CVE-2026-105632

The open-source project management tool Plane is vulnerable to a broken access control flaw in versions prior to 1.4.0 . The GraphQL joinProject mutation allows any workspace member to add themselves to any project within that workspace, including private/secret projects (network=0 ) to which the...

EUVD-2026-92546

Plane is an open-source project management tool. Prior to 1.4.0, the GraphQL joinProject mutation lets any workspace member add themselves to any project in that workspace including network=0 secret/private projects they were never invited to and grants them a full Member role read + write. The...

Gitlab-CVE-2026-19478

CVE-2026-19478 — GitLab GraphQL @glintroduced Directive Injection Unauthenticated Remote Code Injection via GraphQL Directive in GitLab CE/EE — Delete Any Public Project With a Single HTTP Request A hands-on penetration testing lab that reproduces CVE-2026-19478, a critical CVSS 9.4 vulnerability...

stump-smartlist-bola

Stump: Smart List Takeover via Broken Access Control BOLA...

PT-2026-106275

Name of the Vulnerable Software and Affected Versions Twenty versions 1.20.10 through 2.6.9 Description An issue in the GraphQL /metadata endpoint allows the connectedAccounts query to return connectionParameters from ConnectedAccountDTO for all connected accounts within a workspace. This occurs...

PT-2026-106267

Name of the Vulnerable Software and Affected Versions GraphQL Tools versions prior to 12.0.1 Description The mergeDeep function in the GraphQL Tools utils package fails to exclude proto , constructor, or prototype keys while recursively merging source objects. An unauthenticated client can alias...

CVE-2026-104852: Improperly Controlled Modification of Object Prototype Attributes

GraphQL Tools provides utilities for building, stitching, and mocking GraphQL schemas. Prior to 12.0.1, the GraphQL Tools utils package's mergeDeep function follows inherited properties while recursively merging source objects and does not exclude proto, constructor, or prototype keys. An...

CVE-2026-105632: Improper Access Control

Plane is an open-source project management tool. Prior to 1.4.0, the GraphQL joinProject mutation lets any workspace member add themselves to any project in that workspace including network=0 secret/private projects they were never invited to and grants them a full Member role read + write. The...

PT-2026-106079

Plane is an open-source project management tool. Prior to 1.4.0, the GraphQL joinProject mutation lets any workspace member add themselves to any project in that workspace including network=0 secret/private projects they were never invited to and grants them a full Member role read + write. The...

Improper Certificate Validation

Overview Affected versions of this package are vulnerable to Improper Certificate Validation via a hardcoded rejectUnauthorized: false in buildWSLegacyExecutor, which unconditionally disables TLS certificate validation for all wss:// connections and cannot be overridden by callers. An attacker...

@graphql-yoga/graphiql (>=4.4.1-alpha-20250905170435-b8c51271d9eae6fded9e6c7395e3e20280733237, <=4.5.1), @settlemint/sdk-mcp (>=2.6.2-main01bd70e9, <=2.6.12) +1 more potentially affected by CVE-2026-103921 via @graphql-tools/url-loader (>=9.0.0, <=9.0.5)

@graphql-tools/url-loader NPM version =9.0.0, =4.4.1-alpha-20250905170435-b8c51271d9eae6fded9e6c7395e3e20280733237, =2.6.2-main01bd70e9, =1.0.0, =1.0.22 Source cves: CVE-2026-103921 Source advisory: SNYK:JS-GRAPHQLTOOLSURLLOADER-20510284...

Improper Certificate Validation

Overview @graphql-tools/executor-legacy-ws is an A set of utils for faster development of GraphQL tools Affected versions of this package are vulnerable to Improper Certificate Validation via a hardcoded rejectUnauthorized: false in buildWSLegacyExecutor, which unconditionally disables TLS...

@graphql-tools/prisma-loader (>=8.0.0-alpha-20230517123108-df347e95, <=8.0.17-alpha-20241113142246-527bbf8c4e20af3d172439ab4746fe676b3a61c5), @graphql-tools/url-loader (>=8.0.0-alpha-20230517123108-df347e95, <=9.1.9-rc-20260908112455-501eab0b35c6e76223e7ed3d60d6e26c72127f1a) +1 more potentially affected by CVE-2026-103921 via @graphql-tools/executor-legacy-ws (>=1.0.0-alpha-20230517123108-df347e95, <=1.1.35-rc-20260908112455-501eab0b35c6e76223e7ed3d60d6e26c72127f1a)

@graphql-tools/executor-legacy-ws NPM version =1.0.0-alpha-20230517123108-df347e95, =8.0.0-alpha-20230517123108-df347e95, =8.0.0-alpha-20230517123108-df347e95, =9.1.9-rc-20260908112455-501eab0b35c6e76223e7ed3d60d6e26c72127f1a - graphql-config 5.0.0-alpha-20230519081831-037f0ba Source cves:...

CVE-2026-103921

GraphQL Tools provides utilities for building, stitching, and mocking GraphQL schemas. Prior to 1.1.35, the executor-legacy-ws buildWSLegacyExecutor function hardcodes TLS certificate rejection off for Node.js connections to wss:// endpoints. Applications using the executor directly, or url-loade...

atlassian-jwt-auth (>=2.0.0, <=2.6.0), clink (>=0.10.0, <=0.23.0) +7 more potentially affected by CVE-2026-102270 via pyjwt (1.4.0)

pyjwt PYPI version 1.4.0 is affected by a known vulnerability. The following packages have a transitive dependency on pyjwt and may be impacted: - atlassian-jwt-auth =2.0.0, =0.10.0, =0.0.1.dev1, =0.0.1.dev3, =0.4.0, =3.1.0, =1.1.0, =0.8.0, =0.9.0 Source cves: CVE-2026-102270 Source advisory:...

aiopath (>=0.5.7, <=0.6.7), asiva (>=1.0.1, <=1.3.1) +1 more potentially affected by CVE-2026-63374 via anyio (3.1.0)

anyio PYPI version 3.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on anyio and may be impacted: - aiopath =0.5.7, =1.0.1, =1.0.1, =1.0.6 Source cves: CVE-2026-63374 Source advisory: OSV:PYSEC-2026-4025...

aiopath (>=0.5.7, <=0.6.7), asiva (>=1.0.1, <=1.3.1) +1 more potentially affected by CVE-2026-64847 via anyio (3.1.0)

anyio PYPI version 3.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on anyio and may be impacted: - aiopath =0.5.7, =1.0.1, =1.0.1, =1.0.6 Source cves: CVE-2026-64847 Source advisory: OSV:PYSEC-2026-4024...

alcali (>=2018.3.3, <=2019.2.3), ambition-edc (0.3.62) +7 more potentially affected by CVE-2026-15307 via django (2.2.8)

django PYPI version 2.2.8 is affected by a known vulnerability. The following packages have a transitive dependency on django and may be impacted: - alcali =2018.3.3, =0.0.2, =7.2.0, =7.2.1 - seed-auth-api 0.9.8 - seed-control-interface 0.9.18 Source cves: CVE-2026-15307 Source advisory:...

CVE-2026-103921

GraphQL Tools provides utilities for building, stitching, and mocking GraphQL schemas. Prior to 1.1.35, the executor-legacy-ws buildWSLegacyExecutor function hardcodes TLS certificate rejection off for Node.js connections to wss:// endpoints. Applications using the executor directly, or url-loade...

CVE-2026-103921 GraphQL Tools: TLS Certificate Validation Disabled in Legacy GraphQL WebSocket Executor

GraphQL Tools provides utilities for building, stitching, and mocking GraphQL schemas. Prior to 1.1.35, the executor-legacy-ws buildWSLegacyExecutor function hardcodes TLS certificate rejection off for Node.js connections to wss:// endpoints. Applications using the executor directly, or url-loade...