tag
Graphql
Medium
Vendure GraphQL Admin API Authentication Timing Attack / User Enumeration (CVE-2026-25050)
CVE-2026-25050·
Vendure (NativeAuthenticationStrategy.authenticate(), Admin GraphQL API)
unpatched
High
Saleor Stored XSS via Unrestricted File Upload (CVE-2026-23499)
CVE-2026-23499·
Saleor (saleor/saleor)
patched
High
Saleor Rich Text (EditorJS) Field Stored XSS (CVE-2026-22849)
CVE-2026-22849 (GHSA-8jcj-r5g2-qrpv)·
Saleor (open-source e-commerce platform), rich text fields (EditorJS content on pages/products)
unpatched
High
Saleor GraphQL IDOR — Unauthenticated Order PII Exfiltration (CVE-2026-24136)
CVE-2026-24136·
Saleor e-commerce platform (GraphQL API)
patched
High
GitLab WebSocket GraphqlChannel Unauthorized Method Enumeration — CVE-2026-5173
CVE-2026-5173·
GitLab CE/EE, ActionCable WebSocket endpoint (/-/cable), GraphqlChannel
patched
High
Dagster Database I/O Manager SQL Injection via Dynamic Partition Keys (CVE-2026-41490)
CVE-2026-41490 (GHSA-mjw2-v2hm-wj34)·
Dagster database I/O manager integrations: dagster-duckdb, dagster-snowflake, dagster-gcp (BigQuery), dagster-deltalake, dagster-snowflake-polars
patched