MAL-2026-16086 Malicious code in graphql-js-client-transform (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8c11b1672f9929aa10893cab85bc0f4e9a5ae5adfc2c8ae637d45e61b644692b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in graphql-js-client-transform (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8c11b1672f9929aa10893cab85bc0f4e9a5ae5adfc2c8ae637d45e61b644692b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

PT-2026-89133

Information disclosure in the blogComments GraphQL query in Magefan Blog GraphQL for Magento 2 magefan/module-blog-graph-ql through 2.2.1 allows remote unauthenticated attackers to obtain blog commenter email addresses and internal customer and admin identifiers via a POST request to /graphql...

CVE-2026-79323

Information disclosure in the blogComments GraphQL query in Magefan Blog GraphQL for Magento 2 magefan/module-blog-graph-ql through 2.2.1 allows remote unauthenticated attackers to obtain blog commenter email addresses and internal customer and admin identifiers via a POST request to /graphql...

CVE-2026-79323

Information disclosure in the blogComments GraphQL query in Magefan Blog GraphQL for Magento 2 magefan/module-blog-graph-ql through 2.2.1 allows remote unauthenticated attackers to obtain blog commenter email addresses and internal customer and admin identifiers via a POST request to /graphql...

CVE-2026-79323: Exposure of Sensitive Information to an Unauthorized Actor

Information disclosure in the blogComments GraphQL query in Magefan Blog GraphQL for Magento 2 magefan/module-blog-graph-ql through 2.2.1 allows remote unauthenticated attackers to obtain blog commenter email addresses and internal customer and admin identifiers via a POST request to /graphql...

EUVD-2026-75137

Information disclosure in the blogComments GraphQL query in Magefan Blog GraphQL for Magento 2 magefan/module-blog-graph-ql through 2.2.1 allows remote unauthenticated attackers to obtain blog commenter email addresses and internal customer and admin identifiers via a POST request to /graphql...

CVE-2026-79323

The Magefan Blog GraphQL for Magento 2 extension (magefan/module-blog-graph-ql ) version 2.2.1 and prior is vulnerable to an information disclosure flaw within the blogComments GraphQL query . A remote unauthenticated attacker can perform a POST request to the /graphql endpoint to obtain sensitiv...

opencti v7.260907.0

Note: THREAD 2026 — 15 October, Paris. Our community conference for threat intelligence and cyber defense practitioners. Talks, labs, workshops, and an evening social. Join us → Introduction OpenCTI is an open source platform allowing organizations to manage their cyber threat intelligence...

CLSA-2026-1788873403 TuxCare security update for org.springframework.graphql (5 CVEs)

TuxCare rebuilt 2 org.springframework.graphql packages to address 5 CVEs. Fixed in 1.2.9-tuxcare.5...

CLSA-2026-1788870312 TuxCare security update for org.springframework.graphql:spring-graphql (5 CVEs)

TuxCare rebuilt org.springframework.graphql:spring-graphql to address 5 CVEs. Fixed in 1.3.5-tuxcare.3...

CLSA-2026-1788806164 TuxCare security update for org.springframework.graphql (3 CVEs)

TuxCare rebuilt 2 org.springframework.graphql packages to address 3 CVEs. Fixed in 1.4.6-tuxcare.1...

Denial Of Service

Spring for GraphQL is vulnerable to Denial of Service. The vulnerability is due to improper validation of pagination arguments in the Spring Data pagination support, where client‑supplied values are passed to the underlying repository and an attacker can forge a malicious query for a Connection...

Cross-Site Request Forgery (CSRF)

Spring for GraphQL is vulnerable to Cross-Site Request Forgery CSRF. The vulnerability is due to the GraphiQL page allowing attacker-controlled URLs to trigger requests to application GraphQL endpoints, potentially causing confidential information to be leaked to the attacker's website...

Unpatched Magento and Adobe Commerce Zero-Day Exploited to Backdoor Online Stores

Attackers are exploiting a new unpatched vulnerability in Magento Open Source and Adobe Commerce that lets them run malicious code on an online store's server without logging in, Dutch e-commerce security company Sansec said in an advisory published on September 5. Sansec, which discovered the fl...

resterm v1.5.6

Resterm An API-as-code workbench for the terminal. resterm.app · docs Resterm is an API client for the terminal. Requests are saved in plain .http and .rest files, so they can live in your repo next to your code. Use them from the terminal UI, or run the same files in CI or CLI with resterm run...

CVE-2026-86176

NetBox through 4.7.0 fails to properly scope user-private records in REST and GraphQL API endpoints for Notifications, Subscriptions, and Bookmarks. Authenticated users with view permissions can access all users' private records through unscoped querysets, disclosing which users watch or bookmark...

CVE-2026-86176 NetBox through 4.7.0 Information Disclosure via REST and GraphQL APIs

NetBox through 4.7.0 fails to properly scope user-private records in REST and GraphQL API endpoints for Notifications, Subscriptions, and Bookmarks. Authenticated users with view permissions can access all users' private records through unscoped querysets, disclosing which users watch or bookmark...

CVE-2026-86176 NetBox through 4.7.0 Information Disclosure via REST and GraphQL APIs

NetBox through 4.7.0 fails to properly scope user-private records in REST and GraphQL API endpoints for Notifications, Subscriptions, and Bookmarks. Authenticated users with view permissions can access all users' private records through unscoped querysets, disclosing which users watch or bookmark...

CVE-2026-86176 NetBox through 4.7.0 Information Disclosure via REST and GraphQL APIs

NetBox through 4.7.0 fails to properly scope user-private records in REST and GraphQL API endpoints for Notifications, Subscriptions, and Bookmarks. Authenticated users with view permissions can access all users' private records through unscoped querysets, disclosing which users watch or bookmark...