Linux Distros Unpatched Vulnerability : CVE-2026-119286

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - GraphQL-core is a Python port of the GraphQL.js reference implementation. From 3.3.0a3 until 3.3.1, validate reuses a module-level ValidationAbortedError when a...

CVE-2026-63396

Coop is an open source review and moderation tool from ROOST. Prior to 1.0.0, an unauthenticated actor can query Query.allOrgs through /api/v1/graphql on a publicly accessible deployment and obtain data for all organizations, including organization IDs, names, email addresses, website URLs and...

CVE-2026-63399

Coop is an open source review and moderation tool from ROOST. Prior to 1.0.0, the GraphQL Mutation.createOrg operation allows an unauthenticated actor to create arbitrary organizations on a publicly accessible instance. In addition to creating noise in the logs, the lack of rate limiting could...

GHSA-MPQX-Q82W-9X46 GraphQL-core has denial of service via memory leak in aborted validations

Summary When a validation was aborted because the document contained more errors than allowed by maxerrors 100 by default, validate raised a single module-level ValidationAbortedError instance. Python appends the frames of every raise to the existing traceback of an exception that is raised again...

acryl-datahub-dagster-plugin (>=0.0.0.dev0, <=1.8.0rc4), boulder-opal (6.1.0) +66 more potentially affected by CVE-2026-119286 via graphql-core (>=3.3.0a11, <=3.3.0)

graphql-core PYPI version =3.3.0a11, =0.0.0.dev0, =1.1.1, =0.2.0, =0.6.7rc0, =0.8.6rc1, =0.1.0, =0.5.0rc4, =0.1.0, =0.0.6, =0.0.1a11, =1.1.1, =0.0.1, =0.7.0rc0, =0.11.14 and more Source cves: CVE-2026-119286 Source advisory: GHSA-MPQX-Q82W-9X46...

GraphQL-core has denial of service via memory leak in aborted validations

Summary When a validation was aborted because the document contained more errors than allowed by maxerrors 100 by default, validate raised a single module-level ValidationAbortedError instance. Python appends the frames of every raise to the existing traceback of an exception that is raised again...

EUVD-2026-113404

GraphQL-core has denial of service via memory leak in aborted validations...

acryl-datahub-dagster-plugin (>=0.0.0.dev0, <=1.8.0rc4), boulder-opal (6.1.0) +66 more potentially affected by CVE-2026-119286 via graphql-core (>=3.3.0a11, <=3.3.0)

graphql-core PYPI version =3.3.0a11, =0.0.0.dev0, =1.1.1, =0.2.0, =0.6.7rc0, =0.8.6rc1, =0.1.0, =0.5.0rc4, =0.1.0, =0.0.6, =0.0.1a11, =1.1.1, =0.0.1, =0.7.0rc0, =0.11.14 and more Source cves: CVE-2026-119286 Source advisory: OSV:GHSA-MPQX-Q82W-9X46...

CVE-2026-63396

The open-source review and moderation tool Coop by ROOST is vulnerable to a data leak in versions prior to 1.0.0 . An unauthenticated actor can query the Query.allOrgs field via the /api/v1/graphql endpoint on publicly accessible deployments. This flaw allows the retrieval of sensitive data for a...

EUVD-2026-114548

Coop is an open source review and moderation tool from ROOST. Prior to 1.0.0, an unauthenticated actor can query Query.allOrgs through /api/v1/graphql on a publicly accessible deployment and obtain data for all organizations, including organization IDs, names, email addresses, website URLs and...

CVE-2026-63396 Coop has a data leak via unauthenticated GraphQL Query.allOrgs

Coop is an open source review and moderation tool from ROOST. Prior to 1.0.0, an unauthenticated actor can query Query.allOrgs through /api/v1/graphql on a publicly accessible deployment and obtain data for all organizations, including organization IDs, names, email addresses, website URLs and...

CVE-2026-63396 Coop has a data leak via unauthenticated GraphQL Query.allOrgs

Coop is an open source review and moderation tool from ROOST. Prior to 1.0.0, an unauthenticated actor can query Query.allOrgs through /api/v1/graphql on a publicly accessible deployment and obtain data for all organizations, including organization IDs, names, email addresses, website URLs and...

CVE-2026-63396 Coop has a data leak via unauthenticated GraphQL Query.allOrgs

Coop is an open source review and moderation tool from ROOST. Prior to 1.0.0, an unauthenticated actor can query Query.allOrgs through /api/v1/graphql on a publicly accessible deployment and obtain data for all organizations, including organization IDs, names, email addresses, website URLs and...

CVE-2026-63399

The open-source review and moderation tool Coop by ROOST is vulnerable to unauthenticated organization creation in versions prior to 1.0.0 . The issue resides in the GraphQL Mutation.createOrg operation, which allows an unauthenticated actor to create arbitrary organizations on publicly accessibl...

CVE-2026-63399 Coop: Unauthenticated org provisioning via GraphQL Mutation.createOrg

Coop is an open source review and moderation tool from ROOST. Prior to 1.0.0, the GraphQL Mutation.createOrg operation allows an unauthenticated actor to create arbitrary organizations on a publicly accessible instance. In addition to creating noise in the logs, the lack of rate limiting could...

EUVD-2026-114547

Coop is an open source review and moderation tool from ROOST. Prior to 1.0.0, the GraphQL Mutation.createOrg operation allows an unauthenticated actor to create arbitrary organizations on a publicly accessible instance. In addition to creating noise in the logs, the lack of rate limiting could...

CVE-2026-63399 Coop: Unauthenticated org provisioning via GraphQL Mutation.createOrg

Coop is an open source review and moderation tool from ROOST. Prior to 1.0.0, the GraphQL Mutation.createOrg operation allows an unauthenticated actor to create arbitrary organizations on a publicly accessible instance. In addition to creating noise in the logs, the lack of rate limiting could...

CVE-2026-63399

Coop is an open source review and moderation tool from ROOST. Prior to 1.0.0, the "GraphQL" "Mutation.createOrg" operation allows an unauthenticated actor to create arbitrary organizations on a publicly accessible instance. In addition to creating noise in the logs, the lack of rate limiting coul...

stylesmuggler-ioc-toolkit

StyleSmuggler IOC Toolkit — CVE-2026-75650 Magento zero-day · Adobe Commerce zero-day · CVE-2026-75650 · APSB26-146 · VULN-39341 · unauthenticated RCE · Magento malware · Magento backdoor removal · Magento 2.4.9 vulnerability · Rust implant · GraphQL styles injection · PHP web shell Community...

CVE-2026-44840-poc

CVE-2026-44840 — PoC: Dgraph DQL Injection via checkUserPassword GraphQL Docker lab that reproduces a real injection in Dgraph: Vulnerable : dgraph/dgraph:v25.3.3 Patched : dgraph/dgraph:v25.3.4 Real CVE from 2026 · CVSS 3.1 7.5 High · CWE-943 Improper Neutralization in Data Query Logic ·...