CVE-2026-63396: roostorg coop: Coop is an open source review and moderation tool from ROOST

Coop is an open source review and moderation tool from ROOST. Prior to 1.0.0, an unauthenticated actor can query Query.allOrgs through /api/v1/graphql on a publicly accessible deployment and obtain data for all organizations, including organization IDs, names, email addresses, website URLs and...

CVE-2026-117184: n/a: An issue in the GraphQL endpoint of traggo server v0.8.3 allows attackers to cause a Denial of Service (DoS) via a…

An issue in the GraphQL endpoint of traggo server v0.8.3 allows attackers to cause a Denial of Service DoS via a crafted POST request to the GraphQL endpoint...

Tenable Identity Exposure < 3.77.18 (LTS) / 3.93.6 Multiple Vulnerabilities (TNS-2026-34)

The version of Tenable Identity Exposure running on the remote host is prior to 3.77.18 LTS, or 3.78.x prior to 3.93.6. It is, therefore, affected by multiple vulnerabilities according to advisory TNS-2026-34: - A command injection vulnerability in the Active Directory Events Listener of Tenable...

CVE-2026-119286

GraphQL-core is a Python port of the GraphQL.js reference implementation. From 3.3.0a3 until 3.3.1, validate reuses a module-level ValidationAbortedError when a document exceeds maxerrors. Python appends frames to the reused exception's traceback on every raise, retaining each document, validatio...

UBUNTU-CVE-2026-119286

GraphQL-core is a Python port of the GraphQL.js reference implementation. From 3.3.0a3 until 3.3.1, validate reuses a module-level ValidationAbortedError when a document exceeds maxerrors. Python appends frames to the reused exception's traceback on every raise, retaining each document, validatio...

CVE-2026-119286

GraphQL-core is a Python port of the GraphQL.js reference implementation. From 3.3.0a3 until 3.3.1, validate reuses a module-level ValidationAbortedError when a document exceeds maxerrors. Python appends frames to the reused exception's traceback on every raise, retaining each document, validatio...

CVE-2026-119286 GraphQL-core: Denial of service via memory leak in aborted validations

GraphQL-core is a Python port of the GraphQL.js reference implementation. From 3.3.0a3 until 3.3.1, validate reuses a module-level ValidationAbortedError when a document exceeds maxerrors. Python appends frames to the reused exception's traceback on every raise, retaining each document, validatio...

CVE-2026-119286

GraphQL-core is a Python port of the GraphQL.js reference implementation. From 3.3.0a3 until 3.3.1, validate reuses a module-level ValidationAbortedError when a document exceeds maxerrors. Python appends frames to the reused exception's traceback on every raise, retaining each document, validatio...

CVE-2026-119286 GraphQL-core: Denial of service via memory leak in aborted validations

GraphQL-core is a Python port of the GraphQL.js reference implementation. From 3.3.0a3 until 3.3.1, validate reuses a module-level ValidationAbortedError when a document exceeds maxerrors. Python appends frames to the reused exception's traceback on every raise, retaining each document, validatio...

CVE-2026-119286

The GraphQL-core Python library (versions 3.3.0a3 to 3.3.1 ) is vulnerable to a memory exhaustion Denial of Service (DoS) due to a traceback retention issue in the validate() function. The software reuses a module-level ValidationAbortedError when a document exceeds max_errors. Because Python app...

CVE-2026-119286 GraphQL-core: Denial of service via memory leak in aborted validations

GraphQL-core is a Python port of the GraphQL.js reference implementation. From 3.3.0a3 until 3.3.1, validate reuses a module-level ValidationAbortedError when a document exceeds maxerrors. Python appends frames to the reused exception's traceback on every raise, retaining each document, validatio...

BIT-GITLAB-2026-12664 Incorrect Authorization in GitLab

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.2 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that, under certain conditions, could have allowed an authenticated user with a readapi-scoped token to retrieve a project's incoming email address and create...

GraphQL Python GraphQL-core 3 resource management error vulnerability

In GraphQL Core 3 versions 3.3.0a3 through 3.3.1, there is a resource management error vulnerability. This arises because validate reuses the module-level ValidationAbortedError when the number of errors exceeds maxerrors. As a result, abnormal backtracking continues to accumulate documentation,...

PT-2026-132854

Name of the Vulnerable Software and Affected Versions GraphQL-core versions 3.3.0a3 through 3.3.0 Description The validate function reuses a module-level ValidationAbortedError when a document exceeds the max errors threshold. Because Python appends frames to the reused exception's traceback duri...

PT-2026-132432

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.2 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that, under certain conditions, could have allowed an authenticated user with a read api-scoped token to retrieve a project's incoming email address and create...

CVE-2026-119286: graphql-python graphql-core: GraphQL-core is a Python port of the GraphQL.js reference implementation

GraphQL-core is a Python port of the GraphQL.js reference implementation. From 3.3.0a3 until 3.3.1, validate reuses a module-level ValidationAbortedError when a document exceeds maxerrors. Python appends frames to the reused exception's traceback on every raise, retaining each document, validatio...

PT-2026-132765

The make graphql filter and make graphql filter sync filters of juniper warp read the whole body of a POST request into memory before they parsed the body. The filters had no limit on the size of the body. A client could thus send a large body and exhaust the memory of the server. The request nee...

@graphql-tools/prisma-loader (>=8.0.0-alpha-20230517123108-df347e95, <=8.0.17-alpha-20241113142246-527bbf8c4e20af3d172439ab4746fe676b3a61c5), @graphql-tools/url-loader (>=8.0.0-alpha-20230517123108-df347e95, <=9.1.11-alpha-20260930213106-001ad6da4923b8bb612d81d5418e51f7365e603b) +1 more potentially affected by CVE-2026-118665 via @graphql-tools/executor-legacy-ws (>=1.0.0-alpha-20230517123108-df347e95, <=1.1.36-alpha-20260930213106-001ad6da4923b8bb612d81d5418e51f7365e603b)

@graphql-tools/executor-legacy-ws NPM version =1.0.0-alpha-20230517123108-df347e95, =8.0.0-alpha-20230517123108-df347e95, =8.0.0-alpha-20230517123108-df347e95, =9.1.11-alpha-20260930213106-001ad6da4923b8bb612d81d5418e51f7365e603b - graphql-config 5.0.0-alpha-20230519081831-037f0ba Source cves:...

Insufficient Session Expiration

Overview @graphql-tools/executor-legacy-ws is an A set of utils for faster development of GraphQL tools Affected versions of this package are vulnerable to Insufficient Session Expiration via the shared executorConnectionParams closure in buildWSLegacyExecutor, where connection parameters supplie...

Improper Isolation or Compartmentalization

Overview @graphql-tools/executor-legacy-ws is an A set of utils for faster development of GraphQL tools Affected versions of this package are vulnerable to Improper Isolation or Compartmentalization via buildWSLegacyExecutor in packages/executors/legacy-ws/src/index.ts, where a single shared...