`datamodel-code-generator` vulnerable to code injection via unescaped carriage return in GraphQL Union description

Summarydatamodel-code-generator is vulnerable to code injection when generating Python models from an attacker-controlled GraphQL schema. A description on a Union type, written in the regular-string form "..." with a literal \r escape, is rendered into a Python comment by a Jinja2 filter that...

opencti v7.260803.0

Introduction OpenCTI is an open source platform allowing organizations to manage their cyber threat intelligence knowledge and observables. It has been created in order to structure, store, organize and visualize technical and non-technical information about cyber threats. The structuration of th...

Exploit for Improper Privilege Management in Google Chrome

--- 3. CVE-2026-11103 – GraphQL Batching Alias Rate Limit By...

resterm v0.50.0

Resterm A terminal-native API client and workbench for REST, GraphQL, gRPC, WebSocket and SSE. Resterm is an API-as-code workbench - or, in more familiar terms, an API client - built around plain .http and .rest files that you can diff, review and version. It combines interactive request editing...

Exploit for CVE-2026-5432

--- 7. CVE-2026-5432 – GraphQL Batching Alias Confusion SQL...

com.arcadedb:arcadedb-bolt (>=26.2.1, <=26.7.2), com.arcadedb:arcadedb-coverage (>=21.9.1-beta, <=25.4.1) +12 more potentially affected by CVE-2026-68578 via com.arcadedb:arcadedb-server (>=21.9.1-beta, <=26.7.2)

com.arcadedb:arcadedb-server MAVEN version =21.9.1-beta, =26.2.1, =21.9.1-beta, =21.12.1, =24.11.1, =25.9.1, =26.4.2, =25.1.1, =21.9.1-beta, =21.9.1-beta, =21.9.1-beta, =21.9.1-beta, =25.11.1, =26.7.1, =26.7.2 - io.github.mdre:adbogm 0.9.0.6 Source cves: CVE-2026-68578 Source advisory:...

resterm v0.49.4

Resterm A terminal-native API client and workbench for REST, GraphQL, gRPC, WebSocket and SSE. Resterm is an API-as-code workbench - or, in more familiar terms, an API client - built around plain .http and .rest files that you can diff, review and version. It combines interactive request editing...

com.arcadedb:arcadedb-bolt (>=26.2.1, <=26.7.1), com.arcadedb:arcadedb-coverage (>=21.9.1-beta, <=25.4.1) +12 more potentially affected by CVE-2026-67343 via com.arcadedb:arcadedb-server (>=21.9.1-beta, <=26.7.1)

com.arcadedb:arcadedb-server MAVEN version =21.9.1-beta, =26.2.1, =21.9.1-beta, =21.12.1, =24.11.1, =25.9.1, =26.4.2, =25.1.1, =21.9.1-beta, =21.9.1-beta, =21.9.1-beta, =21.9.1-beta, =25.11.1, =26.5.1 - com.arcadedb:arcadedb-tracing 26.7.1 - io.github.mdre:adbogm 0.9.0.6 Source cves: CVE-2026-673...

oxo v2.9.18

OXO Scan Orchestration Engine OXO is a security scanning framework built for modularity, scalability, and simplicity. OXO Engine combines specialized tools to work cohesively to find vulnerabilities and perform actions like recon, enumeration, and fingerprinting. Documentation Agents Store CLI...

CVE-2026-54768

creationtimestamp| type| source ---|---|--- 2026-08-01 00:35:06+00:00| published-proof-of-concept| https://github.com/wp-graphql/wp-graphql/security/advisories/GHSA-jhh7-832h-f8hv 2026-08-01 01:31:13+00:00| seen| https://gist.github.com/alon710/662b2c487ba3f86d2983484c0e6fc728...

EUVD-2026-51676

WPGraphQL provides a GraphQL API for WordPress sites. From 2.0.0 until 2.15.1, the deprecated user field on SendPasswordResetEmailPayload lets an unauthenticated caller distinguish existing author-class accounts through the sendPasswordResetEmail mutation and obtain public profile fields. This...

CVE-2026-54768

WPGraphQL

CVE-2026-54768 WPGraphQL has deprecated `user` field on SendPasswordResetEmailPayload that leaks user existence + profile (defeats explicit anti-enumeration design)

WPGraphQL provides a GraphQL API for WordPress sites. From 2.0.0 until 2.15.1, the deprecated user field on SendPasswordResetEmailPayload lets an unauthenticated caller distinguish existing author-class accounts through the sendPasswordResetEmail mutation and obtain public profile fields. This...

CVE-2026-54768 WPGraphQL has deprecated `user` field on SendPasswordResetEmailPayload that leaks user existence + profile (defeats explicit anti-enumeration design)

WPGraphQL provides a GraphQL API for WordPress sites. From 2.0.0 until 2.15.1, the deprecated user field on SendPasswordResetEmailPayload lets an unauthenticated caller distinguish existing author-class accounts through the sendPasswordResetEmail mutation and obtain public profile fields. This...

CVE-2026-54768

WPGraphQL provides a GraphQL API for WordPress sites. From 2.0.0 until 2.15.1, the deprecated user field on SendPasswordResetEmailPayload lets an unauthenticated caller distinguish existing author-class accounts through the sendPasswordResetEmail mutation and obtain public profile fields. This...

WPGraphQL has deprecated `user` field on SendPasswordResetEmailPayload that leaks user existence + profile (defeats explicit anti-enumeration design)

Summary The sendPasswordResetEmail mutation in WPGraphQL is explicitly designed to prevent user enumeration. The resolver in src/Mutation/SendPasswordResetEmail.php states in a code comment: // We obsfucate the actual success of this mutation to prevent user enumeration. The mutation always retur...

resterm v0.49.3

Resterm A terminal-native API client and workbench for REST, GraphQL, gRPC, WebSocket and SSE. Resterm is an API-as-code workbench - or, in more familiar terms, an API client - built around plain .http and .rest files that you can diff, review and version. It combines interactive request editing...

Missing Authorization

Overview graphql is a plain-Ruby implementation of GraphQL. Affected versions of this package are vulnerable to Missing Authorization in the Execution::Next process. An attacker can access unauthorized fields by triggering authorization failures that do not properly halt execution for fields usin...

resterm v0.49.1

Resterm A terminal-native API client and workbench for REST, GraphQL, gRPC, WebSocket and SSE. Resterm is an API-as-code workbench - or, in more familiar terms, an API client - built around plain .http and .rest files that you can diff, review and version. It combines interactive request editing...

PT-2026-66871

Name of the Vulnerable Software and Affected Versions WPGraphQL versions 2.0.0 through 2.15.0 Description An unauthenticated caller can distinguish existing author-class accounts and obtain public profile fields through the sendPasswordResetEmail mutation. While the mutation is designed to preven...