773 PoCs | 119 CISA KEV

tag

Graphql

Vendure GraphQL Admin API Authentication Timing Attack / User Enumeration (CVE-2026-25050)

CVE-2026-25050 web Patched

CVE-2026-25050webMEDIUMPatched2026-07-05Saleor Stored XSS via Unrestricted File Upload (CVE-2026-23499)

CVE-2026-23499 web Patched

CVE-2026-23499webHIGHPatched2026-07-05Saleor Rich Text (EditorJS) Field Stored XSS (CVE-2026-22849)

CVE-2026-22849 (GHSA-8jcj-r5g2-qrpv) web Patched

CVE-2026-22849webHIGHPatched2026-07-05Saleor GraphQL IDOR — Unauthenticated Order PII Exfiltration (CVE-2026-24136)

CVE-2026-24136 web Patched

CVE-2026-24136webHIGH 7.5Patched2026-07-05GitLab WebSocket GraphqlChannel Unauthorized Method Enumeration — CVE-2026-5173

CVE-2026-5173 web Patched

CVE-2026-5173webHIGHPatched2026-07-05Dagster Database I/O Manager SQL Injection via Dynamic Partition Keys (CVE-2026-41490)

CVE-2026-41490 (GHSA-mjw2-v2hm-wj34) web Patched

CVE-2026-41490webHIGHPatched2026-07-05