194 matches found
beagle
Beagle 1. About Beagle 2. Installation 1. Docker 2. Python Package 3. Configuration 3. Web Interface 1. Uploading Data 2. Browsing Existing Graphs 3. Graph Interface 1. Inspecting Nodes and Edges 2. Expanding Neighbours 3. Hiding Nodes 4. Running Mutators 5. Toggling Node and Edge Types 6...
Dgraph <=v25.3.0 - Admin Mutation Missing Authorization
Dgraph =v25.3.0 contains an authentication bypass caused by missing authorization middleware for the restoreTenant admin mutation, letting unauthenticated attackers overwrite the database, read files, and perform SSRF, exploit requires no authentication. id: CVE-2026-34976 info: name: Dgraph...
Dgraph <= 25.3.2 - Admin Token Disclosure
Dgraph = 25.3.2 contains an information disclosure caused by unauthenticated access to the /debug/vars endpoint , which publishes the cmdline variable including the --security token= flag, letting unauthenticated remote attackers retrieve the admin token and access admin-only endpoints, exploit...
CVE-2026-44840-poc
CVE-2026-44840 — PoC: инъекция Dgraph DQL через checkUserPassword GraphQL Лаборатория Docker, воспроизводящая реальную инъекцию в Dgraph: Уязвимая : dgraph/dgraph:v25.3.3 Пропатченная : dgraph/dgraph:v25.3.4 Реальная CVE 2026 года · CVSS 3.1 7.5 High · CWE-943 Improper Neutralization in Data Quer...
Exploit for CVE-2026-44840
CVE-2026-44840 — PoC: Dgraph DQL Injection via checkUserPassw...
GO-2026-6443 vulnerabilities
Vulnerabilities for packages: k9s, kubescape, mountpoint-s3-csi-driver, nuclei, tempo, mcp-grafana, crossplane-provider-aws-sqs, yunikorn-k8shim, k6, octo-sts, crossplane-provider-azure-storage, restic, tfsec, percona-server-mongodb-operator, rancher-agent, tetragon, redpanda,...
SUSE CVE-2026-34976
Dgraph is an open source distributed GraphQL database. Prior to 25.3.1, the restoreTenant admin mutation is missing from the authorization middleware config admin.go, making it completely unauthenticated. Unlike the similar restore mutation which requires Guardian-of-Galaxy authentication,...
SUSE CVE-2026-40173
Dgraph is an open source distributed GraphQL database. Versions 25.3.1 and prior contain an unauthenticated credential disclosure vulnerability where the /debug/pprof/cmdline endpoint is registered on the default mux and reachable without authentication, exposing the full process command line...
SUSE CVE-2026-41327
Dgraph is an open source distributed GraphQL database. Prior to 25.3.3, a vulnerability has been found in Dgraph that gives an unauthenticated attacker full read access to every piece of data in the database. This affects Dgraph's default configuration where ACL is not enabled. The attack is a...
SUSE CVE-2026-54061
Dgraph is an open source distributed GraphQL database. Prior to version 25.3.5, Dgraph Alpha exposes the RPCs used for external snapshot import on the public gRPC port :9080 without authentication or authorization. As a result, an unauthenticated network client can open StreamExtSnapshot and send...
GO-2026-6261 Dgraph Alpha group stores can be replaced via unauthenticated external snapshot import in github.com/dgraph-io/dgraph
Dgraph Alpha exposes the RPCs used for external snapshot import on the public gRPC port without authentication or authorization. An unauthenticated network client can call StreamExtSnapshot and send Badger stream data to replace a target group's store, which drops and replaces the existing databa...
Dgraph Alpha group stores can be replaced via unauthenticated external snapshot import
Summary Dgraph Alpha exposes the RPCs used for external snapshot import on the public gRPC port :9080 without authentication or authorization. As a result, an unauthenticated network client can open StreamExtSnapshot and send Badger stream data to the target group’s store. In addition, the receiv...
EUVD-2026-42235
Dgraph Alpha group stores can be replaced via unauthenticated external snapshot import...
GHSA-RRWH-6JRQ-WP5V Dgraph Alpha group stores can be replaced via unauthenticated external snapshot import
Summary Dgraph Alpha exposes the RPCs used for external snapshot import on the public gRPC port :9080 without authentication or authorization. As a result, an unauthenticated network client can open StreamExtSnapshot and send Badger stream data to the target group’s store. In addition, the receiv...
GO-2020-0005 vulnerabilities
Vulnerabilities for packages: etcd-fips, dgraph, etcd...
GO-2020-0017 vulnerabilities
Vulnerabilities for packages: docker-credential-acr-env-fips, dgraph, gitness, docker-credential-acr-env...
GO-2024-2529 vulnerabilities
Vulnerabilities for packages: etcd-fips, dgraph, etcd...
GO-2026-5516 vulnerabilities
Vulnerabilities for packages: dgraph...