WS-2019-0352

Information Exposure found in type-graphql before 0.17.6. The package leaks the resolver source code in an error message. It is possible to force this error when no subscription topics are provided in the request...

WS-2019-0201

graphql-shield before 6.0.6 has an authorization bypass vulnerability that allows attackers to access information they should not have access to in case of a key collision...

WS-2019-0068

All versions of graphql-code-generator have an Insecure Default Configuration. The packages sets NODETLSREJECTUNAUTHORIZED to 0, disabling certificate verification for the entire project...

WS-2016-0142

GraphQL HTTP is vulnerable to XSS vulnerability. HTML was was not properly escaped in queries or variables causing GraphiQL to break...

CVE-2026-44010

Craft CMS is a content management system CMS. From 4.0.0 to before 4.17.12 and 5.9.18, the GraphQL Address element resolver src/gql/resolvers/elements/Address.php performs no schema scope filtering on top-level queries. A GraphQL API token scoped to a single low-privilege user group can read ever...

Gitlab -- vulnerabilities

Gitlab reports: Cross-site Scripting issue in Analytics dashboard chart rendering impacts GitLab EE Cross-site Scripting issue in global search impacts GitLab CE/EE Cross-site Scripting issue in Duo Agent output rendering impacts GitLab EE Cross-site Scripting issue in Analytics Dashboard impacts...

CVE-2026-44224

Wiki.js is an open source wiki app built on Node.js. Prior to 2.5.313, the users.update GraphQL mutation accepts an arbitrary groups array and applies it directly to the database with no validation of the group IDs supplied. The resolver passes the caller's arguments straight to the model without...

CVE-2026-44010

Craft CMS is a content management system CMS. From 4.0.0 to before 4.17.12 and 5.9.18, the GraphQL Address element resolver src/gql/resolvers/elements/Address.php performs no schema scope filtering on top-level queries. A GraphQL API token scoped to a single low-privilege user group can read ever...

CVE-2026-44224

Wiki.js is an open source wiki app built on Node.js. Prior to 2.5.313, the users.update GraphQL mutation accepts an arbitrary groups array and applies it directly to the database with no validation of the group IDs supplied. The resolver passes the caller's arguments straight to the model without...

EUVD-2026-29838

Wiki.js is an open source wiki app built on Node.js. Prior to 2.5.313, the users.update GraphQL mutation accepts an arbitrary groups array and applies it directly to the database with no validation of the group IDs supplied. The resolver passes the caller's arguments straight to the model without...

CVE-2026-44010

Summary: Craft CMS CVE-2026-44010 describes a missing schema scope filter in the GraphQL Address resolver, enabling a token scoped to a single low-privilege user group to read all addresses in the system, including those outside the token’s authorization. This affects Craft CMS Pro sites (v4.0.0+...

CVE-2026-44010 Craft CMS: Missing Authorization in GraphQL Address Resolver Allows Cross-Scope PII Disclosure

Craft CMS is a content management system CMS. From 4.0.0 to before 4.17.12 and 5.9.18, the GraphQL Address element resolver src/gql/resolvers/elements/Address.php performs no schema scope filtering on top-level queries. A GraphQL API token scoped to a single low-privilege user group can read ever...

CVE-2026-44010 Craft CMS: Missing Authorization in GraphQL Address Resolver Allows Cross-Scope PII Disclosure

Craft CMS is a content management system CMS. From 4.0.0 to before 4.17.12 and 5.9.18, the GraphQL Address element resolver src/gql/resolvers/elements/Address.php performs no schema scope filtering on top-level queries. A GraphQL API token scoped to a single low-privilege user group can read ever...

CVE-2026-44010

Craft CMS is a content management system CMS. From 4.0.0 to before 4.17.12 and 5.9.18, the GraphQL Address element resolver src/gql/resolvers/elements/Address.php performs no schema scope filtering on top-level queries. A GraphQL API token scoped to a single low-privilege user group can read ever...

com.capitalone.dashboard:api (>=3.4.25, <=3.4.52), com.capitalone.dashboard:api-audit (>=3.6.20, <=3.7.33) +6 more potentially affected by CVE-2026-41284 via org.apache.tomcat.embed:tomcat-embed-core (8.5.70)

org.apache.tomcat.embed:tomcat-embed-core MAVEN version 8.5.70 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.tomcat.embed:tomcat-embed-core and may be impacted: - com.capitalone.dashboard:api =3.4.25, =3.6.20, =3.3.8, =1.2.12, =1.3.14 -...

com.capitalone.dashboard:api (>=3.4.25, <=3.4.52), com.capitalone.dashboard:api-audit (>=3.6.20, <=3.7.33) +6 more potentially affected by CVE-2026-43512 via org.apache.tomcat.embed:tomcat-embed-core (8.5.70)

org.apache.tomcat.embed:tomcat-embed-core MAVEN version 8.5.70 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.tomcat.embed:tomcat-embed-core and may be impacted: - com.capitalone.dashboard:api =3.4.25, =3.6.20, =3.3.8, =1.2.12, =1.3.14 -...

com.capitalone.dashboard:api (>=3.4.25, <=3.4.52), com.capitalone.dashboard:api-audit (>=3.6.20, <=3.7.33) +6 more potentially affected by CVE-2026-43515 via org.apache.tomcat.embed:tomcat-embed-core (8.5.70)

org.apache.tomcat.embed:tomcat-embed-core MAVEN version 8.5.70 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.tomcat.embed:tomcat-embed-core and may be impacted: - com.capitalone.dashboard:api =3.4.25, =3.6.20, =3.3.8, =1.2.12, =1.3.14 -...

wiki.js 安全漏洞

Wiki.js is a Wiki application open-sourced by requarks.io. Versions of Wiki.js prior to 2.5.313 contained a security vulnerability. This vulnerability stemmed from the GraphQL mutation in users.update, which accepted an arbitrary groups array and applied it directly to the database without...

CVE-2026-44010: Missing Authorization

Craft CMS is a content management system CMS. From 4.0.0 to before 4.17.12 and 5.9.18, the GraphQL Address element resolver src/gql/resolvers/elements/Address.php performs no schema scope filtering on top-level queries. A GraphQL API token scoped to a single low-privilege user group can read ever...

CVE-2026-44224: Improper Privilege Management

Wiki.js is an open source wiki app built on Node.js. Prior to 2.5.313, the users.update GraphQL mutation accepts an arbitrary groups array and applies it directly to the database with no validation of the group IDs supplied. The resolver passes the caller's arguments straight to the model without...