EUVD-2026-11858

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in robfelty Collapsing Archives collapsing-archives allows Blind SQL Injection.This issue affects Collapsing Archives: from n/a through = 3.0.7...

EUVD-2026-11798

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Ays Pro Fox LMS fox-lms allows Blind SQL Injection.This issue affects Fox LMS: from n/a through = 1.0.6.3...

EUVD-2026-11792

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in weDevs WP ERP erp allows SQL Injection.This issue affects WP ERP: from n/a through = 1.16.10...

EUVD-2025-208653

IBM Sterling Partner Engagement Manager 6.2.3.0 through 6.2.3.5 and 6.2.4.0 through 6.2.4.2 could allow an attacker to obtain sensitive information from the query string of an HTTP GET method to process a request which could be obtained using man in the middle techniques...

CVE-2026-32704 SiYuan renderSprig: missing admin check allows any user to read full workspace DB

SiYuan is a personal knowledge management system. Prior to 3.6.1, POST /api/template/renderSprig lacks model.CheckAdminRole, allowing any authenticated user to execute arbitrary SQL queries against the SiYuan workspace database and exfiltrate all note content, metadata, and custom attributes. Thi...

@apollo/gateway (>=2.13.0-preview.0, <=2.13.1) potentially affected by CVE-2026-32621 via @apollo/query-planner (>=2.13.0, <=2.13.1)

@apollo/query-planner NPM version =2.13.0, =2.13.0-preview.0, =2.13.1 Source cves: CVE-2026-32621 Source advisory: OSV:GHSA-PFJJ-6F4P-RVMH...

@apollo/gateway (>=2.3.0-beta.2, <=2.9.5), @genesisx/graphql (>=3.0.0-beta.1, <=4.0.1) +8 more potentially affected by CVE-2026-32621 via @apollo/query-planner (>=2.3.0, <=2.9.5)

@apollo/query-planner NPM version =2.3.0, =2.3.0-beta.2, =3.0.0-beta.1, =3.0.0-beta.0, =0.13.8-alpha-20230126151930-d229ec52b, =0.0.1, =9.2.0, =2.8.54, =0.0.0-preview-20230314213245, =1.3.3, =0.0.8, =1.0.48 Source cves: CVE-2026-32621 Source advisory: OSV:GHSA-PFJJ-6F4P-RVMH...

@apollo/gateway (>=2.12.0-preview.0, <=2.12.2), @lenne.tech/nest-server (>=11.3.0, <=11.5.0) potentially affected by CVE-2026-32621 via @apollo/query-planner (>=2.12.0, <=2.12.2)

@apollo/query-planner NPM version =2.12.0, =2.12.0-preview.0, =11.3.0, =11.5.0 Source cves: CVE-2026-32621 Source advisory: OSV:GHSA-PFJJ-6F4P-RVMH...

@apollo/gateway (>=2.11.0-preview.0, <=2.11.5), @dfanchon/gateway (2.11.0) +1 more potentially affected by CVE-2026-32621 via @apollo/query-planner (>=2.11.0, <=2.11.5-preview.1)

@apollo/query-planner NPM version =2.11.0, =2.11.0-preview.0, =11.1.14, =11.2.0 Source cves: CVE-2026-32621 Source advisory: OSV:GHSA-PFJJ-6F4P-RVMH...

@apollo/gateway (>=2.11.0-preview.0, <=2.11.5), @dfanchon/gateway (2.11.0) +1 more potentially affected by CVE-2026-32621 via @apollo/query-planner (>=2.11.0, <=2.11.5-preview.1)

@apollo/query-planner NPM version =2.11.0, =2.11.0-preview.0, =11.1.14, =11.2.0 Source cves: CVE-2026-32621 Source advisory: SNYK:JS-APOLLOQUERYPLANNER-15612460...

@apollo/gateway (>=2.10.0-alpha.0, <=2.10.4), @lenne.tech/nest-server (>=10.8.3, <=11.1.13) +2 more potentially affected by CVE-2026-32621 via @apollo/query-planner (>=2.10.0, <=2.10.4)

@apollo/query-planner NPM version =2.10.0, =2.10.0-alpha.0, =10.8.3, =11.1.13 - @pothos-examples/federation 3.1.13 - @pothos-examples/prisma-federation 3.1.24 Source cves: CVE-2026-32621 Source advisory: SNYK:JS-APOLLOQUERYPLANNER-15612460...

@apollo/gateway (>=2.10.0-alpha.0, <=2.10.4), @lenne.tech/nest-server (>=10.8.3, <=11.1.13) +2 more potentially affected by CVE-2026-32621 via @apollo/query-planner (>=2.10.0, <=2.10.4)

@apollo/query-planner NPM version =2.10.0, =2.10.0-alpha.0, =10.8.3, =11.1.13 - @pothos-examples/federation 3.1.13 - @pothos-examples/prisma-federation 3.1.24 Source cves: CVE-2026-32621 Source advisory: OSV:GHSA-PFJJ-6F4P-RVMH...

Prototype Pollution

Overview @apollo/query-planner is an Apollo Query Planner Affected versions of this package are vulnerable to Prototype Pollution through incomplete sanitization of input in the query plan execution. An attacker can manipulate the Object.prototype in the gateway by crafting operations with field...

@apollo/gateway (>=2.3.0-beta.2, <=2.9.5), @genesisx/graphql (>=3.0.0-beta.1, <=4.0.1) +8 more potentially affected by CVE-2026-32621 via @apollo/query-planner (>=2.3.0, <=2.9.5)

@apollo/query-planner NPM version =2.3.0, =2.3.0-beta.2, =3.0.0-beta.1, =3.0.0-beta.0, =0.13.8-alpha-20230126151930-d229ec52b, =0.0.1, =9.2.0, =2.8.54, =0.0.0-preview-20230314213245, =1.3.3, =0.0.8, =1.0.48 Source cves: CVE-2026-32621 Source advisory: SNYK:JS-APOLLOQUERYPLANNER-15612460...

@apollo/gateway (>=2.13.0-preview.0, <=2.13.1) potentially affected by CVE-2026-32621 via @apollo/query-planner (>=2.13.0, <=2.13.1)

@apollo/query-planner NPM version =2.13.0, =2.13.0-preview.0, =2.13.1 Source cves: CVE-2026-32621 Source advisory: SNYK:JS-APOLLOQUERYPLANNER-15612460...

@apollo/composition (>=2.13.0-preview.0, <=2.13.1), @apollo/gateway (>=2.13.0-preview.0, <=2.13.1) +4 more potentially affected by CVE-2026-32621 via @apollo/federation-internals (>=2.13.0, <=2.13.1)

@apollo/federation-internals NPM version =2.13.0, =2.13.0-preview.0, =2.13.0-preview.0, =2.13.0-preview.0, =2.13.0-preview.0, =2.13.0-preview.0, =0.0.0, =0.0.2-alpha-20260313130016-7fe861602b61cb29c75e6d7e84eae979268037af Source cves: CVE-2026-32621 Source advisory: OSV:GHSA-PFJJ-6F4P-RVMH...

@apollo/gateway (>=2.12.0-preview.0, <=2.12.2), @lenne.tech/nest-server (>=11.3.0, <=11.5.0) potentially affected by CVE-2026-32621 via @apollo/query-planner (>=2.12.0, <=2.12.2)

@apollo/query-planner NPM version =2.12.0, =2.12.0-preview.0, =11.3.0, =11.5.0 Source cves: CVE-2026-32621 Source advisory: SNYK:JS-APOLLOQUERYPLANNER-15612460...

CVE-2026-32628

AnythingLLM has a SQL injection in the built‑in SQL Agent plugin (v1.11.1 and earlier) allowing a user who can invoke the agent to run arbitrary SQL on connected databases. The vulnerability stems from getTableSchemaSql() building queries via direct string concatenation of the table_name paramete...

CVE-2026-32621

Apollo Federation is an architecture for declaratively composing APIs into a unified graph. Prior to 2.9.6, 2.10.5, 2.11.6, 2.12.3, and 2.13.2, a vulnerability exists in query plan execution within the gateway that may allow pollution of Object.prototype in certain scenarios. A malicious client m...

CVE-2026-32621

CVE-2026-32621 affects Apollo Federation’s gateway, with a root cause in query plan execution leading to possible pollution of Object.prototype. The advisory and CVE entry indicate the issue exists prior to fixes in versions 2.9.6, 2.10.5, 2.11.6, 2.12.3, and 2.13.2, involving either crafted oper...