kedro-graphql (>=1.1.0, <=1.5.1) potentially affected by CVE-2026-35171 via kedro (0.19.11)

kedro PYPI version 0.19.11 is affected by a known vulnerability. The following packages have a transitive dependency on kedro and may be impacted: - kedro-graphql =1.1.0, =1.5.1 Source cves: CVE-2026-35171 Source advisory: OSV:GHSA-9CQF-439C-J96R...

kedro-graphql (>=1.1.0, <=1.5.1) potentially affected by CVE-2026-35167 via kedro (0.19.11)

kedro PYPI version 0.19.11 is affected by a known vulnerability. The following packages have a transitive dependency on kedro and may be impacted: - kedro-graphql =1.1.0, =1.5.1 Source cves: CVE-2026-35167 Source advisory: OSV:GHSA-6326-W46W-PPJW...

CVE-2026-34751

Payload is a free and open source headless content management system. Prior to version 3.79.1 in @payloadcms/graphql and payload, a vulnerability in the password recovery flow could allow an unauthenticated attacker to perform actions on behalf of a user who initiates a password reset. This issue...

@adenta/cms (>=0.0.6, <=1.1.1-0), @contentql/core (>=0.1.2, <=0.3.5) +19 more potentially affected by CVE-2026-34751 via @payloadcms/graphql (>=3.0.0-alpha.0, <=3.79.0)

@payloadcms/graphql NPM version =3.0.0-alpha.0, =0.0.6, =0.1.2, =1.0.2, =0.1.0, =3.0.0-alpha.0, =3.2.0, =0.2.0, =3.0.0-beta.10, =1.0.54, =1.0.1, =0.1.0, =0.1.4, =0.1.5 and more Source cves: CVE-2026-34751 Source advisory: MEND:CVE-2026-34751...

CVE-2026-34751 Payload has Unvalidated Input in Password Recovery Endpoints

Payload is a free and open source headless content management system. Prior to version 3.79.1 in @payloadcms/graphql and payload, a vulnerability in the password recovery flow could allow an unauthenticated attacker to perform actions on behalf of a user who initiates a password reset. This issue...

CVE-2026-34751

Payload CMS (including @payloadcms/graphql and the core payload) contains a password-recovery flow vulnerability prior to version 3.79.1 that could allow an unauthenticated attacker to act on behalf of a user initiating a password reset. The issue is rated at CVSS v3.1 base score 9.1 (CRITICAL) w...

CVE-2026-33949

Tina is a headless content management system. Prior to version 2.2.2, a path traversal vulnerability in @tinacms/graphql allows unauthenticated users to write and overwrite arbitrary files within the project root. This is achieved by manipulating the relativePath parameter in GraphQL mutations. T...

CVE-2026-34573

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 8.6.68 and 9.7.0-alpha.12, the GraphQL query complexity validator can be exploited to cause a denial-of-service by sending a crafted query with binary fan-out fragment spreads...

@bojidar-bg/tina-mdx-editor (>=0.1.0, <=0.1.1), @bojidar-bg/tina-simple-git-provider (>=0.1.0, <=0.1.1) +26 more potentially affected by CVE-2026-34603 via @tinacms/graphql (>=0.0.0-a1ff961-20250623024558, <=2.2.1)

@tinacms/graphql NPM version =0.0.0-a1ff961-20250623024558, =0.1.0, =0.1.0, =0.1.0, =0.10.0, =0.0.0-20230511135047, =0.0.0-20230511135047, =2.5.8-canary.50.602.0, =0.0.4, =0.0.85, =0.0.89, =0.0.26, =0.0.34, =0.0.0-20230523213000, =0.0.0-2022221839, =2.2.0 and more Source cves: CVE-2026-34603 Sour...

Weak Password Recovery Mechanism for Forgotten Password

Overview Affected versions of this package are vulnerable to Weak Password Recovery Mechanism for Forgotten Password in the password recovery flow. An attacker can gain unauthorized access to user accounts by exploiting insufficient input validation of the origin of the password reset request...

@adenta/cms (>=0.0.6, <=1.1.1-0), @contentql/core (>=0.1.2, <=0.3.5) +19 more potentially affected by CVE-2026-34751 via @payloadcms/graphql (>=3.0.0-alpha.0, <=3.79.0)

@payloadcms/graphql NPM version =3.0.0-alpha.0, =0.0.6, =0.1.2, =1.0.2, =0.1.0, =3.0.0-alpha.0, =3.2.0, =0.2.0, =3.0.0-beta.10, =1.0.54, =1.0.1, =0.1.0, =0.1.4, =0.1.5 and more Source cves: CVE-2026-34751 Source advisory: GHSA-HP5W-3HXX-VMWF...

@adenta/cms (>=0.0.6, <=1.1.1-0), @contentql/core (>=0.1.2, <=0.3.5) +19 more potentially affected by CVE-2026-34751 via @payloadcms/graphql (>=3.0.0-alpha.0, <=3.79.0)

@payloadcms/graphql NPM version =3.0.0-alpha.0, =0.0.6, =0.1.2, =1.0.2, =0.1.0, =3.0.0-alpha.0, =3.2.0, =0.2.0, =3.0.0-beta.10, =1.0.54, =1.0.1, =0.1.0, =0.1.4, =0.1.5 and more Source cves: CVE-2026-34751 Source advisory: OSV:GHSA-HP5W-3HXX-VMWF...

@adenta/cms (>=0.0.6, <=1.1.1-0), @contentql/core (>=0.1.2, <=0.3.5) +19 more potentially affected by CVE-2026-34751 via @payloadcms/graphql (>=3.0.0-alpha.0, <=3.79.0)

@payloadcms/graphql NPM version =3.0.0-alpha.0, =0.0.6, =0.1.2, =1.0.2, =0.1.0, =3.0.0-alpha.0, =3.2.0, =0.2.0, =3.0.0-beta.10, =1.0.54, =1.0.1, =0.1.0, =0.1.4, =0.1.5 and more Source cves: CVE-2026-34751 Source advisory: SNYK:JS-PAYLOADCMSGRAPHQL-15871107...

CVE-2026-34604

Tina is a headless content management system. Prior to version 2.2.2, @tinacms/graphql uses string-based path containment checks in FilesystemBridge. That blocks plain ../ traversal, but it does not resolve symlink or junction targets. If a symlink/junction already exists under the allowed conten...

CVE-2026-34604 @tinacms/graphql's `FilesystemBridge` Path Validation Can Be Bypassed via Symlinks or Junctions

Tina is a headless content management system. Prior to version 2.2.2, @tinacms/graphql uses string-based path containment checks in FilesystemBridge. That blocks plain ../ traversal, but it does not resolve symlink or junction targets. If a symlink/junction already exists under the allowed conten...

CVE-2026-34604 @tinacms/graphql's `FilesystemBridge` Path Validation Can Be Bypassed via Symlinks or Junctions

Tina is a headless content management system. Prior to version 2.2.2, @tinacms/graphql uses string-based path containment checks in FilesystemBridge. That blocks plain ../ traversal, but it does not resolve symlink or junction targets. If a symlink/junction already exists under the allowed conten...

@bojidar-bg/tina-mdx-editor (>=0.1.0, <=0.1.1), @bojidar-bg/tina-simple-git-provider (>=0.1.0, <=0.1.1) +26 more potentially affected by CVE-2026-34604 via @tinacms/graphql (>=0.0.0-a1ff961-20250623024558, <=2.2.1)

@tinacms/graphql NPM version =0.0.0-a1ff961-20250623024558, =0.1.0, =0.1.0, =0.1.0, =0.10.0, =0.0.0-20230511135047, =0.0.0-20230511135047, =2.5.8-canary.50.602.0, =0.0.4, =0.0.85, =0.0.89, =0.0.26, =0.0.34, =0.0.0-20230523213000, =0.0.0-2022221839, =2.2.0 and more Source cves: CVE-2026-34604 Sour...

CVE-2026-33949 @tinacms/graphql has Path Traversal that leads to overwrite of arbitrary files

Tina is a headless content management system. Prior to version 2.2.2, a path traversal vulnerability in @tinacms/graphql allows unauthenticated users to write and overwrite arbitrary files within the project root. This is achieved by manipulating the relativePath parameter in GraphQL mutations. T...

EUVD-2026-17961

Tina is a headless content management system. Prior to version 2.2.2, a path traversal vulnerability in @tinacms/graphql allows unauthenticated users to write and overwrite arbitrary files within the project root. This is achieved by manipulating the relativePath parameter in GraphQL mutations. T...

@bojidar-bg/tina-mdx-editor (>=0.1.0, <=0.1.1), @bojidar-bg/tina-simple-git-provider (>=0.1.0, <=0.1.1) +26 more potentially affected by CVE-2026-33949 via @tinacms/graphql (>=0.0.0-a1ff961-20250623024558, <=2.2.1)

@tinacms/graphql NPM version =0.0.0-a1ff961-20250623024558, =0.1.0, =0.1.0, =0.1.0, =0.10.0, =0.0.0-20230511135047, =0.0.0-20230511135047, =2.5.8-canary.50.602.0, =0.0.4, =0.0.85, =0.0.89, =0.0.26, =0.0.34, =0.0.0-20230523213000, =0.0.0-2022221839, =2.2.0 and more Source cves: CVE-2026-33949 Sour...