5386 matches found
com.apollographql.federation:federation-spring-subscription-callback (>=5.1.0, <=7.0.0), com.github.vzakharchenko:bridge-forge-connect (>=1.0.1, <=1.0.2) +117 more potentially affected by CVE-2026-59287 via org.springframework.graphql:spring-graphql (>=1.3.0, <=2.0.4)
org.springframework.graphql:spring-graphql MAVEN version =1.3.0, =5.1.0, =1.0.1, =4.0, =4.0, =3.0, =3.0, =4.0, =4.0, =3.0, =3.0, =4.0, =4.0, =1.2.8, =1.2.8, =1.2.8, =1.4.0 and more Source cves: CVE-2026-59287htt...
CVE-2026-77076: Generation of Error Message Containing Sensitive Information
n8n versions before 1.123.69, 2.33.4, and 2.34.1 contain an information disclosure vulnerability in the GraphQL node. When a GraphQL request fails at the connection level, the node re-throws the underlying HTTP client error unchanged instead of wrapping it in n8n's standard error type. That error...
com.apollographql.federation:federation-spring-subscription-callback (>=6.0.0, <=7.0.0), com.graphql-java-generator.graphql-gradle-plugin3:com.graphql-java-generator.graphql-gradle-plugin3.gradle.plugin (>=4.0, <=4.0.2) +55 more potentially affected by CVE-2026-59285 via org.springframework.graphql:spring-graphql (>=2.0.0, <=2.0.4)
org.springframework.graphql:spring-graphql MAVEN version =2.0.0, =6.0.0, =4.0, =4.0, =4.0, =4.0, =4.0, =4.0, =4.0, =4.0, =4.0, =4.0, =4.0.2 - com.introproventures:graphql-jpa-query-test-boot-starter 1.4.0 - com.introproventures:graphql-jpa-query-test-multiple-datasources 1.4.0 -...
Unsafe Dependency Resolution
Overview org.springframework.graphql:spring-graphql is a GraphQL Support for Spring Applications Affected versions of this package are vulnerable to Unsafe Dependency Resolution via the GraphiQL. An attacker can execute arbitrary JavaScript code in the context of users' browsers by compromising t...
ai.aletyx.kogito:aletyx-kogito-ai-addons-springboot-adhoc-subprocess (>=0.1.0, <=0.2.0), ai.aletyx.kogito:aletyx-kogito-ai-addons-springboot-adhoc-subprocess-storage-jpa (>=0.1.0, <=0.2.0) +3163 more potentially affected by CVE-2026-47890 via org.springframework:spring-webflux (>=6.2.0, <=7.0.8)
org.springframework:spring-webflux MAVEN version =6.2.0, =0.1.0, =0.1.0, =0.114.0, =0.114.0, =0.5.0, =0.8.0, =0.3.0, =0.3.0, =0.3.0, =0.3.0, =0.3.0, =1.0.0, =1.0.0, =1.0.0, =1.0.29 and more Source cves: CVE-2026-47890 Source advisory: SNYK:JAVA-ORGSPRINGFRAMEWORK-19267095...
com.apollographql.federation:federation-spring-subscription-callback (>=4.2.0, <=7.0.0), com.contentmunch:blog-api (>=2.0.0.release, <=2.0.1.release) +155 more potentially affected by CVE-2026-59286 via org.springframework.graphql:spring-graphql (>=1.0.0, <=2.0.4)
org.springframework.graphql:spring-graphql MAVEN version =1.0.0, =4.2.0, =2.0.0.release, =1.0.1, =4.0, =2.0rc1, =2.0rc1, =4.0, =2.0rc1, =2.0rc1, =2.0rc1, =2.0rc1, =2.0rc1, =2.0rc1, =2.0rc1, =2.0rc1,...
PT-2026-78936
Name of the Vulnerable Software and Affected Versions n8n versions prior to 1.123.69 n8n versions prior to 2.34.1 Description A bypass of the allowed-domains policy exists in the GraphQL node. When the Authentication parameter is configured in expression mode, all authentication-gated credential...
PT-2026-79191
Name of the Vulnerable Software and Affected Versions BigBlueButton versions prior to 3.0.29 Description Presenters can submit a presentationId through the '/api/graphql' endpoint that identifies a presentation belonging to a different meeting. The RemovePresentationPubMsgHdlr.scala function fail...
com.apollographql.federation:federation-spring-subscription-callback (>=4.2.0, <=7.0.0), com.contentmunch:blog-api (>=2.0.0.release, <=2.0.1.release) +155 more potentially affected by CVE-2026-59288 via org.springframework.graphql:spring-graphql (>=1.0.0, <=2.0.4)
org.springframework.graphql:spring-graphql MAVEN version =1.0.0, =4.2.0, =2.0.0.release, =1.0.1, =4.0, =2.0rc1, =2.0rc1, =4.0, =2.0rc1, =2.0rc1, =2.0rc1, =2.0rc1, =2.0rc1, =2.0rc1, =2.0rc1, =2.0rc1,...
CVE-2026-77081: Authorization Bypass Through User-Controlled Key
n8n before 1.123.69, 2.x before 2.33.4, and 2.x before 2.34.1 contain an allowed-domains bypass in the GraphQL node. When the node's Authentication parameter is set to expression mode, every authentication-gated credential selector is treated as active; if two credentials of different types are...
Deserialization of Untrusted Data
Overview org.springframework.graphql:spring-graphql is a GraphQL Support for Spring Applications Affected versions of this package are vulnerable to Deserialization of Untrusted Data via the deserialization. An attacker can execute arbitrary code by submitting a crafted GraphQL request containing...
Cross-site Request Forgery (CSRF)
Overview org.springframework.graphql:spring-graphql is a GraphQL Support for Spring Applications Affected versions of this package are vulnerable to Cross-site Request Forgery CSRF via the GraphiQL process. An attacker can access confidential information by enticing a victim with an active sessio...
Allocation of Resources Without Limits or Throttling
Overview org.springframework.graphql:spring-graphql is a GraphQL Support for Spring Applications Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the WebSocketGraphQlClient when the keepAlive option is enabled and an attacker is able to...
PT-2026-78932
Name of the Vulnerable Software and Affected Versions n8n versions prior to 1.123.69 n8n versions prior to 2.33.4 n8n versions prior to 2.34.1 Description The GraphQL node fails to properly handle connection-level errors, re-throwing the underlying HTTP client error without wrapping it in the...
com.apollographql.federation:federation-spring-subscription-callback (>=4.2.0, <=7.0.0), com.contentmunch:blog-api (>=2.0.0.release, <=2.0.1.release) +128 more potentially affected by CVE-2026-59289 via org.springframework.graphql:spring-graphql (>=1.2.0, <=2.0.4)
org.springframework.graphql:spring-graphql MAVEN version =1.2.0, =4.2.0, =2.0.0.release, =1.0.1, =4.0, =4.0, =3.0, =3.0, =4.0, =4.0, =3.0, =3.0, =4.0, =4.0, =1.1.0, =1.1.0, =1.4.0 and more Source cves: CVE-2026-59289https://vul...
Malicious Package
Overview sui-graphql-rpc is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...
Malicious Package
Overview sui-move-graphql is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...
com.arcadedb:arcadedb-console (>=21.10.1, <=22.1.2), com.arcadedb:arcadedb-coverage (>=21.9.1-beta, <=25.4.1) +7 more potentially affected by CVE-2026-76224 via com.arcadedb:arcadedb-gremlin (>=21.9.1-beta, <=26.7.3)
com.arcadedb:arcadedb-gremlin MAVEN version =21.9.1-beta, =21.10.1, =21.9.1-beta, =21.12.1, =21.10.1, =21.9.1-beta, =21.9.1-beta, =21.9.1-beta, =21.9.1-beta, =21.9.1-beta, =22.1.2 Source cves: CVE-2026-76224 Source advisory: MEND:CVE-2026-76224...
com.arcadedb:arcadedb-bolt (>=26.2.1, <=26.7.3), com.arcadedb:arcadedb-console (>=21.9.1-beta, <=26.7.3) +22 more potentially affected by CVE-2026-76223 via com.arcadedb:arcadedb-engine (>=21.9.1-beta, <=26.7.3)
com.arcadedb:arcadedb-engine MAVEN version =21.9.1-beta, =26.2.1, =21.9.1-beta, =21.9.1-beta, =21.12.1, =21.9.1-beta, =25.9.1, =25.9.1, =25.9.1, =26.4.2, =21.9.1-beta, =25.1.1, =21.9.1-beta, =21.9.1-beta, =21.9.1-beta, =21.9.1-beta, =26.7.3 and more Source cves: CVE-2026-76223 Source advisory:...
