CVE-2026-103620 Missing authorization in GitHub Enterprise Server allowed repository writers to replace default branches via GraphQL

A missing authorization vulnerability was identified in GitHub Enterprise Server that allowed a repository collaborator with write access to delete the current default branch through the GraphQL API and cause an attacker-controlled branch to become the new default. In repositories that required...

EUVD-2026-93666

A missing authorization vulnerability was identified in GitHub Enterprise Server that allowed a repository collaborator with write access to delete the current default branch through the GraphQL API and cause an attacker-controlled branch to become the new default. In repositories that required...

CVE-2026-103620 Missing authorization in GitHub Enterprise Server allowed repository writers to replace default branches via GraphQL

A missing authorization vulnerability was identified in GitHub Enterprise Server that allowed a repository collaborator with write access to delete the current default branch through the GraphQL API and cause an attacker-controlled branch to become the new default. In repositories that required...

CVE-2026-103620

A missing authorization vulnerability in GitHub Enterprise Server allows repository collaborators with write access to delete the current default branch using the GraphQL API . This flaw enables an attacker to set an attacker-controlled branch as the new default. In repositories requiring pull-re...

CVE-2026-104852

A flaw was found in @graphql-tools/utils. The mergeDeep function fails to restrict sensitive object properties during recursive data merging, leading to prototype pollution, where fundamental JavaScript object definitions are modified. A remote, unauthenticated attacker can exploit this flaw by...

CLSA-2026-1791291395 TuxCare security update for @graphql-tools/utils (1 CVE)

TuxCare rebuilt @graphql-tools/utils to address 1 CVE. Fixed in 11.2.2-tuxcare.1...

BIT-GITLAB-2026-4523 Missing Authorization in GitLab

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 15.11 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1 that under certain conditions could have allowed an unauthenticated user to read CI/CD job trace contents containing sensitive variable values due to improper...

CVE-2026-105763

Twenty is an open-source CRM customer relationship management platform. From 1.20.10 until 2.7.0, the /metadata GraphQL connectedAccounts query returned connectionParameters from ConnectedAccountDTO for every connected account in a workspace, including plaintext IMAP, SMTP, and CalDAV passwords,...

Prototype Pollution

Overview @graphql-tools/utils is a Common package containing utils and types for GraphQL tools Affected versions of this package are vulnerable to Prototype Pollution via the mergeDeep function, which fails to block reserved property keys such as proto, constructor, and prototype before recursive...

@adamwdennis/nestjs-typeorm-cursor-pagination (1.0.0), @ambak/nest-logger (>=1.0.11, <=1.1.0) +210 more potentially affected by CVE-2026-104852 via @graphql-tools/utils (>=12.0.0-alpha-20260805121238-f73ffd0c8126377e841d94b8bb2db97f34af4c41, <=12.0.1-rc-20260907155438-70f93ec122ac510059d67d2c95fa983767d228e4)

@graphql-tools/utils NPM version =12.0.0-alpha-20260805121238-f73ffd0c8126377e841d94b8bb2db97f34af4c41, =1.0.11, =0.0.1, =1.0.0, =1.2.5, =3.1.2, =1.0.8, =1.0.0, =1.0.7, =0.0.1, =0.0.73, =0.0.3, =0.0.13, =0.0.1, =0.0.31 and more Source cves: CVE-2026-104852 Source advisory:...

PT-2026-107111

A missing authorization vulnerability was identified in GitHub Enterprise Server that allowed a repository collaborator with write access to delete the current default branch through the GraphQL API and cause an attacker-controlled branch to become the new default. In repositories that required...

PT-2026-115963

TuxCare rebuilt @graphql-tools/utils to address 1 CVE. Fixed in 11.2.2-tuxcare.1...

CVE-2026-103620: Missing Authorization

A missing authorization vulnerability was identified in GitHub Enterprise Server that allowed a repository collaborator with write access to delete the current default branch through the GraphQL API and cause an attacker-controlled branch to become the new default. In repositories that required...

CVE-2026-105763: Insufficiently Protected Credentials

Twenty is an open-source CRM customer relationship management platform. From 1.20.10 until 2.7.0, the /metadata GraphQL connectedAccounts query returned connectionParameters from ConnectedAccountDTO for every connected account in a workspace, including plaintext IMAP, SMTP, and CalDAV passwords,...

CVE-2026-104852

GraphQL Tools provides utilities for building, stitching, and mocking GraphQL schemas. Prior to 12.0.1, the GraphQL Tools utils package's mergeDeep function follows inherited properties while recursively merging source objects and does not exclude proto, constructor, or prototype keys. An...

CVE-2026-105763 Twenty: Plaintext IMAP/SMTP/CalDAV password disclosure to any workspace member via /metadata GraphQL

Twenty is an open-source CRM customer relationship management platform. From 1.20.10 until 2.7.0, the /metadata GraphQL connectedAccounts query returned connectionParameters from ConnectedAccountDTO for every connected account in a workspace, including plaintext IMAP, SMTP, and CalDAV passwords,...

EUVD-2026-92867

Twenty is an open-source CRM customer relationship management platform. From 1.20.10 until 2.7.0, the /metadata GraphQL connectedAccounts query returned connectionParameters from ConnectedAccountDTO for every connected account in a workspace, including plaintext IMAP, SMTP, and CalDAV passwords,...

CVE-2026-105763 Twenty: Plaintext IMAP/SMTP/CalDAV password disclosure to any workspace member via /metadata GraphQL

Twenty is an open-source CRM customer relationship management platform. From 1.20.10 until 2.7.0, the /metadata GraphQL connectedAccounts query returned connectionParameters from ConnectedAccountDTO for every connected account in a workspace, including plaintext IMAP, SMTP, and CalDAV passwords,...

CVE-2026-105763

The Twenty open-source CRM platform is vulnerable to plaintext password disclosure in versions 1.20.10 through 2.7.0 . The /metadata GraphQL connectedAccounts query returns connectionParameters for all connected accounts in a workspace without enforcing the calling user's identity or account visi...

CVE-2026-105763 Twenty: Plaintext IMAP/SMTP/CalDAV password disclosure to any workspace member via /metadata GraphQL

Twenty is an open-source CRM customer relationship management platform. From 1.20.10 until 2.7.0, the /metadata GraphQL connectedAccounts query returned connectionParameters from ConnectedAccountDTO for every connected account in a workspace, including plaintext IMAP, SMTP, and CalDAV passwords,...