95 matches found
graphw00f
Credits to Nick Aleks for the logo! graphw00f - GraphQL Server Fingerprinting Table of Contents How does it work? Detections GraphQL Threat Matrix Prerequisites Installation Configuration Example Usage Fingerprinting GraphQL Detecting & Fingerprinting GraphQL Support & Issues Resources How does i...
gql (4.3.0b1) potentially affected by CVE-2026-75508 via graphql-core (3.3.0a11)
graphql-core PYPI version 3.3.0a11 is affected by a known vulnerability. The following packages have a transitive dependency on graphql-core and may be impacted: - gql 4.3.0b1 Source cves: CVE-2026-75508 Source advisory: SNYK:PYTHON-GRAPHQLCORE-21433569...
gql (4.3.0b1) potentially affected by CVE-2026-75508 via graphql-core (3.3.0a11)
graphql-core PYPI version 3.3.0a11 is affected by a known vulnerability. The following packages have a transitive dependency on graphql-core and may be impacted: - gql 4.3.0b1 Source cves: CVE-2026-75508 Source advisory: OSV:GHSA-R77W-QPH3-7VF8...
gql (4.3.0b1) potentially affected by CVE-2026-75508 via graphql-core (3.3.0a11)
graphql-core PYPI version 3.3.0a11 is affected by a known vulnerability. The following packages have a transitive dependency on graphql-core and may be impacted: - gql 4.3.0b1 Source cves: CVE-2026-75508 Source advisory: GHSA-R77W-QPH3-7VF8...
gql (4.3.0b1) potentially affected by CVE-2026-75507 via graphql-core (3.3.0a11)
graphql-core PYPI version 3.3.0a11 is affected by a known vulnerability. The following packages have a transitive dependency on graphql-core and may be impacted: - gql 4.3.0b1 Source cves: CVE-2026-75507 Source advisory: SNYK:PYTHON-GRAPHQLCORE-21433568...
gql (4.3.0b1) potentially affected by CVE-2026-75507 via graphql-core (3.3.0a11)
graphql-core PYPI version 3.3.0a11 is affected by a known vulnerability. The following packages have a transitive dependency on graphql-core and may be impacted: - gql 4.3.0b1 Source cves: CVE-2026-75507 Source advisory: OSV:GHSA-VJ8H-FX38-H3VC...
gql (4.3.0b1) potentially affected by CVE-2023-26144 +1 more via graphql-core (3.3.0a11)
graphql-core PYPI version 3.3.0a11 is affected by a known vulnerability. The following packages have a transitive dependency on graphql-core and may be impacted: - gql 4.3.0b1 Source cves: CVE-2023-26144, CVE-2026-75507 Source advisory: GHSA-VJ8H-FX38-H3VC...
CVE-2026-101061
utcp-gql before 1.1.1 and utcp-websocket before 1.1.1 contain server-side request forgery vulnerabilities due to incomplete application of CVE-2026-44661 fixes. The GraphQL plugin uses a vulnerable prefix check allowing bypass URLs like http://127.0.0.1.attacker.example, while the WebSocket plugi...
CVE-2026-101061
The utcp-gql and utcp-websocket libraries, in versions before 1.1.1 , are vulnerable to server-side request forgery (SSRF) . The vulnerability stems from an incomplete application of fixes for CVE-2026-44661. Specifically, the GraphQL plugin utilizes a flawed prefix check that allows bypasses usi...
EUVD-2026-87986
utcp-gql before 1.1.1 and utcp-websocket before 1.1.1 contain server-side request forgery vulnerabilities due to incomplete application of CVE-2026-44661 fixes. The GraphQL plugin uses a vulnerable prefix check allowing bypass URLs like http://127.0.0.1.attacker.example, while the WebSocket plugi...
CVE-2026-101061
utcp-gql before 1.1.1 and utcp-websocket before 1.1.1 contain server-side request forgery vulnerabilities due to incomplete application of CVE-2026-44661 fixes. The GraphQL plugin uses a vulnerable prefix check allowing bypass URLs like http://127.0.0.1.attacker.example, while the WebSocket plugi...
CVE-2026-101061 utcp-gql and utcp-websocket before 1.1.1 SSRF via URL validation bypass
utcp-gql before 1.1.1 and utcp-websocket before 1.1.1 contain server-side request forgery vulnerabilities due to incomplete application of CVE-2026-44661 fixes. The GraphQL plugin uses a vulnerable prefix check allowing bypass URLs like http://127.0.0.1.attacker.example, while the WebSocket plugi...
CVE-2026-101061 utcp-gql and utcp-websocket before 1.1.1 SSRF via URL validation bypass
utcp-gql before 1.1.1 and utcp-websocket before 1.1.1 contain server-side request forgery vulnerabilities due to incomplete application of CVE-2026-44661 fixes. The GraphQL plugin uses a vulnerable prefix check allowing bypass URLs like http://127.0.0.1.attacker.example, while the WebSocket plugi...
CVE-2026-101061: Server-Side Request Forgery (SSRF)
utcp-gql before 1.1.1 and utcp-websocket before 1.1.1 contain server-side request forgery vulnerabilities due to incomplete application of CVE-2026-44661 fixes. The GraphQL plugin uses a vulnerable prefix check allowing bypass URLs like http://127.0.0.1.attacker.example, while the WebSocket plugi...
PT-2026-99573
utcp-gql before 1.1.1 and utcp-websocket before 1.1.1 contain server-side request forgery vulnerabilities due to incomplete application of CVE-2026-44661 fixes. The GraphQL plugin uses a vulnerable prefix check allowing bypass URLs like http://127.0.0.1.attacker.example, while the WebSocket plugi...
io.github.valdemargr:gql-http4s_3 (>=0.1-a2fae94, <=0.1-6257648), io.github.valdemargr:gql-server-http4s_3 (>=0.1-5acc59b, <=0.2.8-23-b552e1c) +1 more potentially affected by CVE-2026-73494 via org.http4s:http4s-blaze-server_3 (>=1.0.0-m23, <=1.0.0-m36)
org.http4s:http4s-blaze-server3 MAVEN version =1.0.0-m23, =0.1-a2fae94, =0.1-5acc59b, =0.12.2, =0.14.5 Source cves: CVE-2026-73494 Source advisory: SNYK:JAVA-ORGHTTP4S-19822093...
io.github.valdemargr:gql-http4s_2.13 (>=0.1-a2fae94, <=0.1-6257648), io.github.valdemargr:gql-server-http4s_2.13 (>=0.1-5acc59b, <=0.2.8-23-b552e1c) +3 more potentially affected by CVE-2026-73494 via org.http4s:blaze-http_2.13 (>=1.0.0-m33, <=1.0.0-m41)
org.http4s:blaze-http2.13 MAVEN version =1.0.0-m33, =0.1-a2fae94, =0.1-5acc59b, =1.0.0-m33, =1.0.0-m33, =1.0.0-m33, =1.0.0-m41 Source cves: CVE-2026-73494 Source advisory: SNYK:JAVA-ORGHTTP4S-19822072...
io.github.valdemargr:gql-http4s_2.13 (>=0.1-a2fae94, <=0.1-6257648), io.github.valdemargr:gql-server-http4s_2.13 (>=0.1-5acc59b, <=0.2.8-23-b552e1c) +3 more potentially affected by CVE-2026-73494 via org.http4s:blaze-http_2.13 (>=1.0.0-m33, <=1.0.0-m41)
org.http4s:blaze-http2.13 MAVEN version =1.0.0-m33, =0.1-a2fae94, =0.1-5acc59b, =1.0.0-m33, =1.0.0-m33, =1.0.0-m33, =1.0.0-m41 Source cves: CVE-2026-73494 Source advisory: MEND:CVE-2026-73494...
