Gitlab-CVE-2026-19478

CVE-2026-19478 — GitLab GraphQL @glintroduced Directive Injection Unauthenticated Remote Code Injection via GraphQL Directive in GitLab CE/EE — Delete Any Public Project With a Single HTTP Request A hands-on penetration testing lab that reproduces CVE-2026-19478, a critical CVSS 9.4 vulnerability...

stump-smartlist-bola

Stump: Smart List Takeover via Broken Access Control BOLA...

CVE-2026-24136-Lab

CVE-2026-24136 - IDOR de GraphQL de Saleor / Exfiltración de PII no autenticada Resumen Campo| Detalle ---|--- CVE ID| CVE-2026-24136 Tipo de vulnerabilidad| IDOR - Authorization Bypass Through User-Controlled Key CWE-639 Software| Saleor e-commerce platform Versiones afectadas| 3.2.0 - 3.20.109 ...

PT-2026-106079

Plane is an open-source project management tool. Prior to 1.4.0, the GraphQL joinProject mutation lets any workspace member add themselves to any project in that workspace including network=0 secret/private projects they were never invited to and grants them a full Member role read + write. The...

PT-2026-106267

Name of the Vulnerable Software and Affected Versions GraphQL Tools versions prior to 12.0.1 Description The mergeDeep function in the GraphQL Tools utils package fails to exclude proto , constructor, or prototype keys while recursively merging source objects. An unauthenticated client can alias...

PT-2026-106275

Twenty is an open-source CRM customer relationship management platform. From 1.20.10 until 2.7.0, the /metadata GraphQL connectedAccounts query returned connectionParameters from ConnectedAccountDTO for every connected account in a workspace, including plaintext IMAP, SMTP, and CalDAV passwords,...

CVE-2026-105632: Improper Access Control

Plane is an open-source project management tool. Prior to 1.4.0, the GraphQL joinProject mutation lets any workspace member add themselves to any project in that workspace including network=0 secret/private projects they were never invited to and grants them a full Member role read + write. The...

cve-2026-19478

CVE-2026-19478 — GitLab GraphQL @glintroduced version-filter vulnerabilities A reproduction lab for two related bugs in GitLab's GraphQL version-filter feature the @glintroduced directive. Both live in the same feature area, are fixed by the same upstream patch, and both let a GraphQL request rea...

CVE-2021-4191_Exploits

CVE-2021-4191Exploits pip install python-graphql-client Uso: python3 gitlabenum.py --rurl http://10.0.0.6/api/graphql Derechos de autor: https://www.rapid7.com/blog/post/2022/03/03/cve-2021-4191-gitlab-graphql-api-user-enumeration-fixed/...

CVE-2025-27407

CVE-2025-27407 GitLab Podman ラボ GitLab Direct Transfer HTTP パスが脆弱な graphql-ruby イントロスペクションスキーマローダーに到達することを実証するための、最小限のローカル専用ラボです。このラボは1つの脆弱な GitLab CE コンテナを実行します。PoC スクリプトはテスト中のみ、その偽の GitLab ソースサーバーをインプロセスで起動します。 自分が所有するシステム、または明示的にテスト許可を得たシステムに対してのみ実行してください。 ファイル ファイル| 目的 ---|--- lab.sh| GitLab...

Improper Certificate Validation

Overview @graphql-tools/executor-legacy-ws is an A set of utils for faster development of GraphQL tools Affected versions of this package are vulnerable to Improper Certificate Validation via a hardcoded rejectUnauthorized: false in buildWSLegacyExecutor, which unconditionally disables TLS...

Improper Certificate Validation

Overview Affected versions of this package are vulnerable to Improper Certificate Validation via a hardcoded rejectUnauthorized: false in buildWSLegacyExecutor, which unconditionally disables TLS certificate validation for all wss:// connections and cannot be overridden by callers. An attacker...

CVE-2026-103921

GraphQL Tools provides utilities for building, stitching, and mocking GraphQL schemas. Prior to 1.1.35, the executor-legacy-ws buildWSLegacyExecutor function hardcodes TLS certificate rejection off for Node.js connections to wss:// endpoints. Applications using the executor directly, or url-loade...

CVE-2026-103921 GraphQL Tools: TLS Certificate Validation Disabled in Legacy GraphQL WebSocket Executor

GraphQL Tools provides utilities for building, stitching, and mocking GraphQL schemas. Prior to 1.1.35, the executor-legacy-ws buildWSLegacyExecutor function hardcodes TLS certificate rejection off for Node.js connections to wss:// endpoints. Applications using the executor directly, or url-loade...

CVE-2026-103921

The GraphQL Tools library (prior to version 1.1.35 ) contains a vulnerability where the executor-legacy-ws buildWSLegacyExecutor() function hardcodes TLS certificate rejection to be disabled for Node.js connections to wss:// endpoints. If an application uses this executor directly or uses url-loa...

CVE-2026-103921 GraphQL Tools: TLS Certificate Validation Disabled in Legacy GraphQL WebSocket Executor

GraphQL Tools provides utilities for building, stitching, and mocking GraphQL schemas. Prior to 1.1.35, the executor-legacy-ws buildWSLegacyExecutor function hardcodes TLS certificate rejection off for Node.js connections to wss:// endpoints. Applications using the executor directly, or url-loade...

CVE-2026-103921 GraphQL Tools: TLS Certificate Validation Disabled in Legacy GraphQL WebSocket Executor

GraphQL Tools provides utilities for building, stitching, and mocking GraphQL schemas. Prior to 1.1.35, the executor-legacy-ws buildWSLegacyExecutor function hardcodes TLS certificate rejection off for Node.js connections to wss:// endpoints. Applications using the executor directly, or url-loade...

PT-2026-103947

Name of the Vulnerable Software and Affected Versions GraphQL Tools versions prior to 1.1.35 Description The buildWSLegacyExecutor function in the executor-legacy-ws module hardcodes the TLS certificate rejection to off for Node.js connections to wss:// endpoints. This allows applications using t...

CVE-2026-103921: Improper Certificate Validation

GraphQL Tools provides utilities for building, stitching, and mocking GraphQL schemas. Prior to 1.1.35, the executor-legacy-ws buildWSLegacyExecutor function hardcodes TLS certificate rejection off for Node.js connections to wss:// endpoints. Applications using the executor directly, or url-loade...

CVE-2026-55094

Taskcluster is the task execution framework that supports Mozilla's continuous integration and release processes. Prior to version 100.3.0, Taskcluster is vulnerable to unauthenticated RCE on Taskcluster deployments with an anonymous role that exposes the GraphQL endpoint and parses filter...