ROOT-APP-MAVEN-CVE-2026-41699 CVE-2026-41699 in org.springframework.graphql:spring-graphql - Patched by Root

Root has patched CVE-2026-41699 in the org.springframework.graphql:spring-graphql package for Root:Maven. Multiple fixed versions available...

PT-2026-92468

OpenCTI is an open source platform for managing cyber threat intelligence knowledge and observables. Prior to 7.260701.0, the synchronizerFetch GraphQL query called fetchRemoteStreams after checking only that a remote stream URL used HTTP or HTTPS. The backend did not apply the ingestion deny lis...

PT-2026-92469

OpenCTI is an open source platform for managing cyber threat intelligence knowledge and observables. Prior to 7.260706.0, the JSON ingestion mapper's extractWithRegexp formula function compiled a user-supplied regular expression with the JavaScript RegExp engine in...

CVE-2026-76821: Uncontrolled Resource Consumption

OpenCTI is an open source platform for managing cyber threat intelligence knowledge and observables. Prior to 7.260706.0, the JSON ingestion mapper's extractWithRegexp formula function compiled a user-supplied regular expression with the JavaScript RegExp engine in...

PT-2026-99159

Summary @zereight/mcp-gitlab exposes GitLab to an LLM agent while relying on read-only mode, a project allow-list, and transport auth as its safety controls. Five defects defeat those controls. Under the MCP threat model, tool-call arguments/content can be shaped by untrusted input prompt injecti...

CLSA-2026-1789373257 TuxCare security update for org.springframework.graphql:spring-graphql (4 CVEs)

TuxCare rebuilt org.springframework.graphql:spring-graphql to address 4 CVEs. Fixed in 1.0.6-tuxcare.6...

CLSA-2026-1789369685 TuxCare security update for org.springframework.graphql:spring-graphql (1 CVE)

TuxCare rebuilt org.springframework.graphql:spring-graphql to address 1 CVE. Fixed in 1.2.9-tuxcare.6...

Malicious code in janus-apex-writable-graphql (npm)

Source: amazon-inspector abfdc92c35108b7bac99e9f035fd519cc20125241b0a253c8541000e44936d16 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in inquirer-pm2-graphql-miranda (npm)

Source: amazon-inspector 964a75711a342b3eb5fc2ab4d78f2cf2af03901b2758dbe99095253d8708e938 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in hyperion-baryon-fork-graphql (npm)

The package hyperion-baryon-fork-graphql was found to contain malicious code. --- Credit: OpenSSF source...

Malicious code in halley-graphql-europa-eridanus (npm)

Source: amazon-inspector 55027f6a56c857da8cb0b35b787396175411ea1da50f3df1203935e5cd19b1e9 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in halley-graphql-miranda-changelog (npm)

Source: amazon-inspector 294a60f8bc8353187fcdc637762aa04ae29fba73de6a28272a0e39cffb15dd41 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in gridsome-css-minimizer-webpack-plugin-graphql-cors (npm)

Source: amazon-inspector ae26c88c181d9c55babee3d7420ebd9761f1cc23f179a381d9b81d8f747c8c1c This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in graphql-nightmare-css-loader-abiogenesis (npm)

Source: amazon-inspector 827a1eab8ee4f7a8518854247fd592f6a76ba721ba6900d144ce9f687b27a255 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in graphql-cache-dactyl-meteor (npm)

Source: amazon-inspector c2c89e45b27de330b847c8bce6f45bfee848d5d30bb49965b5d63299d0e86ae8 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in graphql-umbriel-enceladus-umbriel (npm)

Source: amazon-inspector 95df253aa63bcd8287944401dcbc32701f552deeffcf87cb251266f1c84051c3 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in graphql-elektra-triton-transform (npm)

Source: amazon-inspector f32d98eba6cf6a31eff8d8c5f67b0544f7ea9333a54ebdc237767280fcbcf553 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in graphql-karma-cluster-mongodb (npm)

Source: amazon-inspector 1ad37a1bc3bc4069bfd4867fc32ef836f405f93fe38cb337fd1e5e922bda5076 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in graphql-virgo-prettier-ursa (npm)

Source: amazon-inspector aaf0c2ff36e58cc35243ac8e68be82032aa3e1c00c0ac502474a893c01758736 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in graphql-enceladus-meteor-jasmine (npm)

Source: amazon-inspector f303dc4fc3654d2483f1bdbe2bbcd9922173b5307487abd9154297d5ce82c078 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...