CVE-2026-19869

In @neo4j/graphql 5.2.0+, when both type-level and field-level @authentication directives coexist on a root custom-resolver field, only the type-level rule is evaluated and the stricter field-level rule (e.g., admin-role JWT claim) is silently discarded, allowing any authenticated non-admin clien...

CVE-2026-19869

@neo4j/graphql from 5.2.0 until the patched versions fails to enforce field-level @authentication rules on root custom-resolver fields when a type-level @authentication rule is also present on the same operation type. When both a type-level @authentication on Query/Mutation and a...

EUVD-2026-61047

@neo4j/graphql from 5.2.0 until the patched versions fails to enforce field-level @authentication rules on root custom-resolver fields when a type-level @authentication rule is also present on the same operation type. When both a type-level @authentication on Query/Mutation and a...

CVE-2026-19869

@neo4j/graphql from 5.2.0 until the patched versions fails to enforce field-level @authentication rules on root custom-resolver fields when a type-level @authentication rule is also present on the same operation type. When both a type-level @authentication on Query/Mutation and a...

CVE-2026-19869 Privilege Escalation via Dropped Field-Level @authentication

@neo4j/graphql from 5.2.0 until the patched versions fails to enforce field-level @authentication rules on root custom-resolver fields when a type-level @authentication rule is also present on the same operation type. When both a type-level @authentication on Query/Mutation and a...

CVE-2026-69189

Hoppscotch is an open source API development ecosystem. Prior to 2026.6.0, the team, teamMembers.user, RESTHistory, GQLHistory, currentRESTSession, currentGQLSession, environments, globalEnvironments, and settings GraphQL paths expose another workspace member's private User data, while...

CVE-2026-69189 Hoppscotch: Cross-user private data exposure and UserHistory IDOR via team GraphQL resolvers

Hoppscotch is an open source API development ecosystem. Prior to 2026.6.0, the team, teamMembers.user, RESTHistory, GQLHistory, currentRESTSession, currentGQLSession, environments, globalEnvironments, and settings GraphQL paths expose another workspace member's private User data, while...

CVE-2026-69189

Hoppscotch is an open source API development ecosystem. Prior to 2026.6.0, the team, teamMembers.user, RESTHistory, GQLHistory, currentRESTSession, currentGQLSession, environments, globalEnvironments, and settings GraphQL paths expose another workspace member's private User data, while...

CVE-2026-69189 Hoppscotch: Cross-user private data exposure and UserHistory IDOR via team GraphQL resolvers

Hoppscotch is an open source API development ecosystem. Prior to 2026.6.0, the team, teamMembers.user, RESTHistory, GQLHistory, currentRESTSession, currentGQLSession, environments, globalEnvironments, and settings GraphQL paths expose another workspace member's private User data, while...

CVE-2026-69189

Hoppscotch is an open source API development ecosystem. Prior to 2026.6.0, the team, teamMembers.user, RESTHistory, GQLHistory, currentRESTSession, currentGQLSession, environments, globalEnvironments, and settings GraphQL paths expose another workspace member's private User data, while...

CVE-2026-69189

Hoppscotch versions prior to 2026.6.0 contain an IDOR vulnerability in team and UserHistory GraphQL resolvers: authenticated workspace members can read other users' private request history, authorization headers, session data, and environment values, and modify or delete victim history entries. F...

CVE-2026-69189 Hoppscotch: Cross-user private data exposure and UserHistory IDOR via team GraphQL resolvers

Hoppscotch is an open source API development ecosystem. Prior to 2026.6.0, the team, teamMembers.user, RESTHistory, GQLHistory, currentRESTSession, currentGQLSession, environments, globalEnvironments, and settings GraphQL paths expose another workspace member's private User data, while...

com.arcadedb:arcadedb-bolt (>=26.2.1, <=26.7.3), com.arcadedb:arcadedb-coverage (>=21.9.1-beta, <=25.4.1) +12 more potentially affected by CVE-2026-75851 via com.arcadedb:arcadedb-server (>=21.9.1-beta, <=26.7.3)

com.arcadedb:arcadedb-server MAVEN version =21.9.1-beta, =26.2.1, =21.9.1-beta, =21.12.1, =24.11.1, =25.9.1, =26.4.2, =25.1.1, =21.9.1-beta, =21.9.1-beta, =21.9.1-beta, =21.9.1-beta, =25.11.1, =26.7.1, =26.7.3 - io.github.mdre:adbogm 0.9.0.6 Source cves: CVE-2026-75851 Source advisory:...

com.arcadedb:arcadedb-bolt (>=26.2.1, <=26.7.3), com.arcadedb:arcadedb-coverage (>=21.9.1-beta, <=25.4.1) +12 more potentially affected by CVE-2026-75850 via com.arcadedb:arcadedb-server (>=21.9.1-beta, <=26.7.3)

com.arcadedb:arcadedb-server MAVEN version =21.9.1-beta, =26.2.1, =21.9.1-beta, =21.12.1, =24.11.1, =25.9.1, =26.4.2, =25.1.1, =21.9.1-beta, =21.9.1-beta, =21.9.1-beta, =21.9.1-beta, =25.11.1, =26.7.1, =26.7.3 - io.github.mdre:adbogm 0.9.0.6 Source cves: CVE-2026-75850 Source advisory:...

com.arcadedb:arcadedb-bolt (>=26.4.2, <=26.7.3), com.arcadedb:arcadedb-graphql (>=26.4.2, <=26.7.3) +10 more potentially affected by CVE-2026-75845 via com.arcadedb:arcadedb-server (>=26.4.2, <=26.7.3)

com.arcadedb:arcadedb-server MAVEN version =26.4.2, =26.4.2, =26.4.2, =26.4.2, =26.4.2, =26.4.2, =26.4.2, =26.4.2, =26.4.2, =26.4.2, =26.4.2, =26.4.2, =26.7.1, =26.7.3 Source cves: CVE-2026-75845 Source advisory: MEND:CVE-2026-75845...

com.arcadedb:arcadedb-bolt (>=26.2.1, <=26.7.3), com.arcadedb:arcadedb-console (>=21.9.1-beta, <=26.7.3) +22 more potentially affected by CVE-2026-75844 via com.arcadedb:arcadedb-engine (>=21.9.1-beta, <=26.7.3)

com.arcadedb:arcadedb-engine MAVEN version =21.9.1-beta, =26.2.1, =21.9.1-beta, =21.9.1-beta, =21.12.1, =21.9.1-beta, =25.9.1, =25.9.1, =25.9.1, =26.4.2, =21.9.1-beta, =25.1.1, =21.9.1-beta, =21.9.1-beta, =21.9.1-beta, =21.9.1-beta, =26.7.3 and more Source cves: CVE-2026-75844 Source advisory:...

com.arcadedb:arcadedb-bolt (>=26.2.1, <=26.7.3), com.arcadedb:arcadedb-console (>=21.9.1-beta, <=26.7.3) +22 more potentially affected by CVE-2026-75842 via com.arcadedb:arcadedb-engine (>=21.9.1-beta, <=26.7.3)

com.arcadedb:arcadedb-engine MAVEN version =21.9.1-beta, =26.2.1, =21.9.1-beta, =21.9.1-beta, =21.12.1, =21.9.1-beta, =25.9.1, =25.9.1, =25.9.1, =26.4.2, =21.9.1-beta, =25.1.1, =21.9.1-beta, =21.9.1-beta, =21.9.1-beta, =21.9.1-beta, =26.7.3 and more Source cves: CVE-2026-75842 Source advisory:...

com.arcadedb:arcadedb-bolt (>=26.2.1, <=26.7.3), com.arcadedb:arcadedb-coverage (>=21.9.1-beta, <=25.4.1) +12 more potentially affected by CVE-2026-75839 via com.arcadedb:arcadedb-server (>=21.9.1-beta, <=26.7.3)

com.arcadedb:arcadedb-server MAVEN version =21.9.1-beta, =26.2.1, =21.9.1-beta, =21.12.1, =24.11.1, =25.9.1, =26.4.2, =25.1.1, =21.9.1-beta, =21.9.1-beta, =21.9.1-beta, =21.9.1-beta, =25.11.1, =26.7.1, =26.7.3 - io.github.mdre:adbogm 0.9.0.6 Source cves: CVE-2026-75839 Source advisory:...

BIT-GITLAB-2026-18433 Incorrect Authorization in GitLab

GitLab has remediated an issue in GitLab EE affecting all versions from 19.1 before 19.1.4 and 19.2 before 19.2.2 that under certain conditions could have allowed an authenticated user to read policy configuration belonging to a namespace they were not authorized to access, due to incorrect...

CVE-2026-34884

SSRF via setskywalkingurl Tool and GraphQL expression injection vulnerability in Apache SkyWalking MCP. This issue affects Apache SkyWalking MCP: 0.1.0. Users are recommended to upgrade to version 0.2.0, which fixes this issue...