3103 matches found
CVE-2026-104057 Podgrab Unauthenticated DoS via Concurrent Map Access in WebSocket Handler
Podgrab contains an unauthenticated denial-of-service vulnerability caused by unsynchronized concurrent access to shared maps activePlayers and allConnections in its WebSocket handler, where Wshandler and HandleWebsocketMessages goroutines read and write these maps without a mutex. A remote...
@graphql-tools/prisma-loader (>=8.0.0-alpha-20230517123108-df347e95, <=8.0.17-alpha-20241113142246-527bbf8c4e20af3d172439ab4746fe676b3a61c5), @graphql-tools/url-loader (>=8.0.0-alpha-20230517123108-df347e95, <=9.1.9-rc-20260908112455-501eab0b35c6e76223e7ed3d60d6e26c72127f1a) +1 more potentially affected by CVE-2026-103921 via @graphql-tools/executor-legacy-ws (>=1.0.0-alpha-20230517123108-df347e95, <=1.1.35-rc-20260908112455-501eab0b35c6e76223e7ed3d60d6e26c72127f1a)
@graphql-tools/executor-legacy-ws NPM version =1.0.0-alpha-20230517123108-df347e95, =8.0.0-alpha-20230517123108-df347e95, =8.0.0-alpha-20230517123108-df347e95, =9.1.9-rc-20260908112455-501eab0b35c6e76223e7ed3d60d6e26c72127f1a - graphql-config 5.0.0-alpha-20230519081831-037f0ba Source cves:...
Improper Certificate Validation
Overview @graphql-tools/executor-legacy-ws is an A set of utils for faster development of GraphQL tools Affected versions of this package are vulnerable to Improper Certificate Validation via a hardcoded rejectUnauthorized: false in buildWSLegacyExecutor, which unconditionally disables TLS...
CVE-2026-103921
GraphQL Tools provides utilities for building, stitching, and mocking GraphQL schemas. Prior to 1.1.35, the executor-legacy-ws buildWSLegacyExecutor function hardcodes TLS certificate rejection off for Node.js connections to wss:// endpoints. Applications using the executor directly, or url-loade...
aiorest-ws (>=1.1.0, <=1.1.1) potentially affected by CVE-2026-77528 via autobahn (0.16.0)
autobahn PYPI version 0.16.0 is affected by a known vulnerability. The following packages have a transitive dependency on autobahn and may be impacted: - aiorest-ws =1.1.0, =1.1.1 Source cves: CVE-2026-77528 Source advisory: OSV:PYSEC-2026-4027...
CVE-2026-103921 GraphQL Tools: TLS Certificate Validation Disabled in Legacy GraphQL WebSocket Executor
GraphQL Tools provides utilities for building, stitching, and mocking GraphQL schemas. Prior to 1.1.35, the executor-legacy-ws buildWSLegacyExecutor function hardcodes TLS certificate rejection off for Node.js connections to wss:// endpoints. Applications using the executor directly, or url-loade...
CVE-2026-103921 GraphQL Tools: TLS Certificate Validation Disabled in Legacy GraphQL WebSocket Executor
GraphQL Tools provides utilities for building, stitching, and mocking GraphQL schemas. Prior to 1.1.35, the executor-legacy-ws buildWSLegacyExecutor function hardcodes TLS certificate rejection off for Node.js connections to wss:// endpoints. Applications using the executor directly, or url-loade...
02strich-markdown (>=1.0.0, <=1.0.2), 0xsodium (>=0.2.0, <=0.14.0) +774 more potentially affected by CVE-2026-103921 via @graphql-tools/executor-legacy-ws (>=0.0.1-alpha-20221108142800-3beb5fe2, <=1.1.35-rc-20260908112455-501eab0b35c6e76223e7ed3d60d6e26c72127f1a)
@graphql-tools/executor-legacy-ws NPM version =0.0.1-alpha-20221108142800-3beb5fe2, =1.0.0, =0.2.0, =0.0.1-b, =0.2.0, =0.2.0, =0.5.2, =5.0.2, =2.2.0, =1.1.4, =1.3.1, =1.0.0, =0.0.2-alpha-20220914223128-d706aab, =0.0.2-alpha-20220915073207-1bb0680, =0.0.2-alpha-20221101100428-eb8da76 and more Sour...
CVE-2026-103921
GraphQL Tools provides utilities for building, stitching, and mocking GraphQL schemas. Prior to 1.1.35, the executor-legacy-ws buildWSLegacyExecutor function hardcodes TLS certificate rejection off for Node.js connections to wss:// endpoints. Applications using the executor directly, or url-loade...
CVE-2026-103921
The GraphQL Tools library (prior to version 1.1.35 ) contains a vulnerability where the executor-legacy-ws buildWSLegacyExecutor() function hardcodes TLS certificate rejection to be disabled for Node.js connections to wss:// endpoints. If an application uses this executor directly or uses url-loa...
PT-2026-105915
Summary Before tokenizing, selector iter trims leading/trailing whitespace and comments by running two regexes over the whole raw selector with .search. The trailing one, RE WS END = re.compiler'WSC$', is anchored only at the end $, not the start. Because .search retries the pattern at every...
CVE-2026-104058: Missing Authentication for Critical Function
Podgrab contains a missing authentication vulnerability in which the /ws WebSocket route is registered on the root gin engine instead of the BasicAuth-protected router group, allowing unauthenticated network clients to connect even when PASSWORD is configured. Attackers can join the allConnection...
PT-2026-103947
Name of the Vulnerable Software and Affected Versions GraphQL Tools versions prior to 1.1.35 Description The buildWSLegacyExecutor function in the executor-legacy-ws module hardcodes the TLS certificate rejection to off for Node.js connections to wss:// endpoints. This allows applications using t...
Linux Distros Unpatched Vulnerability : CVE-2026-87830
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the StAX streaming WS-SecurityPolicy validator, certain relative or unsupported XPath expressions can be converted into paths that never match the actual XML...
Rocky Linux 9.2 [CIQ] Security Update: fence-agents-aliyun / fence-agents-all / fence-agents-amt-ws / etc Multiple Vulnerabilities (ciqsa-2026_0411)
The Rocky Linux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ ciqsa-20260411 advisory. This advisory aggregates security fixes for the fence-agents SRPM in CIQ LTS 9.2. It addresses 10 CVEs: CVE-2023-52323, CVE-2023-45803, CVE-2024-34064,...
Rocky Linux 9.4 [CIQ] Security Update: fence-agents-aliyun / fence-agents-all / fence-agents-amt-ws / etc Multiple Vulnerabilities (ciqsa-2026_0527)
The Rocky Linux 9.4 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ ciqsa-20260527 advisory. This advisory aggregates security fixes for the fence-agents SRPM in CIQ LTS 9.4. It addresses 2 CVEs: CVE-2024-56201, CVE-2024-56326. Tenable has...
EUVD-2026-90085
Soft Machine is a Virtual Machine–based agentic development environment / Cloud OS. In versions 0.2.247 and prior, the workspace HTTP service that listens on 0.0.0.0:8080 inside each sm-ws- Fly Machine exposes endpoints /health, /file/, /archive/ without any authentication or origin check. Any ho...
edu.internet2.middleware.grouper:grouper-ui (>=6.0.0, <=6.4.0), edu.internet2.middleware.grouper:grouper-ws (>=6.0.0, <=6.4.0) potentially affected by CVE-2026-103470 via edu.internet2.middleware.grouper:grouper (>=6.0.0, <=6.4.0)
edu.internet2.middleware.grouper:grouper MAVEN version =6.0.0, =6.0.0, =6.0.0, =6.4.0 Source cves: CVE-2026-103470 Source advisory: MEND:CVE-2026-103470...
edu.internet2.middleware.grouper:grouper-ui (>=7.0.0, <=7.5.0), edu.internet2.middleware.grouper:grouper-ws (>=7.0.0, <=7.5.0) potentially affected by CVE-2026-103470 via edu.internet2.middleware.grouper:grouper (>=7.0.0, <=7.5.0)
edu.internet2.middleware.grouper:grouper MAVEN version =7.0.0, =7.0.0, =7.0.0, =7.5.0 Source cves: CVE-2026-103470 Source advisory: MEND:CVE-2026-103470...