WPGraphQL has deprecated `user` field on SendPasswordResetEmailPayload that leaks user existence + profile (defeats explicit anti-enumeration design)

Summary The sendPasswordResetEmail mutation in WPGraphQL is explicitly designed to prevent user enumeration. The resolver in src/Mutation/SendPasswordResetEmail.php states in a code comment: // We obsfucate the actual success of this mutation to prevent user enumeration. The mutation always retur...

GitLab GraphQL API User Enumeration

An unauthenticated remote attacker can leverage this vulnerability to collect registered GitLab usernames, names, and email addresses. id: CVE-2021-4191 info: name: GitLab GraphQL API User Enumeration author: zsusac severity: medium description: An unauthenticated remote attacker can leverage thi...

PT-2026-66871

Name of the Vulnerable Software and Affected Versions WPGraphQL versions 2.0.0 through 2.15.0 Description An unauthenticated caller can distinguish existing author-class accounts and obtain public profile fields through the sendPasswordResetEmail mutation. While the mutation is designed to preven...

SUSE CVE-2026-47671

Nhost is an open source Firebase alternative with GraphQL. In versions of Nhost CLI prior to 1.46.0, the hidden nhost configserver used by nhost dev exposes the Mimir GraphQL API with dummy authorization directives and permissive CORS. When a developer is running the local development environment...

SUSE CVE-2026-48529

GitHub MCP Server is GitHub's official MCP Server. From 0.22.0 until 1.1.2, when running in HTTP mode with --lockdown-mode enabled, the RepoAccessCache is implemented as a process-global singleton initialized with the first authenticated user's GraphQL client. All subsequent requests from differe...

CVE-2026-54621

datamodel-code-generator generates Python data models from schema definitions. Prior to 0.60.1, GraphQL Union description values in src/datamodelcodegenerator/model/template/UnionTypeStatement.jinja2 and src/datamodelcodegenerator/model/template/UnionTypeStatement.py312.jinja2 are rendered into...

GHSA-J884-Q54Q-MMX3 `datamodel-code-generator` vulnerable to code injection via unescaped carriage return in GraphQL Union description

Summary datamodel-code-generator is vulnerable to code injection when generating Python models from an attacker-controlled GraphQL schema. A description on a Union type, written in the regular-string form "..." with a literal \r escape, is rendered into a Python comment by a Jinja2 filter that...

`datamodel-code-generator` vulnerable to code injection via unescaped carriage return in GraphQL Union description

Summary datamodel-code-generator is vulnerable to code injection when generating Python models from an attacker-controlled GraphQL schema. A description on a Union type, written in the regular-string form "..." with a literal \r escape, is rendered into a Python comment by a Jinja2 filter that...

Improper Neutralization of Special Elements Used in a Template Engine

Overview datamodel-code-generator is a Datamodel Code Generator Affected versions of this package are vulnerable to Improper Neutralization of Special Elements Used in a Template Engine via the description field in GraphQL Union types when generating Python models. An attacker can execute arbitra...

CVE-2026-54621 `datamodel-code-generator` vulnerable to code injection via unescaped carriage return in GraphQL Union description

datamodel-code-generator generates Python data models from schema definitions. Prior to 0.60.1, GraphQL Union description values in src/datamodelcodegenerator/model/template/UnionTypeStatement.jinja2 and src/datamodelcodegenerator/model/template/UnionTypeStatement.py312.jinja2 are rendered into...

CVE-2026-54621 `datamodel-code-generator` vulnerable to code injection via unescaped carriage return in GraphQL Union description

datamodel-code-generator generates Python data models from schema definitions. Prior to 0.60.1, GraphQL Union description values in src/datamodelcodegenerator/model/template/UnionTypeStatement.jinja2 and src/datamodelcodegenerator/model/template/UnionTypeStatement.py312.jinja2 are rendered into...

CVE-2026-54621

datamodel-code-generator is affected: before version 0.60.1, GraphQL Union description values in UnionTypeStatement templates are rendered into Python comments without neutralizing carriage returns, enabling attacker-controlled GraphQL schema content to inject Python code that executes upon impor...

CVE-2026-54621 `datamodel-code-generator` vulnerable to code injection via unescaped carriage return in GraphQL Union description

datamodel-code-generator generates Python data models from schema definitions. Prior to 0.60.1, GraphQL Union description values in src/datamodelcodegenerator/model/template/UnionTypeStatement.jinja2 and src/datamodelcodegenerator/model/template/UnionTypeStatement.py312.jinja2 are rendered into...

PT-2026-65614

Name of the Vulnerable Software and Affected Versions datamodel-code-generator versions prior to 0.62.0 Description An unauthenticated path traversal and information disclosure issue exists when the software resolves JSON Schema $ref targets. The application fails to restrict these targets to the...

PT-2026-65611

Name of the Vulnerable Software and Affected Versions datamodel-code-generator versions 0.52.1 through 0.60.1 Description When using Pydantic v2 output mode, the software improperly handles data from the --extra-template-data file. Specifically, the process validators function in src/datamodel co...

PT-2026-65608

Name of the Vulnerable Software and Affected Versions datamodel-code-generator versions 0.25.0 through 0.60.0 Description Code injection occurs when generating Python models from an attacker-controlled GraphQL schema. The issue stems from how GraphQL Union description values are rendered into...

Information Exposure

Overview parse-server is a version of the Parse backend that can be deployed to any infrastructure that can run Node.js. Affected versions of this package are vulnerable to Information Exposure via the GraphQL error message handling process. An attacker can obtain the names of required custom inp...

CVE-2026-66008

Parse Server versions = 9.0.0 before 9.10.0-alpha.6 and = 8.2.2 before 8.6.87 disclose Pointer and Relation target class names through GraphQL validation and input-coercion error messages when public schema introspection is disabled graphQLPublicIntrospection: false, the default. Because these...

CVE-2026-66009 Parse Server 9.0.0 Information Disclosure via GraphQL Error Messages

Parse Server versions = 9.0.0 before 9.10.0-alpha.5 and = 8.2.2 before 8.6.86 return GraphQL validation error messages that name required custom input fields even when public introspection is disabled graphQLPublicIntrospection: false, the default. A client holding only the public application id ...

EUVD-2026-48581

Parse Server versions = 9.0.0 before 9.10.0-alpha.5 and = 8.2.2 before 8.6.86 return GraphQL validation error messages that name required custom input fields even when public introspection is disabled graphQLPublicIntrospection: false, the default. A client holding only the public application id ...