PT-2026-39146

Name of the Vulnerable Software and Affected Versions absinthe versions 1.5.0 through 1.10.1 Description An unauthenticated denial of service can occur via atom table exhaustion when parsing attacker-controlled GraphQL SDL. Multiple Blueprint.Draft.convert/2 implementations in the SDL language...

CVE-2026-41422

Daptin is a GraphQL/JSON-API headless CMS. Prior to version 0.11.4, the /aggregate/:typename endpoint accepted column and group query parameters that were passed verbatim to goqu.L — a raw SQL literal expression builder — without any validation. This bypassed all parameterization and allowed...

EUVD-2025-209718

Cross-Site Request Forgery CSRF vulnerability in WPGraphQL allows Cross Site Request Forgery. This issue affects WPGraphQL: from n/a through 2.5.3...

Cross-site Request Forgery (CSRF)

Overview Affected versions of this package are vulnerable to Cross-site Request Forgery CSRF via the process handling incoming requests. An attacker can perform unauthorized actions on behalf of an authenticated user by tricking them into submitting a crafted request. Remediation Upgrade...

CVE-2025-68604

WPGraphQL WordPress plugin

WordPress plugin WPGraphQL vulnerable to cross-site request fraud

WordPress and WordPress plugins are both products of the WordPress Foundation. WordPress is a blog platform developed using the PHP language. This platform allows for the creation of personal blog websites on servers based on PHP and MySQL. A WordPress plugin is an application extension. WordPres...

GHSA-GJ2P-P9M4-C8GW Craft CMS's Missing Authorization in GraphQL Address Resolver Allows Cross-Scope PII Disclosure

Summary The GraphQL Address element resolver src/gql/resolvers/elements/Address.php performs no schema scope filtering on top-level queries. A GraphQL API token scoped to a single low-privilege user group can read every address in the system, including addresses belonging to users in groups the...

Craft CMS's Missing Authorization in GraphQL Address Resolver Allows Cross-Scope PII Disclosure

Summary The GraphQL Address element resolver src/gql/resolvers/elements/Address.php performs no schema scope filtering on top-level queries. A GraphQL API token scoped to a single low-privilege user group can read every address in the system, including addresses belonging to users in groups the...

com.arcadedb:arcadedb-bolt (>=26.2.1, <=26.3.2), com.arcadedb:arcadedb-coverage (>=21.10.1, <=25.4.1) +10 more potentially affected by CVE-2026-44221 via com.arcadedb:arcadedb-server (>=21.10.1, <=26.3.2)

com.arcadedb:arcadedb-server MAVEN version =21.10.1, =26.2.1, =21.10.1, =21.12.1, =24.11.1, =25.9.1, =25.1.1, =21.10.1, =21.10.1, =21.10.1, =21.10.1, =25.11.1, =26.3.2 - io.github.mdre:adbogm 0.9.0.6 Source cves: CVE-2026-44221 Source advisory: OSV:GHSA-FXC7-FM93-6Q77...

com.arcadedb:arcadedb-bolt (>=26.2.1, <=26.3.2), com.arcadedb:arcadedb-coverage (>=21.10.1, <=25.4.1) +10 more potentially affected by CVE-2026-44221 via com.arcadedb:arcadedb-server (>=21.10.1, <=26.3.2)

com.arcadedb:arcadedb-server MAVEN version =21.10.1, =26.2.1, =21.10.1, =21.12.1, =24.11.1, =25.9.1, =25.1.1, =21.10.1, =21.10.1, =21.10.1, =21.10.1, =25.11.1, =26.3.2 - io.github.mdre:adbogm 0.9.0.6 Source cves: CVE-2026-44221 Source advisory: GHSA-FXC7-FM93-6Q77...

com.arcadedb:arcadedb-bolt (>=26.2.1, <=26.3.2), com.arcadedb:arcadedb-graphql (>=26.1.1, <=26.3.2) +9 more potentially affected by CVE-2026-44221 via com.arcadedb:arcadedb-server (>=26.1.1, <=26.3.2)

com.arcadedb:arcadedb-server MAVEN version =26.1.1, =26.2.1, =26.1.1, =26.1.1, =26.1.1, =26.1.1, =26.1.1, =26.1.1, =26.1.1, =26.1.1, =26.1.1, =26.3.2 - io.github.mdre:adbogm 0.9.0.6 Source cves: CVE-2026-44221 Source advisory: SNYK:JAVA-COMARCADEDB-16638650...

GHSA-3H96-34P3-XM76 GraphQL-Ruby's Ruby lexer does not count comment tokens for the purposes of max_query_string_tokens

GraphQL-Ruby's maxquerystringtokens configuration didn't count comment tokens against the limit, allowing strings to be processed even after the configured maximum had actually been reached. In patched versions, the Ruby lexer does count these tokens. GraphQL-CParser is not affected by this...

Allocation of Resources Without Limits or Throttling

Overview graphql is a plain-Ruby implementation of GraphQL. Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to improper counting of comment tokens in the maxquerystringtokens configuration. An attacker can cause excessive resource...

GraphQL-Ruby's Ruby lexer does not count comment tokens for the purposes of max_query_string_tokens

GraphQL-Ruby's maxquerystringtokens configuration didn't count comment tokens against the limit, allowing strings to be processed even after the configured maximum had actually been reached. In patched versions, the Ruby lexer does count these tokens. GraphQL-CParser is not affected by this...

webonyx/graphql-php has unbounded recursion in parser that causes stack overflow on crafted nested input

Summary GraphQL\Language\Parser is a recursive descent parser with no recursion depth limit and no zend.maxallowedstacksize interaction. Crafted nested queries trigger a SIGSEGV in the PHP runtime, killing the FPM/CLI worker process. Smallest crashing payload is approximately 74 KB. Affected...

GHSA-R7CG-QJJM-XHQQ webonyx/graphql-php has unbounded recursion in parser that causes stack overflow on crafted nested input

Summary GraphQL\Language\Parser is a recursive descent parser with no recursion depth limit and no zend.maxallowedstacksize interaction. Crafted nested queries trigger a SIGSEGV in the PHP runtime, killing the FPM/CLI worker process. Smallest crashing payload is approximately 74 KB. Affected...

Uncontrolled Recursion

Overview Affected versions of this package are vulnerable to Uncontrolled Recursion through unbounded recursion in the Parser process. An attacker can cause process termination and denial of service by submitting a specially crafted, deeply nested input that exhausts the stack and triggers a...

PT-2026-108110

Name of the Vulnerable Software and Affected Versions webonyx graphql-php versions prior to 15.32.3 Description The GraphQLLanguageParser performs recursive descent without a recursion limit in the parseSelectionSet, parseValueLiteral, and parseTypeReference functions. A remote attacker can submi...

PT-2026-41402

GraphQL-Ruby's max query string tokens configuration didn't count comment tokens against the limit, allowing strings to be processed even after the configured maximum had actually been reached. In patched versions, the Ruby lexer does count these tokens. GraphQL-CParser is not affected by this...

webonyx/graphql-php has quadratic validation cost in OverlappingFieldsCanBeMerged via inline fragments

Summary OverlappingFieldsCanBeMerged validation rule has On^2 x m^2 worst case via flattened inline fragments. The CVE-2023-26144 named-fragment cache does not cover inline fragments. A 364 KB query 200 outer x 100 inner inline fragments consumes 117 seconds of CPU per request, with no comparison...