5925 matches found
GHSA-224P-V68G-5G8F GraphQL Armor Max-Depth Plugin Bypass via fragment caching
Summary A query depth restriction using the max-depth can be bypassed if ignoreIntrospection is enabled which is the default configuration by naming your query/fragment schema. Details In the countDepth function, we have the following code that calculates the depth of a used fragment: typescript...
@cedarjs/api-server (>=0.0.4, <=9.0.0-canary.1784), @cedarjs/api-server-watch (>=5.0.7-next.219, <=9.0.0-canary.3124) +55 more potentially affected by unknown CVE via @escape.tech/graphql-armor-max-depth (>=2.0.0, <=2.4.1)
@escape.tech/graphql-armor-max-depth NPM version =2.0.0, =0.0.4, =5.0.7-next.219, =0.0.4, =5.0.4-next.167, =0.0.4, =0.0.4, =0.0.4, =0.0.4, =0.0.4, =0.0.4, =8.0.0-canary.3570, =0.9.1-next.19, =6.0.3-next.227, =0.0.4, =6.0.3-next.227, =9.0.0-canary.3124 and more Source cves: unknown CVE Source...
GraphQL Armor Max-Depth Plugin Bypass via Introspection Query Obfuscation
Summary A query depth restriction using the max-depth property can be bypassed if ignoreIntrospection is enabled which is the default configuration by naming your query/fragment schema. Details At the start of the countDepth function, we have the following check for the ignoreIntrospection option...
@cedarjs/api-server (>=0.0.4, <=9.0.0-canary.1784), @cedarjs/api-server-watch (>=5.0.7-next.219, <=9.0.0-canary.3124) +55 more potentially affected by unknown CVE via @escape.tech/graphql-armor-max-depth (>=2.0.0, <=2.4.1)
@escape.tech/graphql-armor-max-depth NPM version =2.0.0, =0.0.4, =5.0.7-next.219, =0.0.4, =5.0.4-next.167, =0.0.4, =0.0.4, =0.0.4, =0.0.4, =0.0.4, =0.0.4, =8.0.0-canary.3570, =0.9.1-next.19, =6.0.3-next.227, =0.0.4, =6.0.3-next.227, =9.0.0-canary.3124 and more Source cves: unknown CVE Source...
Allocation of Resources Without Limits or Throttling
Overview @escape.tech/graphql-armor-max-depth is a Limit the depth allowed in a GraphQL query. Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the countDepth function when the ignoreIntrospection configuration is enabled. An attacker ca...
@cedarjs/api-server (>=0.0.4, <=9.0.0-canary.1784), @cedarjs/api-server-watch (>=5.0.7-next.219, <=9.0.0-canary.3124) +55 more potentially affected by unknown CVE via @escape.tech/graphql-armor-max-depth (>=2.0.0, <=2.4.1)
@escape.tech/graphql-armor-max-depth NPM version =2.0.0, =0.0.4, =5.0.7-next.219, =0.0.4, =5.0.4-next.167, =0.0.4, =0.0.4, =0.0.4, =0.0.4, =0.0.4, =0.0.4, =8.0.0-canary.3570, =0.9.1-next.19, =6.0.3-next.227, =0.0.4, =6.0.3-next.227, =9.0.0-canary.3124 and more Source cves: unknown CVE Source...
GHSA-HMFR-RX46-4JX2 GraphQL Armor Max-Depth Plugin Bypass via Introspection Query Obfuscation
Summary A query depth restriction using the max-depth property can be bypassed if ignoreIntrospection is enabled which is the default configuration by naming your query/fragment schema. Details At the start of the countDepth function, we have the following check for the ignoreIntrospection option...
PT-2025-36624
Summary A query depth restriction using the max-depth property can be bypassed if ignoreIntrospection is enabled which is the default configuration by naming your query/fragment schema. Details At the start of the countDepth function, we have the following check for the ignoreIntrospection option...
Linux Distros Unpatched Vulnerability : CVE-2025-5846
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An issue has been discovered in GitLab EE affecting all versions from 16.10 before 17.11.5, 18.0 before 18.0.3, and 18.1 before 18.1.1 that could have allowed...
Linux Distros Unpatched Vulnerability : CVE-2024-4006
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An issue has been discovered in GitLab CE/EE affecting all versions starting from 16.7 before 16.9.6, all versions starting from 16.10 before 16.10.4, all...
PT-2025-36601
Summary A query depth restriction using the max-depth can be bypassed if ignoreIntrospection is enabled which is the default configuration by naming your query/fragment schema. Details In the countDepth function, we have the following code that calculates the depth of a used fragment: typescript...
Linux Distros Unpatched Vulnerability : CVE-2025-27407
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - graphql-ruby is a Ruby implementation of GraphQL. Starting in version 1.11.5 and prior to versions 1.11.8, 1.12.25, 1.13.24, 2.0.32, 2.1.14, 2.2.17, and 2.3.21,...
Linux Distros Unpatched Vulnerability : CVE-2024-8116
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An issue has been discovered in GitLab CE/EE affecting all versions from 16.9 before 17.4.6, 17.5 before 17.5.4, and 17.6 before 17.6.2. By using a specific...
Linux Distros Unpatched Vulnerability : CVE-2022-0172
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An issue has been discovered in GitLab CE/EE affecting all versions starting with 12.3. Under certain conditions it was possible to bypass the IP restriction fo...
Linux Distros Unpatched Vulnerability : CVE-2021-22228
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An issue has been discovered in GitLab affecting all versions before 13.11.6, all versions starting from 13.12 before 13.12.6, and all versions starting from 14...
MAL-2025-21884 Malicious code in graphql-callback-loglevel-standard (npm)
The package graphql-callback-loglevel-standard was found to contain malicious code...
MAL-2025-26424 Malicious code in mini-css-extract-plugin-jabbah-sagitta-graphql (npm)
The package mini-css-extract-plugin-jabbah-sagitta-graphql was found to contain malicious code...
Malicious code in @zalastax/nolb-graphql-o (npm)
The package @zalastax/nolb-graphql-o was found to contain malicious code...