Keystone security vulnerabilities

Keystone is a powerful CMS developed by OpenStack. It helps you build and expand faster than any other CMS or application framework. Keystone versions prior to 20260319 have security vulnerabilities. These vulnerabilities stem from unknown code in the...

CVE-2026-47707: Uncontrolled Resource Consumption

Strawberry GraphQL is a library for creating GraphQL APIs. In versions 0.172.0 through0.315.6, the MaxAliasesLimiter extension in Strawberry fails to account for the multiplicative/amplification effect of FragmentSpreadNode. While it correctly counts static aliases within the AST it does not...

Strawberry GraphQL security vulnerability

Strawberry GraphQL is an open-source Python GraphQL library that utilizes type annotations. Versions 0.172.0 to 0.315.6 of Strawberry GraphQL contain security vulnerabilities. These vulnerabilities stem from the MaxAliasesLimiter extension not taking into account the multiplicative amplification...

CVE-2026-47706: Uncontrolled Resource Consumption

Strawberry GraphQL is a library for creating GraphQL APIs. In versions 0.71.0 through 0.315.6, the QueryDepthLimiter extension is vulnerable to an Application-level DOS due to a lack of cycle detection in fragment spreads. When a query contains circular fragment references the determinedepth...

alcali (>=2018.3.3, <=2019.2.3), ambition-edc (0.3.62) +7 more potentially affected by CVE-2026-48587 via django (2.2.8)

django PYPI version 2.2.8 is affected by a known vulnerability. The following packages have a transitive dependency on django and may be impacted: - alcali =2018.3.3, =0.0.2, =7.2.0, =7.2.1 - seed-auth-api 0.9.8 - seed-control-interface 0.9.18 Source cves: CVE-2026-48587 Source advisory:...

alcali (>=2018.3.3, <=2019.2.3), ambition-edc (0.3.62) +7 more potentially affected by CVE-2026-8404 via django (2.2.8)

django PYPI version 2.2.8 is affected by a known vulnerability. The following packages have a transitive dependency on django and may be impacted: - alcali =2018.3.3, =0.0.2, =7.2.0, =7.2.1 - seed-auth-api 0.9.8 - seed-control-interface 0.9.18 Source cves: CVE-2026-8404 Source advisory:...

alexa-browser-client (3.3.0), channels (>=1.1.2, <=2.1.7) +7 more potentially affected by CVE-2026-44545 via daphne (2.2.5)

daphne PYPI version 2.2.5 is affected by a known vulnerability. The following packages have a transitive dependency on daphne and may be impacted: - alexa-browser-client 3.3.0 - channels =1.1.2, =0.2.0, =2.0.1, =0.1.1, =0.1.2, =4.0.0a1, =0.9.0a1, =16.0.0a4, =16.0.0a5 Source cves: CVE-2026-44545...

alexa-browser-client (3.3.0), channels (>=1.1.2, <=2.1.7) +7 more potentially affected by CVE-2026-44546 via daphne (2.2.5)

daphne PYPI version 2.2.5 is affected by a known vulnerability. The following packages have a transitive dependency on daphne and may be impacted: - alexa-browser-client 3.3.0 - channels =1.1.2, =0.2.0, =2.0.1, =0.1.1, =0.1.2, =4.0.0a1, =0.9.0a1, =16.0.0a4, =16.0.0a5 Source cves: CVE-2026-44546...

Malware in json-to-simple-graphql-schema

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malicious Package

Overview json-to-simple-graphql-schema is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this...

Malicious code in @redhat-cloud-services/remediations-client (npm)

Part of the "Mini Shai-Hulud" supply chain worm campaign that compromised the GitHub Actions OIDC trusted publisher shared by Red Hat Cloud Services npm packages. The attacker injected a preinstall hook into this and 31 other packages in the @redhat-cloud-services scope. The hook delivers a...

Parse Server's GraphQL "Did you mean ...?" validation suggestions disclose schema to unauthenticated callers

Impact Parse Server's GraphQL endpoint discloses schema metadata to unauthenticated callers through Did you mean ...? suggestions embedded in GraphQL validation-error messages. An unauthenticated caller who knows only the public application id can iteratively send malformed queries to reconstruct...

GHSA-8CPH-RGR4-G5VJ Parse Server's GraphQL "Did you mean ...?" validation suggestions disclose schema to unauthenticated callers

Impact Parse Server's GraphQL endpoint discloses schema metadata to unauthenticated callers through Did you mean ...? suggestions embedded in GraphQL validation-error messages. An unauthenticated caller who knows only the public application id can iteratively send malformed queries to reconstruct...

Information Exposure

Overview parse-server is a version of the Parse backend that can be deployed to any infrastructure that can run Node.js. Affected versions of this package are vulnerable to Information Exposure via the Did you mean ...? suggestions in GraphQL validation-error messages. An attacker can enumerate...

WS-2022-0380

Impact Unauthenticated GraphQL queries for user accounts can expose password hashes of users that have created or modified content, typically but not necessarily limited to administrators and editors. Patches Affected versions: Ibexa DXP v3.3., v4.2., eZ Platform v2.5. Resolving versions: Ibexa D...

PT-2026-45045

Name of the Vulnerable Software and Affected Versions Parse Server versions prior to 8.6.78 Parse Server versions prior to 9.9.1-alpha.2 Description The GraphQL endpoint discloses schema metadata to unauthenticated callers via "Did you mean ...?" suggestions within GraphQL validation-error...

GHSA-Q537-QHJ4-WCJX OpenCTI: Privilege escalation via graphQL API is abusable by organization admins, due to incorrect ACL on userEdit relationAdd

Summary An organization admin can escalate their privileges by adding a user from a different organization with higher privileges, to their own organization. Impact Full platform access, access to sensitive or proprietary information...

ANT-2026-NDBADAT0 · sentinelone/purple-mcp · Algorithmic Complexity Denial of Service

cpu-exhaustion high Severity Claude high · Security research firm - · Maintainer - Discovered by Claude Mythos Preview REPORT Anthropic's analysis of this finding, sealed at approval. ANT-2026-NDBADAT0: Algorithmic Complexity DoS The MCP tools for alerts, misconfigurations, and vulnerabilities...

CVE-2026-44730 OpenCTI: Privilege escalation via graphQL API abusable by organization admins, due to incorrect ACL on userEdit relationAdd

OpenCTI is an open source platform for managing cyber threat intelligence knowledge and observables. Prior to 6.9.7, an organization admin can escalate their privileges by adding a user from a different organization with higher privileges, to their own organization. This is due to incorrect ACL o...

Broken Object Level Authorization in the Wild: An Empirical Taxonomy from 100+ Bug Bounty Disclosures

Broken Object Level Authorization BOLA is consistently ranked the most critical API security vulnerability, yet the existing literature remains almost entirely conceptual. This paper presents one of the first large-scale empirical analyses of BOLA in publicly disclosed bug bounty reports. We...