aas2openapi (>=0.2.0, <=0.2.4), adelecv (>=0.0.1, <=0.0.2) +84 more potentially affected by CVE-2026-35526 via strawberry-graphql (>=0.16.10, <=0.312.0)

strawberry-graphql PYPI version =0.16.10, =0.2.0, =0.0.1, =0.0.1, =0.1.1, =0.1.0, =0.1.0, =0.3.0, =0.1.0, =0.1.0, =0.1.0, =0.0.2rc0, =25.13.0rc1, =1.2.0, =0.1.1, =0.2.0, =0.21.0 and more Source cves: CVE-2026-35526 Source advisory: GHSA-HV3W-M4G2-5X77...

GHSA-VPWC-V33Q-MQ89 strawberry-graphql: Authentication bypass via legacy graphql-ws WebSocket subprotocol

Strawberry up until version 0.312.3 is vulnerable to an authentication bypass on WebSocket subscription endpoints. The legacy graphql-ws subprotocol handler does not verify that a connectioninit handshake has been completed before processing start subscription messages. This allows a remote...

Missing Authentication for Critical Function

Overview strawberry-graphql is an A library for creating GraphQL APIs Affected versions of this package are vulnerable to Missing Authentication for Critical Function via the onwsconnect process. An attacker can gain unauthorized access to WebSocket subscription endpoints by connecting with the...

strawberry-graphql: Authentication bypass via legacy graphql-ws WebSocket subprotocol

Strawberry up until version 0.312.3 is vulnerable to an authentication bypass on WebSocket subscription endpoints. The legacy graphql-ws subprotocol handler does not verify that a connectioninit handshake has been completed before processing start subscription messages. This allows a remote...

aas2openapi (>=0.2.0, <=0.2.4), adelecv (>=0.0.1, <=0.0.2) +84 more potentially affected by CVE-2026-35523 via strawberry-graphql (>=0.16.10, <=0.312.0)

strawberry-graphql PYPI version =0.16.10, =0.2.0, =0.0.1, =0.0.1, =0.1.1, =0.1.0, =0.1.0, =0.3.0, =0.1.0, =0.1.0, =0.1.0, =0.0.2rc0, =25.13.0rc1, =1.2.0, =0.1.1, =0.2.0, =0.21.0 and more Source cves: CVE-2026-35523 Source advisory: GHSA-VPWC-V33Q-MQ89...

aas2openapi (>=0.2.0, <=0.2.4), adelecv (>=0.0.1, <=0.0.2) +84 more potentially affected by CVE-2026-35523 via strawberry-graphql (>=0.16.10, <=0.312.0)

strawberry-graphql PYPI version =0.16.10, =0.2.0, =0.0.1, =0.0.1, =0.1.1, =0.1.0, =0.1.0, =0.3.0, =0.1.0, =0.1.0, =0.1.0, =0.0.2rc0, =25.13.0rc1, =1.2.0, =0.1.1, =0.2.0, =0.21.0 and more Source cves: CVE-2026-35523 Source advisory: OSV:GHSA-VPWC-V33Q-MQ89...

aas2openapi (>=0.2.0, <=0.2.4), adelecv (>=0.0.1, <=0.0.2) +84 more potentially affected by CVE-2026-35523 via strawberry-graphql (>=0.16.10, <=0.312.0)

strawberry-graphql PYPI version =0.16.10, =0.2.0, =0.0.1, =0.0.1, =0.1.1, =0.1.0, =0.1.0, =0.3.0, =0.1.0, =0.1.0, =0.1.0, =0.0.2rc0, =25.13.0rc1, =1.2.0, =0.1.1, =0.2.0, =0.21.0 and more Source cves: CVE-2026-35523 Source advisory: SNYK:PYTHON-STRAWBERRYGRAPHQL-15922312...

kedro-graphql (>=0.1.2, <=0.4.0), kedro-snowflake (>=0.1.0, <=0.1.1) potentially affected by CVE-2026-111170 +1 more via kedro-datasets (1.2.0)

kedro-datasets PYPI version 1.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on kedro-datasets and may be impacted: - kedro-graphql =0.1.2, =0.1.0, =0.1.1 Source cves: CVE-2026-111170, CVE-2026-35492 Source advisory: OSV:GHSA-CJG8-H5QC-HRJV...

dbt-duckdb-kedro-datasets (>=0.1.0, <=0.1.2), kedro-graphql (>=0.5.0, <=0.5.1) +1 more potentially affected by CVE-2026-111170 +1 more via kedro-datasets (3.0.1)

kedro-datasets PYPI version 3.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on kedro-datasets and may be impacted: - dbt-duckdb-kedro-datasets =0.1.0, =0.5.0, =0.2.0, =0.3.0rc1 Source cves: CVE-2026-111170, CVE-2026-35492 Source advisory:...

kedro-azureml (0.9.0), kedro-graphql (>=1.1.0, <=1.5.1) +4 more potentially affected by CVE-2026-111170 +1 more via kedro-datasets (7.0.0)

kedro-datasets PYPI version 7.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on kedro-datasets and may be impacted: - kedro-azureml 0.9.0 - kedro-graphql =1.1.0, =0.12.2, =0.7.0, =0.1.0, =0.1.3 Source cves: CVE-2026-111170, CVE-2026-35492 Source...

BIT-PARSE-2026-34573 Parse Server: GraphQL complexity validator exponential fragment traversal DoS

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 8.6.68 and 9.7.0, the GraphQL query complexity validator can be exploited to cause a denial-of-service by sending a crafted query with binary fan-out fragment spreads. A singl...

BIT-PARSE-2026-34373 Parse Server: GraphQL API endpoint ignores CORS origin restriction

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 8.6.66 and 9.7.0, the GraphQL API endpoint does not respect the allowOrigin server option and unconditionally allows cross-origin requests from any website. This bypasses orig...

PT-2026-30761

Name of the Vulnerable Software and Affected Versions Strawberry GraphQL versions through 0.312.3 Description Strawberry GraphQL is susceptible to an authentication bypass on WebSocket subscription endpoints. The legacy graphql-ws subprotocol handler does not verify completion of a connection ini...

Directus information leakage vulnerability

Directus is an open-source real-time API and application dashboard developed by Directus. It is used to manage SQL database content. Versions of Directus prior to 11.16.1 contained a vulnerability related to information leakage. This vulnerability stemmed from the serverspecs GraphQL parser not...

Directus security vulnerabilities

Directus is an open-source real-time API and application dashboard developed by Directus. It is used to manage SQL database content. Versions of Directus prior to 11.17.0 contained a security vulnerability. This vulnerability stemmed from GraphQL endpoints not repeatedly calling the data deletion...

CVE-2026-35441: Uncontrolled Resource Consumption

Directus is a real-time API and App dashboard for managing SQL database content. Prior to 11.17.0, Directus' GraphQL endpoints /graphql and /graphql/system did not deduplicate resolver invocations within a single request. An authenticated user could exploit GraphQL aliasing to repeat an expensive...

CVE-2026-35413: Exposure of Sensitive Information to an Unauthorized Actor

Directus is a real-time API and App dashboard for managing SQL database content. Prior to 11.16.1, when GRAPHQLINTROSPECTION=false is configured, Directus correctly blocks standard GraphQL introspection queries schema, type. However, the serverspecsgraphql resolver on the /graphql/system endpoint...

PT-2026-33391

Hi, I found that 6 endpoints in Authorizer accept a user-controlled redirect uri and append sensitive tokens to it without validating the URL against AllowedOrigins. The OAuth /app handler validates redirect uri at http handlers/app.go:46, but the GraphQL mutations and verify email handler skip...

Directus: Unauthenticated Denial of Service via GraphQL Alias Amplification of Expensive Health Check Resolver

Summary The GraphQL specification permits a single query to repeat the same field multiple times using aliases, with each alias resolved independently by default. Directus did not deduplicate resolver invocations within a single request, meaning each alias triggered a full, independent execution ...

GHSA-6Q22-G298-GRJH Directus: Unauthenticated Denial of Service via GraphQL Alias Amplification of Expensive Health Check Resolver

Summary The GraphQL specification permits a single query to repeat the same field multiple times using aliases, with each alias resolved independently by default. Directus did not deduplicate resolver invocations within a single request, meaning each alias triggered a full, independent execution ...