CVE-2026-77066 Omnivore Server-Side Request Forgery via the scanFeeds GraphQL Query

The scanFeedsResolver in packages/api/src/resolvers/subscriptions/index.ts passes the caller-supplied url straight to axios.geturl, rssParserConfig with no address validation. The same file guards the subscribe path with validateUrl, which rejects private and reserved ranges through the private-i...

Deserialization of Untrusted Data

Overview org.springframework.graphql:spring-graphql is a GraphQL Support for Spring Applications Affected versions of this package are vulnerable to Deserialization of Untrusted Data via the deserialization. An attacker can execute arbitrary code by submitting a crafted GraphQL request containing...

com.apollographql.federation:federation-spring-subscription-callback (>=4.2.0, <=7.0.0), com.contentmunch:blog-api (>=2.0.0.release, <=2.0.1.release) +161 more potentially affected by CVE-2026-59288 via org.springframework.graphql:spring-graphql (>=1.0.0, <=2.0.4)

org.springframework.graphql:spring-graphql MAVEN version =1.0.0, =4.2.0, =2.0.0.release, =1.0.1, =4.0, =2.0rc1, =2.0rc1, =4.0, =2.0rc1, =2.0rc1, =2.0rc1, =2.0rc1, =2.0rc1, =2.0rc1, =2.0rc1, =2.0rc1,...

com.apollographql.federation:federation-spring-subscription-callback (>=5.1.0, <=7.0.0), com.github.vzakharchenko:bridge-forge-connect (>=1.0.1, <=1.0.2) +123 more potentially affected by CVE-2026-59287 via org.springframework.graphql:spring-graphql (>=1.3.0, <=2.0.4)

org.springframework.graphql:spring-graphql MAVEN version =1.3.0, =5.1.0, =1.0.1, =4.0, =4.0, =3.0, =3.0, =4.0, =4.0, =3.0, =3.0, =4.0, =4.0, =1.2.8, =1.2.8, =1.2.8, =1.4.0 and more Source cves: CVE-2026-59287htt...

PT-2026-79191

Name of the Vulnerable Software and Affected Versions BigBlueButton versions prior to 3.0.29 Description Presenters can submit a presentationId through the '/api/graphql' endpoint that identifies a presentation belonging to a different meeting. The RemovePresentationPubMsgHdlr.scala function fail...

com.apollographql.federation:federation-spring-subscription-callback (>=4.2.0, <=7.0.0), com.contentmunch:blog-api (>=2.0.0.release, <=2.0.1.release) +161 more potentially affected by CVE-2026-59286 via org.springframework.graphql:spring-graphql (>=1.0.0, <=2.0.4)

org.springframework.graphql:spring-graphql MAVEN version =1.0.0, =4.2.0, =2.0.0.release, =1.0.1, =4.0, =2.0rc1, =2.0rc1, =4.0, =2.0rc1, =2.0rc1, =2.0rc1, =2.0rc1, =2.0rc1, =2.0rc1, =2.0rc1, =2.0rc1,...

Allocation of Resources Without Limits or Throttling

Overview org.springframework.graphql:spring-graphql is a GraphQL Support for Spring Applications Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the pagination support. An attacker can exhaust application memory or place significant,...

PT-2026-78936

Name of the Vulnerable Software and Affected Versions n8n versions prior to 1.123.69 n8n versions prior to 2.34.1 Description A bypass of the allowed-domains policy exists in the GraphQL node. When the Authentication parameter is configured in expression mode, all authentication-gated credential...

CVE-2026-77081: Authorization Bypass Through User-Controlled Key

n8n before 1.123.69, 2.x before 2.33.4, and 2.x before 2.34.1 contain an allowed-domains bypass in the GraphQL node. When the node's Authentication parameter is set to expression mode, every authentication-gated credential selector is treated as active; if two credentials of different types are...

Unsafe Dependency Resolution

Overview org.springframework.graphql:spring-graphql is a GraphQL Support for Spring Applications Affected versions of this package are vulnerable to Unsafe Dependency Resolution via the GraphiQL. An attacker can execute arbitrary JavaScript code in the context of users' browsers by compromising t...

ai.aletyx.kogito:aletyx-kogito-ai-addons-springboot-adhoc-subprocess (>=0.1.0, <=0.2.0), ai.aletyx.kogito:aletyx-kogito-ai-addons-springboot-adhoc-subprocess-storage-jpa (>=0.1.0, <=0.2.0) +3188 more potentially affected by CVE-2026-47890 via org.springframework:spring-webflux (>=6.2.0, <=7.0.8)

org.springframework:spring-webflux MAVEN version =6.2.0, =0.1.0, =0.1.0, =0.114.0, =0.114.0, =0.5.0, =0.8.0, =0.3.0, =0.3.0, =0.3.0, =0.3.0, =0.3.0, =1.0.0, =1.0.0, =1.0.0, =1.0.29 and more Source cves: CVE-2026-47890 Source advisory: SNYK:JAVA-ORGSPRINGFRAMEWORK-19267095...

com.apollographql.federation:federation-spring-subscription-callback (>=6.0.0, <=7.0.0), com.graphql-java-generator.graphql-gradle-plugin3:com.graphql-java-generator.graphql-gradle-plugin3.gradle.plugin (>=4.0, <=4.0.2) +57 more potentially affected by CVE-2026-59285 via org.springframework.graphql:spring-graphql (>=2.0.0, <=2.0.4)

org.springframework.graphql:spring-graphql MAVEN version =2.0.0, =6.0.0, =4.0, =4.0, =4.0, =4.0, =4.0, =4.0, =4.0, =4.0, =4.0, =4.0, =4.0.2 - com.introproventures:graphql-jpa-query-test-boot-starter 1.4.0 - com.introproventures:graphql-jpa-query-test-multiple-datasources 1.4.0 -...

Allocation of Resources Without Limits or Throttling

Overview org.springframework.graphql:spring-graphql is a GraphQL Support for Spring Applications Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the WebSocketGraphQlClient when the keepAlive option is enabled and an attacker is able to...

Cross-site Request Forgery (CSRF)

Overview org.springframework.graphql:spring-graphql is a GraphQL Support for Spring Applications Affected versions of this package are vulnerable to Cross-site Request Forgery CSRF via the GraphiQL process. An attacker can access confidential information by enticing a victim with an active sessio...

PT-2026-78932

Name of the Vulnerable Software and Affected Versions n8n versions prior to 1.123.69 n8n versions prior to 2.33.4 n8n versions prior to 2.34.1 Description The GraphQL node fails to properly handle connection-level errors, re-throwing the underlying HTTP client error without wrapping it in the...

CVE-2026-77076: Generation of Error Message Containing Sensitive Information

n8n versions before 1.123.69, 2.33.4, and 2.34.1 contain an information disclosure vulnerability in the GraphQL node. When a GraphQL request fails at the connection level, the node re-throws the underlying HTTP client error unchanged instead of wrapping it in n8n's standard error type. That error...

com.apollographql.federation:federation-spring-subscription-callback (>=4.2.0, <=7.0.0), com.contentmunch:blog-api (>=2.0.0.release, <=2.0.1.release) +134 more potentially affected by CVE-2026-59289 via org.springframework.graphql:spring-graphql (>=1.2.0, <=2.0.4)

org.springframework.graphql:spring-graphql MAVEN version =1.2.0, =4.2.0, =2.0.0.release, =1.0.1, =4.0, =4.0, =3.0, =3.0, =4.0, =4.0, =3.0, =3.0, =4.0, =4.0, =1.1.0, =1.1.0, =1.4.0 and more Source cves: CVE-2026-59289https://vul...

Malicious Package

Overview sui-graphql-rpc is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview sui-move-graphql is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

com.arcadedb:arcadedb-console (>=21.10.1, <=22.1.2), com.arcadedb:arcadedb-coverage (>=21.9.1-beta, <=25.4.1) +7 more potentially affected by CVE-2026-76224 via com.arcadedb:arcadedb-gremlin (>=21.9.1-beta, <=26.7.3)

com.arcadedb:arcadedb-gremlin MAVEN version =21.9.1-beta, =21.10.1, =21.9.1-beta, =21.12.1, =21.10.1, =21.9.1-beta, =21.9.1-beta, =21.9.1-beta, =21.9.1-beta, =21.9.1-beta, =22.1.2 Source cves: CVE-2026-76224 Source advisory: MEND:CVE-2026-76224...