VMware Spring for GraphQL 访问控制错误漏洞

VMware Spring for GraphQL is a GraphQL application development framework provided by the American company VMware. Versions of VMware Spring for GraphQL such as 2.0.0 and earlier, 1.4.0 and earlier, 1.3.0 and earlier, as well as 1.0.0 and earlier, contain an access control vulnerability. This...

VMware Spring for GraphQL 访问控制错误漏洞

VMware Spring for GraphQL is a GraphQL application development framework provided by the American company VMware. Versions of VMware Spring for GraphQL such as 2.0.0 and earlier, 1.4.0 and earlier, 1.3.0 and earlier, as well as 1.0.0 and earlier, have a access control vulnerability. This...

PT-2026-48627

Name of the Vulnerable Software and Affected Versions Spring for GraphQL versions 1.0.0 through 1.0.6 Spring for GraphQL versions 1.3.0 through 1.3.8 Spring for GraphQL versions 1.4.0 through 1.4.5 Spring for GraphQL versions 2.0.0 through 2.0.3 Description The annotation detection mechanism for...

PT-2026-48625

Name of the Vulnerable Software and Affected Versions Spring for GraphQL versions 1.3.0 through 1.3.8 Spring for GraphQL versions 1.4.0 through 1.4.5 Spring for GraphQL versions 2.0.0 through 2.0.3 Description Applications are susceptible to unsafe deserialization when processing paginated GraphQ...

com.apollographql.federation:federation-spring-subscription-callback (>=5.0.0 <=6.1.0), com.graphql-java-generator.graphql-gradle-plugin3:com.graphql-java-generator.graphql-gradle-plugin3.gradle.plugin (>=4.0 <=4.0.2) +45 more potentially affected by CVE-2026-41699 via org.springframework.graphql:spring-graphql (>=2.0.0-M1 <=2.0.3)

org.springframework.graphql:spring-graphql MAVEN version =2.0.0-M1, =5.0.0, =4.0, =4.0, =4.0, =4.0, =4.0, =4.0, =4.0, =4.0, =4.0, =4.0, =4.0.2 - com.introproventures:graphql-jpa-query-test-boot-starter =1.4.0 - com.introproventures:graphql-jpa-query-test-multiple-datasources =1.4.0 -...

cve-2026-41700 - HIGH - Cross-Site WebSocket Hijacking in Spring for GraphQL

cve-2026-41700 - HIGH - Cross-Site WebSocket Hijacking in Spring for GraphQL...

cve-2026-41699 - HIGH - Unsafe Deserialization in Spring GraphQL

cve-2026-41699 - HIGH - Unsafe Deserialization in Spring GraphQL...

Deserialization of Untrusted Data

Overview org.springframework.graphql:spring-graphql is a GraphQL Support for Spring Applications Affected versions of this package are vulnerable to Deserialization of Untrusted Data via deserialization of pagination-related data in Spring GraphQL. An attacker can achieve remote code execution by...

Origin Validation Error

Overview org.springframework.graphql:spring-graphql is a GraphQL Support for Spring Applications Affected versions of this package are vulnerable to Origin Validation Error via insufficient Origin validation for WebSocket connections. An attacker can perform Cross-Site WebSocket Hijacking CSWSH b...

Incorrect Authorization

Overview org.springframework.graphql:spring-graphql is a GraphQL Support for Spring Applications Affected versions of this package are vulnerable to Incorrect Authorization via annotation resolution for @Controller data fetchers in Spring GraphQL. An attacker can bypass authorization checks when...

com.apollographql.federation:federation-spring-subscription-callback (>=4.2.0 <=5.5.0), com.contentmunch:blog-api (>=2.0.0.RELEASE <=2.0.1.RELEASE) +136 more potentially affected by CVE-2026-41699 via org.springframework.graphql:spring-graphql (>=1.0.0 <=1.4.5)

org.springframework.graphql:spring-graphql MAVEN version =1.0.0, =4.2.0, =2.0.0.RELEASE, =1.0.1, =2.0, =2.0, =2.0, =2.0, =2.0, =2.0, =2.0, =2.0, =2.0, =2.0, =2.0RC1 - com.graphql-java-generator:graphql-maven-plugin-samples-CustomTemplates-client =2.0RC1 -...

ai.aitia:arrowhead-application-library-java-spring (>=4.4.0.2 <=4.6.0.0), br.com.m4rc310:br-com-m4rc310-graphql (=1.0.1) +1222 more potentially affected by CVE-2026-41838 via org.springframework:spring-websocket (>=5.3.0 <=5.3.9)

org.springframework:spring-websocket MAVEN version =5.3.0, =4.4.0.2, =5.3.0, =5.6.5, =5.3.0, =5.3.0, =5.3.0, =5.3.0, =6.2.0, =6.8.0, =6.4.0, =5.3.0, =6.10.5 and more Source cves: CVE-2026-41838 Source advisory: SNYK:JAVA-ORGSPRINGFRAMEWORK-17254123...

CVE-2026-11424

A server-side request forgery SSRF vulnerability exists in a GraphQL service component shared by Altium Enterprise Server and Altium 365. An authenticated user can submit a request whose input is treated as a URL by the server and used to issue an outbound HTTP GET request without URL validation ...

CVE-2026-11424

A server-side request forgery SSRF vulnerability exists in a GraphQL service component shared by Altium Enterprise Server and Altium 365. An authenticated user can submit a request whose input is treated as a URL by the server and used to issue an outbound HTTP GET request without URL validation ...

CVE-2026-11424

CVE-2026-11424: SSRF in a GraphQL service shared by Altium Enterprise Server and Altium 365. An authenticated user can submit input treated as a URL, causing the server to perform an outbound HTTP GET without URL validation or destination filtering, and return the response body. This enables acce...

CVE-2026-11424 Server-Side Request Forgery in Altium Platform Design GraphQL Service Allows Information Disclosure

A server-side request forgery SSRF vulnerability exists in a GraphQL service component shared by Altium Enterprise Server and Altium 365. An authenticated user can submit a request whose input is treated as a URL by the server and used to issue an outbound HTTP GET request without URL validation ...

CVE-2026-11424

A server-side request forgery SSRF vulnerability exists in a GraphQL service component shared by Altium Enterprise Server and Altium 365. An authenticated user can submit a request whose input is treated as a URL by the server and used to issue an outbound HTTP GET request without URL validation ...

CVE-2026-45739

Strawberry GraphQL is a library for creating GraphQL APIs. In versions 0.288.4 through 0.315.3, Strawberry's bundled GraphiQL template wrote values from the GraphiQL headers editor into the browser URL query string. If a user entered a sensitive header, such as Authorization: Bearer , the value...

CVE-2026-6215

A weakness has been identified in DbGate up to 7.1.4. The impacted element is the function apiServerUrl1 of the file packages/rest/src/openApiDriver.ts of the component REST/GraphQL. This manipulation causes server-side request forgery. The attack may be initiated remotely. The exploit has been...

CVE-2025-9484

GitLab has remediated an issue in GitLab EE affecting all versions from 16.6 before 18.8.9, 18.9 before 18.9.5, and 18.10 before 18.10.3 that under certain circumstances could have allowed an authenticated user to have access to other users' email addresses via certain GraphQL queries...