GraphQLmap

GraphQLmap GraphQLmap is a scripting engine to interact with a graphql endpoint for pentesting purposes. Install Features and examples Dump a GraphQL schema Interact with a GraphQL endpoint Execute GraphQL queries Autocomplete queries GraphQL field fuzzing Example 1 - Bruteforce a character Examp...

CVE-2026-55094

A flaw was found in Taskcluster. This vulnerability allows an unauthenticated remote attacker to achieve arbitrary code execution. When a deployment exposes its GraphQL endpoint to anonymous access, user-supplied filter parameters are unsafely evaluated by the backend filtering library. A remote...

CVE-2026-117184

An issue in the GraphQL endpoint of traggo server v0.8.3 allows attackers to cause a Denial of Service DoS via a crafted POST request to the GraphQL endpoint...

Exploit for CVE-2026-117184

CVE-2026-117184 — Unauthenticated Denial of Service via GraphQ...

CVE-2026-117184

Traggo server v0.8.3 is vulnerable to an unauthenticated Denial of Service (DoS) via its GraphQL endpoint. The vulnerability is caused by uncontrolled resource consumption (CWE-400) because the server lacks request body size limits and complexity limits, while the version field lacks an authentic...

EUVD-2026-114178

An issue in the GraphQL endpoint of traggo server v0.8.3 allows attackers to cause a Denial of Service DoS via a crafted POST request to the GraphQL endpoint...

Traggo Server security vulnerability

Version 0.8.3 of Traggo Server contains a security vulnerability. This vulnerability arises from improper handling of specially crafted POST requests on the GraphQL endpoint, potentially leading to a denial of service...

CVE-2026-117184

An issue in the GraphQL endpoint of traggo server v0.8.3 allows attackers to cause a Denial of Service DoS via a crafted POST request to the GraphQL endpoint...

CVE-2026-117184: n/a: An issue in the GraphQL endpoint of traggo server v0.8.3 allows attackers to cause a Denial of Service (DoS) via a…

An issue in the GraphQL endpoint of traggo server v0.8.3 allows attackers to cause a Denial of Service DoS via a crafted POST request to the GraphQL endpoint...

PT-2026-133626

An issue in the GraphQL endpoint of traggo server v0.8.3 allows attackers to cause a Denial of Service DoS via a crafted POST request to the GraphQL endpoint...

EUVD-2026-90208

Taskcluster is the task execution framework that supports Mozilla's continuous integration and release processes. Prior to version 100.3.0, Taskcluster is vulnerable to unauthenticated RCE on Taskcluster deployments with an anonymous role that exposes the GraphQL endpoint and parses filter...

CVE-2026-55094

Taskcluster is the task execution framework that supports Mozilla's continuous integration and release processes. Prior to version 100.3.0, Taskcluster is vulnerable to unauthenticated RCE on Taskcluster deployments with an anonymous role that exposes the GraphQL endpoint and parses filter...

CVE-2026-55094: Improper Input Validation

Taskcluster is the task execution framework that supports Mozilla's continuous integration and release processes. Prior to version 100.3.0, Taskcluster is vulnerable to unauthenticated RCE on Taskcluster deployments with an anonymous role that exposes the GraphQL endpoint and parses filter...

CVE-2026-79323

Information disclosure in the blogComments GraphQL query in Magefan Blog GraphQL for Magento 2 magefan/module-blog-graph-ql through 2.2.1 allows remote unauthenticated attackers to obtain blog commenter email addresses and internal customer and admin identifiers via a POST request to /graphql...

PT-2026-57359

Summary The /authorize endpoint accepts any redirect uri without validating it against AllowedOrigins. When response type=token or response type=id token, the server appends access token, id token, and refresh token as query parameters and issues a 302 redirect to the attacker-supplied URL. An...

PT-2026-57366

Name of the Vulnerable Software and Affected Versions Authorizer versions prior to 2.0.1 Description The /authorize endpoint fails to validate the redirect uri parameter against a list of allowed origins. When the response type is set to token or id token, the server appends the access token, id...

MLflow Uncontrolled Resource Consumption vulnerability

In mlflow/mlflow version 2.17.2, the /graphql endpoint is vulnerable to a denial of service attack. An attacker can create large batches of queries that repeatedly request all runs from a given experiment. This can tie up all the workers allocated by MLFlow, rendering the application unable to...

PYSEC-2026-1687 Unauthenticated views may expose information to anonymous users

Impact A number of Nautobot URL endpoints were found to be improperly accessible to unauthenticated anonymous users, including the following: - /api/graphql/ 1 - /api/users/users/session/ Nautobot 2.x only; the only information exposed to an anonymous user is which authentication backend classes...

GO-2026-5420 kubernetes-graphql-gateway: GraphQL Endpoint Vulnerable to Authenticated Denial-of-Service via Unrestricted Query Execution in github.com/platform-mesh/kubernetes-graphql-gateway

kubernetes-graphql-gateway: GraphQL Endpoint Vulnerable to Authenticated Denial-of-Service via Unrestricted Query Execution in github.com/platform-mesh/kubernetes-graphql-gateway...

NL Portal Backend Libraries: Document contents remained downloadable by any logged-in user (incomplete fix of CVE-2026-49463)

Summary A previous advisory CVE-2026-49463 / GHSA-qpm9-h556-mwxm reported that any logged-in user could download any document by its identifier, and stated this was fixed in 3.0.1. For the document-content part that fix was incomplete: documents remained downloadable by any authenticated user in...