com.github.t1:wunderbar.demo.order (3.5.1), com.github.t1:wunderbar.demo.product (3.5.1) +12 more potentially affected by CVE-2026-76763 via io.smallrye:smallrye-graphql (>=2.14.0, <=2.14.2)

io.smallrye:smallrye-graphql MAVEN version =2.14.0, =3.25.0.cr1, =3.25.0.cr1, =3.25.0.cr1, =2.14.0, =2.14.0, =2.14.0, =2.14.0, =2.14.0, =v0.46.0-rc1, =3.25.0, =0.11.0, =0.12.0 Source cves: CVE-2026-76763 Source advisory: MEND:CVE-2026-76763...

Authorization Bypass

quarkus-smallrye-graphql is vulnerable to Authorization Bypass. The vulnerability is due to doHandle function in SmallRyeGraphQLOverWebSocketHandler.java file there are no checks to ensure that the user is authenticated or authorized to access the GraphQL endpoint. This allows an attacker to acce...

com.github.t1:wunderbar.demo.product (>=2.2.0, <=2.4.9), io.quarkiverse.githubaction:quarkus-github-action (>=0.1.0, <=0.9.2) +19 more potentially affected by CVE-2023-6394 via io.quarkus:quarkus-smallrye-graphql-client (>=2.0.0.alpha3, <=2.13.8.final)

io.quarkus:quarkus-smallrye-graphql-client MAVEN version =2.0.0.alpha3, =2.2.0, =0.1.0, =0.1.0, =0.1.0, =1.3.0, =1.8.0, =1.8.0, =1.3.0, =1.3.0, =1.7.4, =1.8.0, =1.3.0, =1.3.0, =2.0.0, =2.0.0.alpha3, =2.13.8.final and more Source cves: CVE-2023-6394...

com.github.t1:wunderbar.demo.product (>=2.2.0, <=2.4.9), io.quarkiverse.githubaction:quarkus-github-action (>=0.1.0, <=0.9.2) +19 more potentially affected by CVE-2023-6394 via io.quarkus:quarkus-smallrye-graphql-client (>=2.0.0.alpha3, <=2.13.8.final)

io.quarkus:quarkus-smallrye-graphql-client MAVEN version =2.0.0.alpha3, =2.2.0, =0.1.0, =0.1.0, =0.1.0, =1.3.0, =1.8.0, =1.8.0, =1.3.0, =1.3.0, =1.7.4, =1.8.0, =1.3.0, =1.3.0, =2.0.0, =2.0.0.alpha3, =2.13.8.final and more Source cves: CVE-2023-6394...

io.automatiko.addons:automatiko-graphql-addon (0.17.0), io.quarkus:quarkus-smallrye-graphql-deployment (>=2.10.0.final, <=2.10.3.final) potentially affected by CVE-2022-2466 via io.quarkus:quarkus-smallrye-graphql (>=2.10.0.final, <=2.10.3.final)

io.quarkus:quarkus-smallrye-graphql MAVEN version =2.10.0.final, =2.10.0.final, =2.10.3.final Source cves: CVE-2022-2466 Source advisory: MEND:CVE-2022-2466...