CVE-2026-119420 Lago through 1.55.0 Authentication Bypass via acceptInvite GraphQL Mutation

Lago through 1.55.0 contains an authentication bypass vulnerability that allows organization administrators to obtain session tokens for existing accounts via the acceptInvite mutation without a password check. Attackers can invite a victim's email, accept with an arbitrary password, and receive ...

Exploit for CVE-2026-117184

CVE-2026-117184 — Unauthenticated Denial of Service via GraphQ...

CVE-2026-119286

A flaw was found in graphql-core. When validating queries that exceed the maximum allowed error threshold, the library reuses an internal error object across multiple requests. This causes Python to retain historical request data in memory for the lifetime of the process. A remote, unauthenticate...

[R1] Tenable Identity Exposure Versions 3.93.6 and 3.77.18 Fix Multiple Vulnerabilities

R1 Tenable Identity Exposure Versions 3.93.6 and 3.77.18 Fix Multiple Vulnerabilities Arnie Cabral Fri, 10/30/2026 - 00:00 Several vulnerabilities have been identified, reported to Tenable and resolved. Please see the full list of resolved issues below. A command injection vulnerability in the...

Security Bulletin: Multiple security vulnerabilities are addressed with IBM Content Cortex(CCx) 26.0.0-IF004 and 26.0.1-IF001 for October 2026

Summary IBM Content Cortex CCx 26.0.0-IF004 and 26.0.1-IF001 addresse CVEs across components including AI Services & tools, FDM, GraphQL, CSS and CPE Vulnerability Details CVEID:CVE-2026-59950 DESCRIPTION: The MCP Python SDK, called mcp on PyPI, is a Python implementation of the Model Context...

Traggo Server 0.8.3 GraphQL Alias Overloading Denial of Service

Traggo server version 0.8.3 contains an unauthenticated denial of service condition in its GraphQL endpoint due to alias overloading and missing request complexity and body-size limits. A proof of concept is provided. https://packetstorm.news/download/238544...

Traggo Server security vulnerability

Version 0.8.3 of Traggo Server contains a security vulnerability. This vulnerability arises from improper handling of specially crafted POST requests on the GraphQL endpoint, potentially leading to a denial of service...

PT-2026-133713

Mythic 3.2.16 through 3.4.0.61 contains a stored cross-site scripting vulnerability that allows attackers controlling target endpoint files to run JavaScript in the Mythic UI origin by planting HTML in .pdf-named files. When an operator downloads the file and clicks Preview Media, content-sniffed...

PT-2026-133545

ArcadeDB from 21.12.1 before 26.10.2 contains an authorization bypass vulnerability that allows users with only readRecord to replace the shared GraphQL schema via the read-only query endpoint. Attackers can send a GraphQL type definition with a crafted @sql directive to /api/v1/query/database,...

PT-2026-134245

Coop is an open source review and moderation tool from ROOST. Prior to 1.0.0, an unauthenticated actor can query Query.allOrgs through /api/v1/graphql on a publicly accessible deployment and obtain data for all organizations, including organization IDs, names, email addresses, website URLs and...

PT-2026-134247

Coop is an open source review and moderation tool from ROOST. Prior to 1.0.0, the GraphQL Mutation.createOrg operation allows an unauthenticated actor to create arbitrary organizations on a publicly accessible instance. In addition to creating noise in the logs, the lack of rate limiting could...

CVE-2026-63399: roostorg coop: Coop is an open source review and moderation tool from ROOST

Coop is an open source review and moderation tool from ROOST. Prior to 1.0.0, the GraphQL Mutation.createOrg operation allows an unauthenticated actor to create arbitrary organizations on a publicly accessible instance. In addition to creating noise in the logs, the lack of rate limiting could...

CVE-2026-119599: looplj AxonHub: AxonHub through 1.0.0-beta11 contains a privilege escalation vulnerability that allows project users to assign…

AxonHub through 1.0.0-beta11 contains a privilege escalation vulnerability that allows project users to assign system-level scopes by creating serviceaccount API keys with unvalidated scopes. Attackers holding writeapikeys can mint keys with readchannels and query /admin/graphql to read every...

PT-2026-133551

AxonHub through 1.0.0-beta11 contains a privilege escalation vulnerability that allows project users to assign system-level scopes by creating service account API keys with unvalidated scopes. Attackers holding write api keys can mint keys with read channels and query /admin/graphql to read every...

CVE-2026-117184

Traggo server v0.8.3 is vulnerable to an unauthenticated Denial of Service (DoS) via its GraphQL endpoint. The vulnerability is caused by uncontrolled resource consumption (CWE-400) because the server lacks request body size limits and complexity limits, while the version field lacks an authentic...

EUVD-2026-114178

An issue in the GraphQL endpoint of traggo server v0.8.3 allows attackers to cause a Denial of Service DoS via a crafted POST request to the GraphQL endpoint...

CVE-2026-117184

An issue in the GraphQL endpoint of traggo server v0.8.3 allows attackers to cause a Denial of Service DoS via a crafted POST request to the GraphQL endpoint...

PT-2026-133626

An issue in the GraphQL endpoint of traggo server v0.8.3 allows attackers to cause a Denial of Service DoS via a crafted POST request to the GraphQL endpoint...

CVE-2026-119764: its-a-feature Mythic: Mythic 3.2.16 through 3.4.0.61 contains a stored cross-site scripting vulnerability that allows attackers controlling…

Mythic 3.2.16 through 3.4.0.61 contains a stored cross-site scripting vulnerability that allows attackers controlling target endpoint files to run JavaScript in the Mythic UI origin by planting HTML in .pdf-named files. When an operator downloads the file and clicks Preview Media, content-sniffed...

CVE-2026-119576: ArcadeData arcadedb: ArcadeDB from 21.12.1 before 26.10.2 contains an authorization bypass vulnerability that allows users with only…

ArcadeDB from 21.12.1 before 26.10.2 contains an authorization bypass vulnerability that allows users with only readRecord to replace the shared GraphQL schema via the read-only query endpoint. Attackers can send a GraphQL type definition with a crafted @sql directive to /api/v1/query/database,...