GraphCrawler

GraphCrawler GraphQL 自动化测试工具包 Graph Crawler 是用于任何 GraphQL 端点的最强大的自动化测试工具包。 版本 1.2 已发布!! 新增：可使用 Escape Technology 强大的 Graphinder 工具自动搜索端点。只需指向一个域名并添加 -e 选项，Graphinder 将执行子域名枚举并搜索常见目录以寻找 GraphQL 端点。之后 GraphCrawler 将接管并逐一处理每个发现。如果无法内省模式，可以通过 -s 选项以 JSON 文件形式提供。...

SuiteCRM Unauthenticated Graphql Introspection

Graphql Introspection is enabled without authentication, exposing the scheme defining all object types, arguments, and functions. id: CVE-2023-47643 info: name: SuiteCRM Unauthenticated Graphql Introspection author: isacaya severity: medium description: | Graphql Introspection is enabled without...

PraisonAI: MCP HTTP-stream transport is unauthenticated by default, exposing tool enumeration and an unvalidated tool-call surface

Summary PraisonAI's MCP HTTP-stream server authenticates requests only when an API key is configured; the CLI defaults --api-key to None, so praisonai mcp serve --transport http-stream exposes the full MCP surface unauthenticated. A request with no Authorization and no Origin can initialize and...

CVE-2026-34308

CVE-2026-34308: Denegación de servicio en MySQL Server componente JSON Boletín oficial del proveedor: Oracle Critical Patch Update Advisory — April 2026. Resumen según el CVE publicado Vulnerabilidad en Oracle MySQL Server componente: Server: JSON. Versiones afectadas compatibles: 8.0.0–8.0.45 ,...

CVE-2026-63720-datamodel-code-generator

CVE-2026-63720: Inyección de código en datamodel-code-generator a través de customBasePath no validado Gravedad: Alta, CVSS 3.1 7.5 / CVSS 4.0 7.5 asignada por VulnCheck, la CNA Techo ambiental despliegue como servicio de red: hasta 9.8 Vector v4.0:...

CVE-2018-1058

CVE-2018-1058 — Demostración de la Ruta de Búsqueda de PostgreSQL Este repositorio contiene el informe final y los artefactos de reproducibilidad para: CVE-2018-1058: Escalada de Privilegios en PostgreSQL mediante una Ruta de Búsqueda No Controlada El objetivo es demostrar el fallo de confianza e...

CVE-2026-106032

Server-side request forgery in the OpenAPI schema processing of the agent import functionality in Amazon Bedrock AgentCore Starter Toolkit before 0.3.14 might allow an authenticated remote actor in the same AWS account to cause the environment of a user importing a Bedrock Agent to issue arbitrar...

EUVD-2026-94002

Server-side request forgery in the OpenAPI schema processing of the agent import functionality in Amazon Bedrock AgentCore Starter Toolkit before 0.3.14 might allow an authenticated remote actor in the same AWS account to cause the environment of a user importing a Bedrock Agent to issue arbitrar...

CVE-2026-106032 Server-side request forgery and local file read via unrestricted external OpenAPI reference resolution in Bedrock AgentCore Starter Toolkit agent import

Server-side request forgery in the OpenAPI schema processing of the agent import functionality in Amazon Bedrock AgentCore Starter Toolkit before 0.3.14 might allow an authenticated remote actor in the same AWS account to cause the environment of a user importing a Bedrock Agent to issue arbitrar...

CVE-2026-106032 Server-side request forgery and local file read via unrestricted external OpenAPI reference resolution in Bedrock AgentCore Starter Toolkit agent import

Server-side request forgery in the OpenAPI schema processing of the agent import functionality in Amazon Bedrock AgentCore Starter Toolkit before 0.3.14 might allow an authenticated remote actor in the same AWS account to cause the environment of a user importing a Bedrock Agent to issue arbitrar...

CVE-2026-106032

The Amazon Bedrock AgentCore Starter Toolkit is vulnerable to Server-Side Request Forgery (SSRF) and local file read in versions prior to 0.3.14 . The root cause is unrestricted external OpenAPI reference resolution during the processing of the agent import functionality. An authenticated remote ...

CVE-2026-71203-PoC

CVE-2026-71203 — changedetection.io: Falta de autenticación en /api/v1/full-spec revela el esquema OpenAPI completo Producto: dgtlmoon/changedetection.io — v0.55.7 Archivo: changedetectionio/api/Spec.py CWE: CWE-306 — Autenticación faltante para función crítica CVSS 3.1:...

PT-2026-107262

Server-side request forgery in the OpenAPI schema processing of the agent import functionality in Amazon Bedrock AgentCore Starter Toolkit before 0.3.14 might allow an authenticated remote actor in the same AWS account to cause the environment of a user importing a Bedrock Agent to issue arbitrar...

EUVD-2026-91749

ProseMirror has a XSS vulnerability in prosemirror-view's paste handling...

Astra Linux – Vulnerability in OpenLDAP

In OpenLDAP versions 2.4.57 and 2.5.x through 2.5.1alpha, an assertion failure in slapd can occur in the issuerAndThisUpdateCheck function due to a malicious packet. This leads to a denial of service daemon exits caused by a short timestamp. This issue is related to the schemainit.c file and the...

CVE-2025-54554

CVE-2025-54554 CVE-2025-54554 – Acceso no autenticado en la API REST de tiaudit que lleva a la divulgación de información sensible Descubridor: Amanpreet Parmar | Ingeniero Senior de Seguridad @Harvard Medical School Resumen: CVE-2025-54554 identifica una vulnerabilidad en el componente tiaudit d...

CVE-2025-27407

CVE-2025-27407 GitLab Podman 实验室 用于验证 GitLab Direct Transfer HTTP 路径可达脆弱 graphql-ruby 内省模式加载器的最小本地实验室。该实验室运行一个易受攻击的 GitLab CE 容器；PoC 脚本仅在测试时在进程中启动其伪造的 GitLab 源服务器。 仅对您拥有或明确授权测试的系统运行此操作。 文件 文件| 目的 ---|--- lab.sh| 启动、等待、验证并清理 GitLab 实验室。 pochostportcmd.py| 一次性 PoC：伪造源服务器 + GitLab 登录/配置/导入触发器。 要求 带有...

CVE-2026-86817

The Five Star Business Profile and Schema WordPress plugin before 2.4.0 does not properly restrict the callbacks used to resolve schema field default values, allowing authenticated users with Author-level access and above to store input that discloses sensitive data, including other users' passwo...

CVE-2026-86817

The Five Star Business Profile and Schema WordPress plugin (versions 2.3.20-2.3.21 ) is vulnerable to a sensitive data disclosure flaw. The issue stems from the plugin failing to properly restrict callbacks used to resolve schema field default values. This allows authenticated users with Author-l...

EUVD-2026-92074

The Five Star Business Profile and Schema WordPress plugin before 2.4.0 does not properly restrict the callbacks used to resolve schema field default values, allowing authenticated users with Author-level access and above to store input that discloses sensitive data, including other users' passwo...