GraphCrawler

GraphCrawler THE GraphQL automated testing tookit Graph Crawler is the most powerful automated testing toolkit for any GraphQL endpoint. Version 1.2 is out!! NEW: Can search for endpoints for you using Escape Technology's powerful Graphinder tool. Just point it towards a domain and add the '-e'...

BIT-PARSE-2026-109302 Parse Server 8.2.2 before 8.6.94 and 9.0.0 before 9.10.1 GraphQL Schema Disclosure via Persisted Queries

Parse Server 8.2.2 before 8.6.94 and 9.0.0 before 9.10.1 applies its GraphQL introspection control only to operation text sent directly with a request, not to operations resolved from Apollo Server's automatic persisted query cache. Unauthenticated attackers holding the public Application Id and...

CVE-2026-109302

Parse Server 8.2.2 before 8.6.94 and 9.0.0 before 9.10.1-alpha.14 applies its GraphQL introspection control only to operation text sent directly with a request, not to operations resolved from Apollo Server's automatic persisted query cache. Unauthenticated attackers holding the public Applicatio...

CVE-2026-109302 Parse Server 8.2.2 before 8.6.94 and 9.0.0 before 9.10.1-alpha.14 GraphQL Schema Disclosure via Persisted Queries

Parse Server 8.2.2 before 8.6.94 and 9.0.0 before 9.10.1-alpha.14 applies its GraphQL introspection control only to operation text sent directly with a request, not to operations resolved from Apollo Server's automatic persisted query cache. Unauthenticated attackers holding the public Applicatio...

CVE-2026-109302: Incorrect Authorization

Parse Server 8.2.2 before 8.6.94 and 9.0.0 before 9.10.1-alpha.14 applies its GraphQL introspection control only to operation text sent directly with a request, not to operations resolved from Apollo Server's automatic persisted query cache. Unauthenticated attackers holding the public Applicatio...

ROOT-APP-NPM-CVE-2026-23897 CVE-2026-23897 in @apollo/server - Patched by Root

Root has patched CVE-2026-23897 in the @apollo/server package for Root:npm. Multiple fixed versions available...

Apollo Server GraphQL Introspection - Detect

Apollo Server GraphQL introspection was detected. !/usr/bin/env python3 -- coding: utf-8 -- """Apollo Server GraphQL introspection was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Apollo Server GraphQL...

ROOT-APP-NPM-GHSA-9Q82-XGWF-VJ6H GHSA-9q82-xgwf-vj6h in @rootio/apollo__server - Patched by Root

Root has patched GHSA-9q82-xgwf-vj6h in the @rootio/apolloserver package for Root:npm. Multiple fixed versions available...

WS-2020-0116

Apollo-server-lambda before 2.4.12 is vulnerable to Information Exposure. The package does not properly enforce validation rules when creating subscription servers, which includes a NoInstrospection rule for the Websocket. This leaks the GraphQL schema types, their relations and human-readable...

8base-cli (>=0.0.80, <=0.0.90), @awoyotoyin/ts-graphql-yoga-express-starter (1.0.0) +133 more potentially affected by unknown CVE via apollo-server-lambda (>=1.3.2, <=2.11.0)

apollo-server-lambda NPM version =1.3.2, =0.0.80, =0.1.0-latest.30e51283, =0.1.0, =0.1.1, =1.0.0, =0.0.1-beta, =1.0.0, =1.7.0, =0.0.4, =0.0.1, =0.0.1-alpha.13, =0.0.1-alpha.12, =0.0.1-alpha.12.5 and more Source cves: unknown CVE Source advisory: MEND:WS-2020-0116...

WS-2020-0115

Apollo-server-micro before 2.4.12 is vulnerable to Information Exposure. The package does not properly enforce validation rules when creating subscription servers, which includes a NoInstrospection rule for the Websocket. This leaks the GraphQL schema types, their relations and human-readable nam...

codelift (>=0.6.3-canary.85.acbf24c.0, <=1.0.15-canary.394.652cc97.0), graphql-server-micro (>=1.0.2, <=1.4.1) +8 more potentially affected by unknown CVE via apollo-server-micro (>=1.4.0, <=2.14.1)

apollo-server-micro NPM version =1.4.0, =0.6.3-canary.85.acbf24c.0, =1.0.2, =1.0.0, =1.0.0, =2.0.0, =1.5.8, =0.1.0, =0.1.0, =1.0.0-rc.3, =1.0.0-rc.5 Source cves: unknown CVE Source advisory: MEND:WS-2020-0115...

WS-2020-0114

Apollo-server-koa before 2.4.12 is vulnerable to Information Exposure. The package does not properly enforce validation rules when creating subscription servers, which includes a NoInstrospection rule for the Websocket. This leaks the GraphQL schema types, their relations and human-readable names...

@axelspringer/mango-api (>=0.0.1-alpha, <=1.0.0-beta.75), @carlosbajo/graphql-gateway (>=1.2.0, <=2.4.62) +49 more potentially affected by unknown CVE via apollo-server-koa (>=1.3.6, <=2.9.12)

apollo-server-koa NPM version =1.3.6, =0.0.1-alpha, =1.2.0, =2.8.1, =2.4.8, =0.2.1, =0.5.1, =0.2.1, =0.5.1, =0.2.6, =0.1.2, =0.1.6, =0.3.10, =0.3.10, =6.1.0, =1.0.1, =1.0.2 and more Source cves: unknown CVE Source advisory: MEND:WS-2020-0114...

@bakjs/graphql (>=2.0.0, <=2.2.0), @clevyr/pavo-hapi-graphql (>=0.0.1, <=0.0.5) +14 more potentially affected by unknown CVE via apollo-server-hapi (>=1.2.0, <=1.4.0)

apollo-server-hapi NPM version =1.2.0, =2.0.0, =0.0.1, =0.1.0, =1.0.0, =0.0.51, =3.0.0, =1.0.2, =1.0.1, =0.2.2, =0.2.37 - trailpack-apollo 3.0.0-alpha.0 and more Source cves: unknown CVE Source advisory: MEND:WS-2020-0113...

WS-2020-0113

Apollo-server-hapi before 2.4.12 is vulnerable to Information Exposure. The package does not properly enforce validation rules when creating subscription servers, which includes a NoInstrospection rule for the Websocket. This leaks the GraphQL schema types, their relations and human-readable name...

WS-2020-0112

Apollo-server-fastify before 2.4.12 is vulnerable to Information Exposure. The package does not properly enforce validation rules when creating subscription servers, which includes a NoInstrospection rule for the Websocket. This leaks the GraphQL schema types, their relations and human-readable...

@0x18b2ee/parse-server (>=3.10.1, <=3.11.0), @3wks/gae-node-nestjs (>=0.1.3, <=5.2.0-rc3) +479 more potentially affected by unknown CVE via apollo-server-express (>=1.0.5, <=2.14.1)

apollo-server-express NPM version =1.0.5, =3.10.1, =0.1.3, =0.1.1, =2.0.0, =0.1.0, =0.1.0, =0.3.0-SNAPSHOT1, =0.5.0-rc1, =0.3.0-SNAPSHOT1, =0.5.2-dev1, =2018.8.28-0, =0.0.1-0.0.7.0, =1.1.8 and more Source cves: unknown CVE Source advisory: MEND:WS-2020-0111...

WS-2020-0111

Apollo-server-express before 2.4.12 is vulnerable to Information Exposure. The package does not properly enforce validation rules when creating subscription servers, which includes a NoInstrospection rule for the Websocket. This leaks the GraphQL schema types, their relations and human-readable...

WS-2020-0110

Apollo-server-cloudflare before 2.4.12 is vulnerable to Information Exposure. The package does not properly enforce validation rules when creating subscription servers, which includes a NoInstrospection rule for the Websocket. This leaks the GraphQL schema types, their relations and human-readabl...