PYSEC-2026-4302 Strawberry legacy graphql-ws retains naturally completed subscription slots

Summary Strawberry's legacy graphql-ws subscription handler can retain task and subscription bookkeeping after a one-shot subscription has naturally sent its complete message. When the application configures maxsubscriptionsperconnection, the handler counts those completed operations in...

ROOT-APP-PYPI-CVE-2026-107728 CVE-2026-107728 in strawberry-graphql - Patched by Root

Root has patched CVE-2026-107728 in the strawberry-graphql package for Root:PyPI. Multiple fixed versions available...

PT-2026-115293

Craftplan through 0.7.5 contains a missing authorization vulnerability in the CRM Customer resource that allows unauthenticated attackers to create customer records via JSON:API and GraphQL. Attackers can send anonymous requests to POST /api/json/customers or the create customer mutation to inser...

CVE-2026-55414: Missing Authorization

NL Portal Backend Libraries provide backend components for Dutch government portals that interact with residents, customers, suppliers, and partner organizations. From 1.1.0 until 3.0.4, and in 3.1.0, the public getFormDefinitionByObjectenApiUrl and deprecated getFormDefinitionById GraphQL...

CVE-2026-111349: Missing Authorization

Craftplan through 0.7.5 contains a missing authorization vulnerability in the CRM Customer resource that allows unauthenticated attackers to create customer records via JSON:API and GraphQL. Attackers can send anonymous requests to POST /api/json/customers or the createcustomer mutation to insert...

GitLab 19.2 < 19.2.8 / 19.3 < 19.3.5 / 19.4 < 19.4.2 (CVE-2026-85529)

The version of GitLab installed on the remote host is affected by a vulnerability, as follows: - GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.2 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an...

CVE-2026-93637

An authentication rate-limit bypass in Zimbra Collaboration Suite 10.1.0 through 10.1.21 allows unauthenticated attackers to make repeated password guesses through GraphQL without incrementing Zimbra’s source-IP failure counter. GraphQL aliases allow multiple authentication attempts in one HTTP...

CVE-2026-93637 Zimbra Collaboration Suite GraphQL Batched Authentication Bypasses Pre-Auth Rate Limiting

An authentication rate-limit bypass in Zimbra Collaboration Suite 10.1.0 through 10.1.21 allows unauthenticated attackers to make repeated password guesses through GraphQL without incrementing Zimbra’s source-IP failure counter. GraphQL aliases allow multiple authentication attempts in one HTTP...

EUVD-2026-101460

An authentication rate-limit bypass in Zimbra Collaboration Suite 10.1.0 through 10.1.21 allows unauthenticated attackers to make repeated password guesses through GraphQL without incrementing Zimbra’s source-IP failure counter. GraphQL aliases allow multiple authentication attempts in one HTTP...

CVE-2026-93637 Zimbra Collaboration Suite GraphQL Batched Authentication Bypasses Pre-Auth Rate Limiting

An authentication rate-limit bypass in Zimbra Collaboration Suite 10.1.0 through 10.1.21 allows unauthenticated attackers to make repeated password guesses through GraphQL without incrementing Zimbra’s source-IP failure counter. GraphQL aliases allow multiple authentication attempts in one HTTP...

CVE-2026-93637

CVE-2026-93637 is an authentication rate-limit bypass in Zimbra Collaboration Suite versions 10.1.0 through 10.1.21 . The vulnerability exists because the GraphQL extension processes authentication requests through a path that bypasses the SoapEngine 's failure handling logic. Consequently, faile...

Shy Alter Craftplan Authorization Issue Vulnerability

Shy Alter Craftplan versions 0.7.5 and earlier have an authorization issue vulnerability. This vulnerability stems from a lack of authorization verification for CRM customer resources. Unauthenticated attackers can create customer records by sending anonymous requests via JSON:API and GraphQL,...

NL Portal Backend Libraries Authorization Vulnerability

NL Portal Backend Libraries versions from 1.1.0 to 3.0.4, as well as 3.1.0, have security vulnerabilities. These vulnerabilities stem from the fact that the getFormDefinitionByObjectenApiUrl and the deprecated getFormDefinitionById GraphQL parsers have access without requiring...

From One Account to Every Mailbox: Breaking Zimbra's Identity Boundaries (Part 1)

An enterprise mail server authenticates users, stores private communications, delivers recovery links, runs calendars, and sends mail that employees and other systems trust. Compromising it can therefore expose both email and the identities and workflows built around it. During a broader assessme...

ROOT-APP-NPM-CVE-2026-103921 CVE-2026-103921 in @graphql-tools/executor-legacy-ws - Patched by Root

Root has patched CVE-2026-103921 in the @graphql-tools/executor-legacy-ws package for Root:npm. Multiple fixed versions available...

PT-2026-114350

An authentication rate-limit bypass in Zimbra Collaboration Suite 10.1.0 through 10.1.21 allows unauthenticated attackers to make repeated password guesses through GraphQL without incrementing Zimbra’s source-IP failure counter. GraphQL aliases allow multiple authentication attempts in one HTTP...

CVE-2026-93637: Improper Restriction of Excessive Authentication Attempts

An authentication rate-limit bypass in Zimbra Collaboration Suite 10.1.0 through 10.1.21 allows unauthenticated attackers to make repeated password guesses through GraphQL without incrementing Zimbra’s source-IP failure counter. GraphQL aliases allow multiple authentication attempts in one HTTP...

CVE-2026-110210

Phase Console through 2.77.3 contains a missing authorization vulnerability that allows organisation members without Secrets read permission to read secret history via the secretHistory GraphQL query. Attackers holding an environment key can supply a known secret identifier to retrieve encrypted...

CVE-2026-110210 Phase Console through 2.77.3 Missing Authorization via secretHistory GraphQL Query

Phase Console through 2.77.3 contains a missing authorization vulnerability that allows organisation members without Secrets read permission to read secret history via the secretHistory GraphQL query. Attackers holding an environment key can supply a known secret identifier to retrieve encrypted...

EUVD-2026-99251

Phase Console through 2.77.3 contains a missing authorization vulnerability that allows organisation members without Secrets read permission to read secret history via the secretHistory GraphQL query. Attackers holding an environment key can supply a known secret identifier to retrieve encrypted...