WS-2019-0068

All versions of graphql-code-generator have an Insecure Default Configuration. The packages sets NODETLSREJECTUNAUTHORIZED to 0, disabling certificate verification for the entire project...

@absa-subatomic/openshift-api (>=0.0.1, <=0.0.2), @atomist-seeds/automation-client (>=1.0.0-atomist-update-1.0.0-M.5a-1538147067873.20180928150441, <=1.0.0-master.20180928151025) +40 more potentially affected by unknown CVE via graphql-code-generator (>=0.5.5, <=0.17.0)

graphql-code-generator NPM version =0.5.5, =0.0.1, =1.0.0-atomist-update-1.0.0-M.5a-1538147067873.20180928150441, =1.0.0-atomist-update-1.0.0-M.5a-1538146868055.20180928150114, =1.0.0-atomist-update-1.0.0-M.5a-1538147121196.20180928150530, =0.1.0-master.20181019173228,...

bloql (0.7.3), react-sotefront-components-test (>=0.2.0, <=0.2.6) potentially affected by unknown CVE via express-graphql (>=0.4.0, <=0.4.9)

express-graphql NPM version =0.4.0, =0.2.0, =0.2.6 Source cves: unknown CVE Source advisory: MEND:WS-2016-0142...

WS-2016-0142

GraphQL HTTP is vulnerable to XSS vulnerability. HTML was was not properly escaped in queries or variables causing GraphiQL to break...

CVE-2026-44010

Craft CMS is a content management system CMS. From 4.0.0 to before 4.17.12 and 5.9.18, the GraphQL Address element resolver src/gql/resolvers/elements/Address.php performs no schema scope filtering on top-level queries. A GraphQL API token scoped to a single low-privilege user group can read ever...

@activepieces/piece-amazon-textract (>=0.2.0, <=0.3.0), @activepieces/piece-salesforce (0.7.2) +4 more potentially affected by CVE-2026-44665 via fast-xml-builder (>=1.1.1, <=1.1.4)

fast-xml-builder NPM version =1.1.1, =0.2.0, =0.2.1, =0.0.4, =10.4.0, =10.5.0 Source cves: CVE-2026-44665 Source advisory: MEND:CVE-2026-44665...

Gitlab -- vulnerabilities

Gitlab reports: Cross-site Scripting issue in Analytics dashboard chart rendering impacts GitLab EE Cross-site Scripting issue in global search impacts GitLab CE/EE Cross-site Scripting issue in Duo Agent output rendering impacts GitLab EE Cross-site Scripting issue in Analytics Dashboard impacts...

CVE-2026-44224

Wiki.js is an open source wiki app built on Node.js. Prior to 2.5.313, the users.update GraphQL mutation accepts an arbitrary groups array and applies it directly to the database with no validation of the group IDs supplied. The resolver passes the caller's arguments straight to the model without...

CVE-2026-44010

Craft CMS is a content management system CMS. From 4.0.0 to before 4.17.12 and 5.9.18, the GraphQL Address element resolver src/gql/resolvers/elements/Address.php performs no schema scope filtering on top-level queries. A GraphQL API token scoped to a single low-privilege user group can read ever...

EUVD-2026-29838

Wiki.js is an open source wiki app built on Node.js. Prior to 2.5.313, the users.update GraphQL mutation accepts an arbitrary groups array and applies it directly to the database with no validation of the group IDs supplied. The resolver passes the caller's arguments straight to the model without...

CVE-2026-44224

Wiki.js is an open source wiki app built on Node.js. Prior to 2.5.313, the users.update GraphQL mutation accepts an arbitrary groups array and applies it directly to the database with no validation of the group IDs supplied. The resolver passes the caller's arguments straight to the model without...

CVE-2026-44010 Craft CMS: Missing Authorization in GraphQL Address Resolver Allows Cross-Scope PII Disclosure

Craft CMS is a content management system CMS. From 4.0.0 to before 4.17.12 and 5.9.18, the GraphQL Address element resolver src/gql/resolvers/elements/Address.php performs no schema scope filtering on top-level queries. A GraphQL API token scoped to a single low-privilege user group can read ever...

CVE-2026-44010 Craft CMS: Missing Authorization in GraphQL Address Resolver Allows Cross-Scope PII Disclosure

Craft CMS is a content management system CMS. From 4.0.0 to before 4.17.12 and 5.9.18, the GraphQL Address element resolver src/gql/resolvers/elements/Address.php performs no schema scope filtering on top-level queries. A GraphQL API token scoped to a single low-privilege user group can read ever...

CVE-2026-44010

Craft CMS is a content management system CMS. From 4.0.0 to before 4.17.12 and 5.9.18, the GraphQL Address element resolver src/gql/resolvers/elements/Address.php performs no schema scope filtering on top-level queries. A GraphQL API token scoped to a single low-privilege user group can read ever...

CVE-2026-44010

Summary: Craft CMS CVE-2026-44010 describes a missing schema scope filter in the GraphQL Address resolver, enabling a token scoped to a single low-privilege user group to read all addresses in the system, including those outside the token’s authorization. This affects Craft CMS Pro sites (v4.0.0+...

com.capitalone.dashboard:api (>=3.4.25, <=3.4.52), com.capitalone.dashboard:api-audit (>=3.6.20, <=3.7.33) +6 more potentially affected by CVE-2026-41284 via org.apache.tomcat.embed:tomcat-embed-core (8.5.70)

org.apache.tomcat.embed:tomcat-embed-core MAVEN version 8.5.70 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.tomcat.embed:tomcat-embed-core and may be impacted: - com.capitalone.dashboard:api =3.4.25, =3.6.20, =3.3.8, =1.2.12, =1.3.14 -...

com.capitalone.dashboard:api (>=3.4.25, <=3.4.52), com.capitalone.dashboard:api-audit (>=3.6.20, <=3.7.33) +6 more potentially affected by CVE-2026-43512 via org.apache.tomcat.embed:tomcat-embed-core (8.5.70)

org.apache.tomcat.embed:tomcat-embed-core MAVEN version 8.5.70 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.tomcat.embed:tomcat-embed-core and may be impacted: - com.capitalone.dashboard:api =3.4.25, =3.6.20, =3.3.8, =1.2.12, =1.3.14 -...

com.capitalone.dashboard:api (>=3.4.25, <=3.4.52), com.capitalone.dashboard:api-audit (>=3.6.20, <=3.7.33) +6 more potentially affected by CVE-2026-43515 via org.apache.tomcat.embed:tomcat-embed-core (8.5.70)

org.apache.tomcat.embed:tomcat-embed-core MAVEN version 8.5.70 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.tomcat.embed:tomcat-embed-core and may be impacted: - com.capitalone.dashboard:api =3.4.25, =3.6.20, =3.3.8, =1.2.12, =1.3.14 -...

wiki.js security vulnerabilities

Wiki.js is a Wiki application open-sourced by requarks.io. Versions of Wiki.js prior to 2.5.313 contained a security vulnerability. This vulnerability stemmed from the GraphQL mutation in users.update, which accepted an arbitrary groups array and applied it directly to the database without...

CVE-2026-44224: Improper Privilege Management

Wiki.js is an open source wiki app built on Node.js. Prior to 2.5.313, the users.update GraphQL mutation accepts an arbitrary groups array and applies it directly to the database with no validation of the group IDs supplied. The resolver passes the caller's arguments straight to the model without...