CVE-2026-49463 NL Portal: Missing per-user authorization on document and decision GraphQL queries in nl-portal-backend-libraries

NL Portal Backend Libraries provide backend components for Dutch government portals that interact with residents, customers, suppliers, and partner organizations. The nl.nl-portal:documenten-api package through version 3.0.0 and the nl.nl-portal:besluiten package from version 1.5.0 through 3.0.0...

CVE-2026-49463

NL Portal Backend Libraries (Dutch government portal backend) contained a missing per-user authorization in two GraphQL resolver areas. The nl.nl-portal:documenten-api package (all versions up to 3.0.0) and nl.nl-portal:besluiten package (1.5.0–3.0.0) both declared resolvers without an authentica...

CVE-2026-49463 NL Portal: Missing per-user authorization on document and decision GraphQL queries in nl-portal-backend-libraries

NL Portal Backend Libraries provide backend components for Dutch government portals that interact with residents, customers, suppliers, and partner organizations. The nl.nl-portal:documenten-api package through version 3.0.0 and the nl.nl-portal:besluiten package from version 1.5.0 through 3.0.0...

CVE-2026-62102

Subscriber Privilege Escalation in Gato GraphQL = 19.2.3 versions...

CVE-2026-62102 WordPress Gato GraphQL plugin <= 19.2.3 - Privilege Escalation vulnerability

Subscriber Privilege Escalation in Gato GraphQL = 19.2.3 versions...

EUVD-2026-76196

Subscriber Privilege Escalation in Gato GraphQL = 19.2.3 versions...

CVE-2026-62102

CVE-2026-62102 affects the WordPress Gato GraphQL plugin in versions 19.2.3 and earlier , where a Subscriber-level privilege escalation vulnerability exists. The CVSS 3.1 score is 8.8 (HIGH) with the vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, indicating a network-attackable flaw requiring only l...

CVE-2026-62102 WordPress Gato GraphQL plugin <= 19.2.3 - Privilege Escalation vulnerability

Subscriber Privilege Escalation in Gato GraphQL = 19.2.3 versions...

CLSA-2026-1789149911 TuxCare security update for org.springframework.graphql:spring-graphql (1 CVE)

TuxCare rebuilt org.springframework.graphql:spring-graphql to address 1 CVE. Fixed in 1.3.5-tuxcare.4...

WordPress Gato GraphQL plugin <= 19.2.3 - Privilege Escalation vulnerability

Privilege Escalation vulnerability discovered by benzdeus in WordPress Plugin Gato GraphQL versions = 19.2.3...

CVE-2026-49462: Exposure of Sensitive Information to an Unauthorized Actor

NL Portal Backend Libraries provide backend components for Dutch government portals that interact with residents, customers, suppliers, and partner organizations. In versions up to and including 3.0.0, deployments using the shipped default configuration exposed two GraphQL developer features...

PT-2026-90041

Name of the Vulnerable Software and Affected Versions GitLab EE versions 18.3 through 19.1.7 GitLab EE versions 19.2 through 19.2.5 GitLab EE versions 19.3 through 19.3.1 Description An issue exists where an authenticated user with Duo Chat access can obtain Advanced Search instance configuration...

PT-2026-90019

Subscriber Privilege Escalation in Gato GraphQL = 19.2.3 versions...

CVE-2026-62102: Incorrect Privilege Assignment

Subscriber Privilege Escalation in Gato GraphQL = 19.2.3 versions...

CVE-2026-49463: Exposure of Sensitive Information to an Unauthorized Actor

NL Portal Backend Libraries provide backend components for Dutch government portals that interact with residents, customers, suppliers, and partner organizations. The nl.nl-portal:documenten-api package through version 3.0.0 and the nl.nl-portal:besluiten package from version 1.5.0 through 3.0.0...

CVE-2026-49464: Authorization Bypass Through User-Controlled Key

NL Portal Backend Libraries provide backend components for Dutch government portals that interact with residents, customers, suppliers, and partner organizations. The nl.nl-portal:taak package from version 1.5.0 through 3.0.0 fails to verify ownership when processing the submitTaakV2 GraphQL...

PT-2026-90492

NL Portal Backend Libraries provide backend components for Dutch government portals that interact with residents, customers, suppliers, and partner organizations. In versions up to and including 3.0.0, deployments using the shipped default configuration exposed two GraphQL developer features...

PT-2026-90500

Name of the Vulnerable Software and Affected Versions GitLab EE versions 12.3 through 19.1.8 GitLab EE versions 19.2 through 19.2.5 GitLab EE versions 19.3 through 19.3.1 Description An authenticated user can achieve remote code execution by importing a specially crafted Git project export. This...

utcp-gql SSRF: CVE-2026-44661 fix not applied to the GraphQL and WebSocket plugins

SummaryThe fix for CVE-2026-44661 commit 5b16e43 added the ensuresecureurl / issecureurl helpers and wired them into the three HTTP-family plugins, but it did not reach the GraphQL or WebSocket plugins. The GraphQL plugin utcp-gql still uses the startswith prefix check that the fix explicitly...

CVE-2026-79323

Information disclosure in the blogComments GraphQL query in Magefan Blog GraphQL for Magento 2 magefan/module-blog-graph-ql through 2.2.1 allows remote unauthenticated attackers to obtain blog commenter email addresses and internal customer and admin identifiers via a POST request to /graphql...