GHSA-G8JH-VG5J-4H3F Apollo Router Improperly Enforces Renamed Access Control Directives

Summary A vulnerability in Apollo Router allowed for unauthorized access to protected data through schema elements with access control directives @authenticated, @requiresScopes, and @policy that were renamed via @link imports. Router did not enforce renamed access control directives on schema...

Apollo Router Improperly Enforces Renamed Access Control Directives

Summary A vulnerability in Apollo Router allowed for unauthorized access to protected data through schema elements with access control directives @authenticated, @requiresScopes, and @policy that were renamed via @link imports. Router did not enforce renamed access control directives on schema...

Trojanized ESET Installers Drop Kalambur Backdoor in Phishing Attacks on Ukraine

A previously unknown threat activity cluster has been observed impersonating Slovak cybersecurity company ESET as part of phishing attacks targeting Ukrainian entities. The campaign, detected in May 2025, is tracked by the security outfit under the moniker InedibleOchotense , describing it as...

PT-2025-45376

Name of the Vulnerable Software and Affected Versions Apollo Router Core versions 1.61.11 and earlier Apollo Router Core versions 2.0.0-alpha.0 through 2.8.1-rc.0 Description Apollo Router Core, a configurable graph router written in Rust for Apollo Federation 2, had an access control issue. The...

PT-2025-45720

Summary A vulnerability in Apollo Router allowed for unauthorized access to protected data through schema elements with access control directives @authenticated, @requiresScopes, and @policy that were renamed via @link imports. Router did not enforce renamed access control directives on schema...

CVE-2025-63589

A reflected XSS vulnerability exists in CMSimpleXH 1.8's index.php router when attacker-controlled path segments are not sanitized or encoded before being inserted into the generated HTML navigation links, breadcrumbs, search form action, footer links. An attacker-controlled string placed in the...

Apollo Router Core security vulnerability

Apollo Router Core is a router core application for the Apollo community. A security vulnerability exists in Apollo Router Core versions prior to 1.61.11 and versions 2.0.0-alpha.0 through 2.8.1-rc.0, which stems from mishandling of access control commands and could lead to unauthenticated querie...

PT-2025-45332

Name of the Vulnerable Software and Affected Versions CMSimple XH version 1.8 Description A reflected Cross-Site Scripting XSS issue exists in the index.php router. The issue occurs because attacker-controlled path segments are not properly sanitized or encoded before being included in the...

CVE-2025-64173: Authentication Bypass Using an Alternate Path or Channel

Apollo Router Core is a configurable graph router written in Rust to run a federated supergraph using Apollo Federation 2. In versions 1.61.11 below, as well as 2.0.0-alpha.0 through 2.8.1-rc.0, a vulnerability allowed for unauthenticated queries to access data that required additional access...

CVE-2025-63589

A reflected XSS vulnerability exists in CMSimpleXH 1.8's index.php router when attacker-controlled path segments are not sanitized or encoded before being inserted into the generated HTML navigation links, breadcrumbs, search form action, footer links. An attacker-controlled string placed in the...

Tenda CH22 Router fromAddressNat() Function Code Execution

The vulnerability of the fromAddressNat function /goform/addressNat in the Tenda CH22 router’s microprogramming system is related to the issue of the operation going beyond the buffer boundaries in memory when processing the page parameter. Exploiting this vulnerability could allow a remote...

Tenda CH22 Router Code Execution

The vulnerability of the fromSafeClientFilter function /goform/SafeClientFilter in the Tenda CH22 router software lies in the fact that the operation is executed outside the buffer in memory when processing the page parameter. Exploiting this vulnerability allows an attacker to execute arbitrary...

Tenda CH22 Router fromRouteStatic() Code Execution

The vulnerability of the fromRouteStatic function /goform/RouteStatic of the Tenda CH22 router software lies in the fact that the operation’s output goes beyond the buffer in memory. Exploiting this vulnerability could allow a remote attacker to execute arbitrary code or cause a service failure b...

Tenda CH22 Router Code Execution

The vulnerability of the fromwebExcptypemanFilterr function /goform/webExcptypemanFilter of the Tenda CH22 router software is related to the execution of operations outside the buffer in memory when processing the page parameter. Exploiting this vulnerability could allow an attacker to execute...

PT-2025-45789

Summary A vulnerability in Apollo Router allowed for unauthenticated queries to access data that required additional access controls. Router incorrectly handled access control directives on interface types/fields and their implementing object types/fields, applying them to interface types/fields...

PT-2025-45381

Name of the Vulnerable Software and Affected Versions Apollo Router Core versions 1.61.12-rc.0 through 1.61.12 and 2.8.1-rc.0 through 2.8.1 Description Apollo Router Core, a Rust graph router for Apollo Federation 2, had a flaw where access control directives—specifically @authenticated,...

rapid-router (>=1.0.0.post0.dev406, <=1.0.0.post0.dev408) potentially affected by CVE-2025-64459 via django (1.8.3)

django PYPI version 1.8.3 is affected by a known vulnerability. The following packages have a transitive dependency on django and may be impacted: - rapid-router =1.0.0.post0.dev406, =1.0.0.post0.dev408 Source cves: CVE-2025-64459 Source advisory: OSV:GHSA-FRMV-PR5F-9MCR...

aedttest (0.0.2), aimmo (>=2.5.13, <=2.7.0) +15 more potentially affected by CVE-2025-64458 via django (3.2.18)

django PYPI version 3.2.18 is affected by a known vulnerability. The following packages have a transitive dependency on django and may be impacted: - aedttest 0.0.2 - aimmo =2.5.13, =6.2.2, =6.29.3, =6.29.3, =0.1.1, =0.1.0, =1.1.0, =0.10.0, =0.104.3rc1, =0.9.0rc1, =4.5.0, =5.9.3, =0.7.0rc1, =0.7....

aimmo (>=0.69.9b442, <=0.69.10b450), cfl-common (>=4.30.9, <=4.30.10) +2 more potentially affected by CVE-2025-64459 via django (2.2.22)

django PYPI version 2.2.22 is affected by a known vulnerability. The following packages have a transitive dependency on django and may be impacted: - aimmo =0.69.9b442, =4.30.9, =4.30.9, =4.30.10 - rapid-router 2.7.6 Source cves: CVE-2025-64459 Source advisory: OSV:GHSA-FRMV-PR5F-9MCR...

aimmo (>=0.28.0b5241, <=0.61.8b52), cfl-common (>=3.1.4, <=4.14.2) +2 more potentially affected by CVE-2025-64459 via django (1.11.24)

django PYPI version 1.11.24 is affected by a known vulnerability. The following packages have a transitive dependency on django and may be impacted: - aimmo =0.28.0b5241, =3.1.4, =2.19.0, =2.2.0, =2.4.12 Source cves: CVE-2025-64459 Source advisory: OSV:GHSA-FRMV-PR5F-9MCR...