CVE-2026-76820

OpenCTI, an open-source cyber threat intelligence platform, is affected by a Server-Side Request Forgery (SSRF) in the synchronizerFetch GraphQL query prior to version 7.260701.0 . The backend's fetchRemoteStreams function validated only the HTTP/HTTPS scheme without applying the ingestion deny l...

EUVD-2026-79241

OpenCTI is an open source platform for managing cyber threat intelligence knowledge and observables. Prior to 7.260701.0, the synchronizerFetch GraphQL query called fetchRemoteStreams after checking only that a remote stream URL used HTTP or HTTPS. The backend did not apply the ingestion deny lis...

CVE-2026-76821 OpenCTI: User-Controlled ReDoS in JSON Ingestion Mapper

OpenCTI is an open source platform for managing cyber threat intelligence knowledge and observables. Prior to 7.260706.0, the JSON ingestion mapper's extractWithRegexp formula function compiled a user-supplied regular expression with the JavaScript RegExp engine in...

CVE-2026-76821 OpenCTI: User-Controlled ReDoS in JSON Ingestion Mapper

OpenCTI is an open source platform for managing cyber threat intelligence knowledge and observables. Prior to 7.260706.0, the JSON ingestion mapper's extractWithRegexp formula function compiled a user-supplied regular expression with the JavaScript RegExp engine in...

CVE-2026-76821

OpenCTI , an open-source cyber threat intelligence platform, is vulnerable to user-controlled ReDoS in the JSON ingestion mapper's extractWithRegexp formula function (prior to 7.260706.0 ). The function compiled a user-supplied regular expression with the JavaScript RegExp engine without validati...

EUVD-2026-79240

OpenCTI is an open source platform for managing cyber threat intelligence knowledge and observables. Prior to 7.260706.0, the JSON ingestion mapper's extractWithRegexp formula function compiled a user-supplied regular expression with the JavaScript RegExp engine in...

ROOT-APP-PYPI-CVE-2026-35526 CVE-2026-35526 in strawberry-graphql - Patched by Root

Root has patched CVE-2026-35526 in the strawberry-graphql package for Root:PyPI. Multiple fixed versions available...

ROOT-APP-PYPI-CVE-2026-35523 CVE-2026-35523 in strawberry-graphql - Patched by Root

Root has patched CVE-2026-35523 in the strawberry-graphql package for Root:PyPI. Multiple fixed versions available...

ROOT-APP-MAVEN-CVE-2026-41856 CVE-2026-41856 in org.springframework.graphql:spring-graphql - Patched by Root

Root has patched CVE-2026-41856 in the org.springframework.graphql:spring-graphql package for Root:Maven. Multiple fixed versions available...

ROOT-APP-MAVEN-CVE-2026-41699 CVE-2026-41699 in org.springframework.graphql:spring-graphql - Patched by Root

Root has patched CVE-2026-41699 in the org.springframework.graphql:spring-graphql package for Root:Maven. Multiple fixed versions available...

ROOT-APP-MAVEN-CVE-2026-41700 CVE-2026-41700 in org.springframework.graphql:spring-graphql - Patched by Root

Root has patched CVE-2026-41700 in the org.springframework.graphql:spring-graphql package for Root:Maven. Multiple fixed versions available...

PT-2026-92469

OpenCTI is an open source platform for managing cyber threat intelligence knowledge and observables. Prior to 7.260706.0, the JSON ingestion mapper's extractWithRegexp formula function compiled a user-supplied regular expression with the JavaScript RegExp engine in...

CVE-2026-76821: Uncontrolled Resource Consumption

OpenCTI is an open source platform for managing cyber threat intelligence knowledge and observables. Prior to 7.260706.0, the JSON ingestion mapper's extractWithRegexp formula function compiled a user-supplied regular expression with the JavaScript RegExp engine in...

PT-2026-92468

OpenCTI is an open source platform for managing cyber threat intelligence knowledge and observables. Prior to 7.260701.0, the synchronizerFetch GraphQL query called fetchRemoteStreams after checking only that a remote stream URL used HTTP or HTTPS. The backend did not apply the ingestion deny lis...

PT-2026-99159

Summary @zereight/mcp-gitlab exposes GitLab to an LLM agent while relying on read-only mode, a project allow-list, and transport auth as its safety controls. Five defects defeat those controls. Under the MCP threat model, tool-call arguments/content can be shaped by untrusted input prompt injecti...

CLSA-2026-1789373257 TuxCare security update for org.springframework.graphql (4 CVEs)

TuxCare rebuilt 2 org.springframework.graphql packages to address 4 CVEs. Fixed in 1.0.6-tuxcare.6...

CLSA-2026-1789369685 TuxCare security update for org.springframework.graphql (1 CVE)

TuxCare rebuilt 2 org.springframework.graphql packages to address 1 CVE. Fixed in 1.2.9-tuxcare.6...

CVE-2026-87719

GitLab has remediated an issue in GitLab EE affecting all versions from 18.3 before 18.11.12, 19.0 before 19.0.9, 19.1 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that under certain conditions could allow an authenticated user with Duo Chat access to obtain Advanced Search instance...

CVE-2026-87719 Deserialization of Untrusted Data in GitLab

GitLab has remediated an issue in GitLab EE affecting all versions from 18.3 before 18.11.12, 19.0 before 19.0.9, 19.1 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that under certain conditions could allow an authenticated user with Duo Chat access to obtain Advanced Search instance...

CVE-2026-87719 Deserialization of Untrusted Data in GitLab

GitLab has remediated an issue in GitLab EE affecting all versions from 18.3 before 18.11.12, 19.0 before 19.0.9, 19.1 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that under certain conditions could allow an authenticated user with Duo Chat access to obtain Advanced Search instance...