advisory: OSV:PYSEC-2026-161...

balto (>=0.1.5, <=0.3.0), fastapi (>=0.34.0, <=0.37.0) +3 more potentially affected by CVE-2026-48710 via starlette (0.12.7)

starlette PYPI version 0.12.7 is affected by a known vulnerability. The following packages have a transitive dependency on starlette and may be impacted: - balto =0.1.5, =0.34.0, =0.1.7, =0.14.0, =0.14.3 Source cves: CVE-2026-48710 Source advisory: OSV:PYSEC-2026-161...

aiida-graphql (>=0.0.1, <=0.0.2), postblog (>=0.4.1, <=0.5.2) +1 more potentially affected by CVE-2026-48710 via starlette (0.12.10)

starlette PYPI version 0.12.10 is affected by a known vulnerability. The following packages have a transitive dependency on starlette and may be impacted: - aiida-graphql =0.0.1, =0.4.1, =0.16.5, =0.18.1 Source cves: CVE-2026-48710 Source advisory: OSV:PYSEC-2026-161...

aioboot (0.3.0), dms (0.0.3) +3 more potentially affected by CVE-2026-48710 via starlette (0.13.0)

starlette PYPI version 0.13.0 is affected by a known vulnerability. The following packages have a transitive dependency on starlette and may be impacted: - aioboot 0.3.0 - dms 0.0.3 - piccolo-admin =0.3.1, =0.4.2, =0.18.2, =0.21.1 Source cves: CVE-2026-48710 Source advisory: OSV:PYSEC-2026-161...

piccolo-admin (0.6.0), piccolo-api (0.7.0) +2 more potentially affected by CVE-2026-48710 via starlette (0.13.3)

starlette PYPI version 0.13.3 is affected by a known vulnerability. The following packages have a transitive dependency on starlette and may be impacted: - piccolo-admin 0.6.0 - piccolo-api 0.7.0 - starlette-graphql-zifulu =0.0.1a3, =0.22.0, =0.24.1 Source cves: CVE-2026-48710 Source advisory:...

CVE-2026-2734

A flaw was found in mlflow. An authenticated user could exploit a lack of proper authorization checks in the SearchModelVersions REST API and mlflowSearchModelVersions GraphQL query. This flaw allows them to enumerate all model versions across all registered models, potentially exposing sensitive...

Access Control Bypass

Overview mlflow is a platform to streamline machine learning development, including tracking experiments, packaging code into reproducible runs, and sharing and deploying models. Affected versions of this package are vulnerable to Access Control Bypass via the SearchModelVersions REST API endpoin...

GHSA-W5XQ-C4PF-GHQ7 MLflow authenticated users can enumerate any registered model versions due to lack of per-model permissions checks

In mlflow/mlflow versions up to 3.9.0, the SearchModelVersions REST API endpoint and the mlflowSearchModelVersions GraphQL query lack proper per-model authorization checks when basic authentication is enabled. This allows any authenticated user to enumerate all model versions across all registere...