CVE-2026-5432-GraphQL-Batching-Alias-Confusion-SQL-Injection

7. CVE-2026-5432 – GraphQLバッチ処理エイリアス混乱SQLインジェクション 概要 GraphQLリゾルバは、フィールドエイリアスからSQLクエリを動的に構築します。バッチ処理とエイリアスを使用することで、攻撃者は許可リストを回避してSQLを注入できます。 深刻度: Critical（データベース乗っ取り） Node.jsサーバーとエクスプロイト root@kitploit: // vulnerablegraphqlserver.js const express = require'express'; const graphqlHTTP =...

PT-2026-81886

Name of the Vulnerable Software and Affected Versions Apache Tomcat versions 11.0.0-M1 through 11.0.24 Apache Tomcat versions 10.1.0-M1 through 10.1.57 Apache Tomcat versions 9.0.25 through 9.0.120 Apache Tomcat versions 8.5.46 through 8.5.100 Apache Tomcat versions 7.0.97 through 7.0.109...

EUVD-2026-36315

OpenClaw: Embedded runner policy could be confused by provider aliases...

CVE-2026-53809 OpenClaw < 2026.4.25 - Provider Alias Confusion in Embedded Runner Policy

OpenClaw before 2026.4.25 contains a policy bypass vulnerability in embedded runner policy that allows requests using provider aliases to compare against aliases instead of canonical provider identities. Attackers can exploit this confusion to select bundled tool access outside intended provider...

CVE-2026-53809 OpenClaw < 2026.4.25 - Provider Alias Confusion in Embedded Runner Policy

OpenClaw before 2026.4.25 contains a policy bypass vulnerability in embedded runner policy that allows requests using provider aliases to compare against aliases instead of canonical provider identities. Attackers can exploit this confusion to select bundled tool access outside intended provider...

CVE-2026-53809 OpenClaw < 2026.4.25 - Provider Alias Confusion in Embedded Runner Policy

OpenClaw before 2026.4.25 contains a policy bypass vulnerability in embedded runner policy that allows requests using provider aliases to compare against aliases instead of canonical provider identities. Attackers can exploit this confusion to select bundled tool access outside intended provider...