CVE-2026-62102

Subscriber Privilege Escalation in Gato GraphQL = 19.2.3 versions...

CVE-2026-62102 WordPress Gato GraphQL plugin <= 19.2.3 - Privilege Escalation vulnerability

Subscriber Privilege Escalation in Gato GraphQL = 19.2.3 versions...

CVE-2026-62102

CVE-2026-62102 affects the WordPress Gato GraphQL plugin in versions 19.2.3 and earlier , where a Subscriber-level privilege escalation vulnerability exists. The CVSS 3.1 score is 8.8 (HIGH) with the vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, indicating a network-attackable flaw requiring only l...

EUVD-2026-76196

Subscriber Privilege Escalation in Gato GraphQL = 19.2.3 versions...

CVE-2026-62102 WordPress Gato GraphQL plugin <= 19.2.3 - Privilege Escalation vulnerability

Subscriber Privilege Escalation in Gato GraphQL = 19.2.3 versions...

CLSA-2026-1789149911 TuxCare security update for org.springframework.graphql:spring-graphql (1 CVE)

TuxCare rebuilt org.springframework.graphql:spring-graphql to address 1 CVE. Fixed in 1.3.5-tuxcare.4...

WordPress Gato GraphQL plugin <= 19.2.3 - Privilege Escalation vulnerability

Privilege Escalation vulnerability discovered by benzdeus in WordPress Plugin Gato GraphQL versions = 19.2.3...

ROOT-APP-MAVEN-CVE-2022-37734 CVE-2022-37734 in com.graphql-java:graphql-java - Patched by Root

Root has patched CVE-2022-37734 in the com.graphql-java:graphql-java package for Root:Maven. Multiple fixed versions available...

PT-2026-96614

TuxCare rebuilt org.springframework.graphql:spring-graphql to address 1 CVE. Fixed in 1.3.5-tuxcare.4...

CVE-2026-49463: Exposure of Sensitive Information to an Unauthorized Actor

NL Portal Backend Libraries provide backend components for Dutch government portals that interact with residents, customers, suppliers, and partner organizations. The nl.nl-portal:documenten-api package through version 3.0.0 and the nl.nl-portal:besluiten package from version 1.5.0 through 3.0.0...

CVE-2026-49462: Exposure of Sensitive Information to an Unauthorized Actor

NL Portal Backend Libraries provide backend components for Dutch government portals that interact with residents, customers, suppliers, and partner organizations. In versions up to and including 3.0.0, deployments using the shipped default configuration exposed two GraphQL developer features...

PT-2026-90492

NL Portal Backend Libraries provide backend components for Dutch government portals that interact with residents, customers, suppliers, and partner organizations. In versions up to and including 3.0.0, deployments using the shipped default configuration exposed two GraphQL developer features...

CVE-2026-62102: Incorrect Privilege Assignment

Subscriber Privilege Escalation in Gato GraphQL = 19.2.3 versions...

CVE-2026-49464: Authorization Bypass Through User-Controlled Key

NL Portal Backend Libraries provide backend components for Dutch government portals that interact with residents, customers, suppliers, and partner organizations. The nl.nl-portal:taak package from version 1.5.0 through 3.0.0 fails to verify ownership when processing the submitTaakV2 GraphQL...

PT-2026-90500

Name of the Vulnerable Software and Affected Versions GitLab EE versions 12.3 through 19.1.8 GitLab EE versions 19.2 through 19.2.5 GitLab EE versions 19.3 through 19.3.1 Description An authenticated user can achieve remote code execution by importing a specially crafted Git project export. This...

PT-2026-90019

Subscriber Privilege Escalation in Gato GraphQL = 19.2.3 versions...

PT-2026-90041

Name of the Vulnerable Software and Affected Versions GitLab EE versions 18.3 through 19.1.7 GitLab EE versions 19.2 through 19.2.5 GitLab EE versions 19.3 through 19.3.1 Description An issue exists where an authenticated user with Duo Chat access can obtain Advanced Search instance configuration...

utcp-gql SSRF: CVE-2026-44661 fix not applied to the GraphQL and WebSocket plugins

SummaryThe fix for CVE-2026-44661 commit 5b16e43 added the ensuresecureurl / issecureurl helpers and wired them into the three HTTP-family plugins, but it did not reach the GraphQL or WebSocket plugins. The GraphQL plugin utcp-gql still uses the startswith prefix check that the fix explicitly...

Malicious Package

Overview graphql-js-client-transform is a malicious package. This package contains malicious code. Although this package may be attempting to impersonate a legitimate organization, it has no connection to that organization or its authors. Remediation Avoid using all malicious instances of the...

CVE-2026-79323

Information disclosure in the blogComments GraphQL query in Magefan Blog GraphQL for Magento 2 magefan/module-blog-graph-ql through 2.2.1 allows remote unauthenticated attackers to obtain blog commenter email addresses and internal customer and admin identifiers via a POST request to /graphql...