CVE-2026-21886: Improper Authorization

OpenCTI is an open source platform for managing cyber threat intelligence knowledge and observables. Prior to version 6.9.1, the GraphQL mutations "IndividualDeletionDeleteMutation" is intended to allow users to delete individual entity objects respectively. However, it was observed that this...

OpenCTI 安全漏洞

OpenCTI is an open-source network threat intelligence platform developed by OpenCTI. Versions of OpenCTI prior to 6.9.1 contained security vulnerabilities. These vulnerabilities were due to a flaw in GraphQL mutations that lacked validation, which could lead to the deletion of irrelevant and...

CVE-2026-32594

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 8.6.40 and 9.6.0-alpha.14, the GraphQL WebSocket endpoint for subscriptions does not pass requests through the Express middleware chain that enforces authentication, introspection...

Malicious code in graphql-request-dom (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 12e85257ce18204d98a8a6181fa40a75d7feb91477b98f6b86ba89223a9f4e51 The package graphql-request-dom was found to contain malicious code. Source: ghsa-malware...

Malicious Package

Overview graphql-request-dom is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

MAL-2026-1444 Malicious code in graphql-request-dom (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 12e85257ce18204d98a8a6181fa40a75d7feb91477b98f6b86ba89223a9f4e51 The package graphql-request-dom was found to contain malicious code. Source: ghsa-malware...

Malicious code in typescript-type-graphql (npm)

The package 'typescript-type-graphql' is part of the PhantomRaven supply chain attack campaign Wave 2. It uses a Remote Dynamic Dependency RDD technique: the published package appears benign but includes a URL-based dependency in package.json pointing to an attacker-controlled C2 server...

CVE-2026-32594: Missing Authentication for Critical Function

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 8.6.40 and 9.6.0-alpha.14, the GraphQL WebSocket endpoint for subscriptions does not pass requests through the Express middleware chain that enforces authentication, introspection...

Parse Server 访问控制错误漏洞

Parse Server is an open-source backend developed by the Parse Platform. It can be deployed on any infrastructure that supports Node.js. There were access control vulnerability issues in versions of Parse Server prior to 8.6.40 and 9.6.0-alpha.14. This vulnerability stemmed from the GraphQL...

MAL-2026-1540 Malicious code in typescript-type-graphql (npm)

The package 'typescript-type-graphql' is part of the PhantomRaven supply chain attack campaign Wave 2. It uses a Remote Dynamic Dependency RDD technique: the published package appears benign but includes a URL-based dependency in package.json pointing to an attacker-controlled C2 server...

EUVD-2026-11707

Anchore Enterprise versions before 5.25.1 contain an SQL injection vulnerability in the GraphQL Reports API. An authenticated attacker that is able to access the GraphQL API could execute arbitrary SQL instructions resulting in modifications to the data contained in the Anchore Enterprise databas...

@lenne.tech/nest-server (>=10.8.3, <=11.1.13), @pothos-examples/federation (3.1.13) +1 more potentially affected by CVE-2026-32621 via @apollo/gateway (>=2.10.0, <=2.10.2)

@apollo/gateway NPM version =2.10.0, =10.8.3, =11.1.13 - @pothos-examples/federation 3.1.13 - @pothos-examples/prisma-federation 3.1.24 Source cves: CVE-2026-32621 Source advisory: SNYK:JS-APOLLOGATEWAY-15612461...

@genesisx/graphql (>=3.0.0-beta.1, <=4.0.1), @genesisx/graphql-utils (>=3.0.0-beta.0, <=3.0.1) +9 more potentially affected by CVE-2026-32621 via @apollo/gateway (>=2.0.0-preview.2, <=2.9.3)

@apollo/gateway NPM version =2.0.0-preview.2, =3.0.0-beta.1, =3.0.0-beta.0, =0.11.46-alpha-bad726532.0, =0.0.1, =8.6.7, =2.8.54, =0.0.0-preview-20220428090254, =0.0.0-preview-20221125005457, =1.3.3, =0.0.3, =1.0.48 - nestjs-registry 0.0.1 Source cves: CVE-2026-32621 Source advisory:...

@apollo/composition (>=2.13.0, <=2.13.1), @apollo/gateway (>=2.13.0, <=2.13.1) +4 more potentially affected by CVE-2026-32621 via @apollo/federation-internals (>=2.13.0, <=2.13.1)

@apollo/federation-internals NPM version =2.13.0, =2.13.0, =2.13.0, =2.13.0, =2.13.0, =2.13.0, =0.0.0, =0.0.2-alpha-20260313130016-7fe861602b61cb29c75e6d7e84eae979268037af Source cves: CVE-2026-32621 Source advisory: OSV:GHSA-PFJJ-6F4P-RVMH...

@lenne.tech/nest-server (>=11.3.0, <=11.5.0) potentially affected by CVE-2026-32621 via @apollo/gateway (2.12.0)

@apollo/gateway NPM version 2.12.0 is affected by a known vulnerability. The following packages have a transitive dependency on @apollo/gateway and may be impacted: - @lenne.tech/nest-server =11.3.0, =11.5.0 Source cves: CVE-2026-32621 Source advisory: OSV:GHSA-PFJJ-6F4P-RVMH...

Prototype Pollution

Overview @apollo/query-planner is an Apollo Query Planner Affected versions of this package are vulnerable to Prototype Pollution through incomplete sanitization of input in the query plan execution. An attacker can manipulate the Object.prototype in the gateway by crafting operations with field...

@genesisx/graphql (>=3.0.0-beta.1, <=4.0.1), @genesisx/graphql-utils (>=3.0.0-beta.0, <=3.0.1) +9 more potentially affected by CVE-2026-32621 via @apollo/gateway (>=2.0.0-preview.2, <=2.9.3)

@apollo/gateway NPM version =2.0.0-preview.2, =3.0.0-beta.1, =3.0.0-beta.0, =0.11.46-alpha-bad726532.0, =0.0.1, =8.6.7, =2.8.54, =0.0.0-preview-20220428090254, =0.0.0-preview-20221125005457, =1.3.3, =0.0.3, =1.0.48 - nestjs-registry 0.0.1 Source cves: CVE-2026-32621 Source advisory:...

Prototype Pollution

Overview @apollo/gateway is a library exporting utility functions. Affected versions of this package are vulnerable to Prototype Pollution through incomplete sanitization of input in the query plan execution. An attacker can manipulate the Object.prototype in the gateway by crafting operations wi...

GHSA-P2X3-8689-CWPG Parse Server's GraphQL WebSocket endpoint bypasses security middleware

Impact Any Parse Server deployment that uses the GraphQL API is affected. The GraphQL WebSocket endpoint for subscriptions does not pass requests through the Express middleware chain that enforces authentication, introspection control, and query complexity limits. An attacker can connect to the...

Missing Authentication for Critical Function

Overview parse-server is a version of the Parse backend that can be deployed to any infrastructure that can run Node.js. Affected versions of this package are vulnerable to Missing Authentication for Critical Function in the createSubscriptions process. An attacker can execute unauthorized GraphQ...