Missing Authentication for Critical Function

Overview @neo4j/graphql is an A GraphQL to Cypher query execution layer for Neo4j and JavaScript GraphQL implementations Affected versions of this package are vulnerable to Missing Authentication for Critical Function via top-level Cypher fields in translateTopLevelCypher, where schema-level and...

CVE-2026-96618 Hex exhausts memory and disk on oversized or compressed responses from an untrusted mirror

Improper Handling of Highly Compressed Data Data Amplification vulnerability in hexpm hex allows an untrusted package mirror to exhaust the memory or disk space of the machine running mix deps.get, mix deps.update, mix hex.package fetch or mix hex.docs fetch. Hex treats a mirror configured with...

CVE-2026-96618

The hexpm hex package (versions 0.11.2 before 2.5.2) is vulnerable to a Data Amplification attack where an untrusted mirror can exhaust a machine's memory or disk space. The root cause is that Hex.HTTP.request/5 decompresses gzip responses without enforcing size limits, and package tarballs/docs ...

EUVD-2026-97500

Improper Handling of Highly Compressed Data Data Amplification vulnerability in hexpm hex allows an untrusted package mirror to exhaust the memory or disk space of the machine running mix deps.get, mix deps.update, mix hex.package fetch or mix hex.docs fetch. Hex treats a mirror configured with...

EEF-CVE-2026-96618 Hex exhausts memory and disk on oversized or compressed responses from an untrusted mirror

Summary Improper Handling of Highly Compressed Data Data Amplification vulnerability in hexpm hex allows an untrusted package mirror to exhaust the memory or disk space of the machine running mix deps.get, mix deps.update, mix hex.package fetch or mix hex.docs fetch. Hex treats a mirror configure...

CVE-2026-96618 Hex exhausts memory and disk on oversized or compressed responses from an untrusted mirror

Improper Handling of Highly Compressed Data Data Amplification vulnerability in hexpm hex allows an untrusted package mirror to exhaust the memory or disk space of the machine running mix deps.get, mix deps.update, mix hex.package fetch or mix hex.docs fetch. Hex treats a mirror configured with...

CVE-2026-96618

Improper Handling of Highly Compressed Data Data Amplification vulnerability in hexpm hex allows an untrusted package mirror to exhaust the memory or disk space of the machine running mix deps.get, mix deps.update, mix hex.package fetch or mix hex.docs fetch. Hex treats a mirror configured with...

CVE-2026-96618

Improper Handling of Highly Compressed Data Data Amplification vulnerability in hexpm hex allows an untrusted package mirror to exhaust the memory or disk space of the machine running mix deps.get, mix deps.update, mix hex.package fetch or mix hex.docs fetch. Hex treats a mirror configured with...

CVE-2026-96618 Hex exhausts memory and disk on oversized or compressed responses from an untrusted mirror

Improper Handling of Highly Compressed Data Data Amplification vulnerability in hexpm hex allows an untrusted package mirror to exhaust the memory or disk space of the machine running mix deps.get, mix deps.update, mix hex.package fetch or mix hex.docs fetch. Hex treats a mirror configured with...

Security update for libsoup

This update for libsoup fixes the following issues: CVE-2026-15713: SoupCache: libsoup: HTTP/2 frame window exhaustion remote denial of service via memory leak bsc1271448. CVE-2026-102555: Heap buffer overflow via uninitialized length in data-URI base64 decoding bsc1283299. CVE-2026-102556: Heap...

⚡ Weekly Recap: Helpdesk 0-Days, Rogue Certs, ShinyHunters Arrest, AI-Fooling Malware and More

Some meetings last longer than it took attackers to jump on a newly disclosed security flaw this week. Within hours, they were already testing it. That's not much time to read the warning, let alone do something about it. But speed is only part of the problem. A secure connection didn't always me...

CVE-2026-92681 @neo4j/graphql: schema-level and type-level @authentication not enforced on top-level @cypher fields

In @neo4j/graphql versions up to and including 7.6.3, @authentication directives applied at the schema level or on the Query or Mutation types are silently ignored for top-level fields annotated with @cypher. Only @authentication directives placed directly on the individual fields are enforced. A...

EUVD-2026-97487

In @neo4j/graphql versions up to and including 7.6.3, @authentication directives applied at the schema level or on the Query or Mutation types are silently ignored for top-level fields annotated with @cypher. Only @authentication directives placed directly on the individual fields are enforced. A...

CVE-2026-92681 @neo4j/graphql: schema-level and type-level @authentication not enforced on top-level @cypher fields

In @neo4j/graphql versions up to and including 7.6.3, @authentication directives applied at the schema level or on the Query or Mutation types are silently ignored for top-level fields annotated with @cypher. Only @authentication directives placed directly on the individual fields are enforced. A...

CVE-2026-92681

In @neo4j/graphql versions up to and including 7.6.3, @authentication directives applied at the schema level or on the Query or Mutation types are silently ignored for top-level fields annotated with @cypher. Only @authentication directives placed directly on the individual fields are enforced. A...

CVE-2026-92681 @neo4j/graphql: schema-level and type-level @authentication not enforced on top-level @cypher fields

In @neo4j/graphql versions up to and including 7.6.3, @authentication directives applied at the schema level or on the Query or Mutation types are silently ignored for top-level fields annotated with @cypher. Only @authentication directives placed directly on the individual fields are enforced. A...

CVE-2026-92682 @neo4j/graphql: authorization relationship and connection filters invert the "none" quantifier

In @neo4j/graphql versions from 7.0.0 up to but not including 7.6.4, the none quantifier in @authorization filters on relationships and connections is not negated when translated to Cypher, so it behaves like some. A rule such as "none of the related denied users matches the JWT subject" therefor...

CVE-2026-92682

The @neo4j/graphql library (versions 7.0.0 up to but not including 7.6.4 ) contains an incorrect authorization vulnerability where the none quantifier in @authorization filters for relationships and connections fails to negate correctly when translated to Cypher. Consequently, the filter behaves ...

EUVD-2026-97486

In @neo4j/graphql versions from 7.0.0 up to but not including 7.6.4, the none quantifier in @authorization filters on relationships and connections is not negated when translated to Cypher, so it behaves like some. A rule such as "none of the related denied users matches the JWT subject" therefor...

CVE-2026-92682 @neo4j/graphql: authorization relationship and connection filters invert the "none" quantifier

In @neo4j/graphql versions from 7.0.0 up to but not including 7.6.4, the none quantifier in @authorization filters on relationships and connections is not negated when translated to Cypher, so it behaves like some. A rule such as "none of the related denied users matches the JWT subject" therefor...