graphql Archives • Daily CyberSecurity

Twenty CRM Flaw CVE-2026-105763 Exposes Plaintext Email Passwords to Any Workspace Member

Twenty CRM vulnerability CVE-2026-105763 exposing plaintext IMAP SMTP CalDAV passwords via GraphQL

Twenty CRM Flaw CVE-2026-105763 Exposes Plaintext Email Passwords to Any Workspace Member

Do Son October 6, 2026

Twenty CRM vulnerability CVE-2026-105763 (CVSS 9.6) enables plaintext password disclosure of IMAP and SMTP accounts. Upgrade to 2.7.0.

CVE-2026-19478: GitLab Flaw Exploited in the Wild, PoC Public GitLab CVE-2026-19478 critical vulnerability warning showing unauthenticated attackers delete public projects exploited in the wild

GitLab CVE-2026-19478 critical vulnerability warning showing unauthenticated attackers delete public projects exploited in the wild

CVE-2026-19478: GitLab Flaw Exploited in the Wild, PoC Public

Do Son August 23, 2026

GitLab CVE-2026-19478 vulnerability lets unauthenticated attackers delete public projects. Exploited in the wild with public PoC. Patch now.

CVE-2026-19478 (CVSS 9.4): GitLab GraphQL Code Injection Flaw Patched CVE-2026-19478 GitLab GraphQL code injection vulnerability CVSS 9.4 patch release CVE-2026-19650 CSRF

CVE-2026-19478 GitLab GraphQL code injection vulnerability CVSS 9.4 patch release CVE-2026-19650 CSRF

CVE-2026-19478 (CVSS 9.4): GitLab GraphQL Code Injection Flaw Patched

Do Son August 18, 2026

GitLab patched CVE-2026-19478, a CVSS 9.4 GraphQL code injection flaw letting unauthenticated users alter or delete project data. Update now.

Dgraph’s Debug Endpoint Hands Over Admin Tokens to Anyone Dgraph Vulnerability CVSS 10.0 Dgraph Admin Leak CVE-2026-40173

Dgraph’s Debug Endpoint Hands Over Admin Tokens to Anyone

Do Son April 19, 2026

Dgraph (CVE-2026-40173) leaks admin tokens in plain text via unauthenticated debug endpoints. This critical 9.4 CVSS flaw allows full DB takeover. Patch now!

Security Alert: GitLab Issues Patch for High-Severity Vulnerabilities Across CE and EE GitLab Security Code Integrity GitLab sale GitLab, Security GitLab Stored XSS, Kubernetes Proxy Flaw

GitLab Security Code Integrity GitLab sale GitLab, Security GitLab Stored XSS, Kubernetes Proxy Flaw

Security Alert: GitLab Issues Patch for High-Severity Vulnerabilities Across CE and EE

Do Son April 9, 2026

GitLab releases critical patches (18.10.3+) for WebSocket flaws, Terraform DoS, and unauthorized privilege demotions. Update your self-managed instances!

Zero Authentication, Total Control: Critical CVSS 10 Flaw Uncovered in Dgraph Database Dgraph Vulnerability CVSS 10.0 Dgraph Admin Leak CVE-2026-40173

Zero Authentication, Total Control: Critical CVSS 10 Flaw Uncovered in Dgraph Database

Do Son April 5, 2026

Dgraph patches a critical 10.0 CVSS flaw (CVE-2026-33976). Unauthenticated attackers can overwrite databases and read local files. Update to v25.3.1 now!

GitLab Critical Alert: High-Severity Flaws Allow App Impersonation and AI Token Leaks GitLab Security Update Account Impersonation GitLab Security Update CVE-2026-1090 GitLab vulnerability GitLab vulnerability, GitLab patches

GitLab Security Update Account Impersonation GitLab Security Update CVE-2026-1090 GitLab vulnerability GitLab vulnerability, GitLab patches

GitLab Critical Alert: High-Severity Flaws Allow App Impersonation and AI Token Leaks

Do Son March 25, 2026

GitLab has released a critical security advisory alongside versions 18.10.1, 18.9.3, and 18.8.7 for its Community (CE)...

CVE-2026-25993: Critical EverShop SQL Injection (CVSS 9.3) Exposes Stores

Do Son February 12, 2026

Critical EverShop flaw CVE-2026-25993 (CVSS 9.3) allows Second-Order SQL Injection via URL keys. Update to v2.1.1 to prevent store takeover.

GitLab Patch Alert: High-Severity Web IDE Flaw Exposes Private Repos GitLab Security Update CVE-2025-7659 CVE-2024-5655 GitLab Vulnerabilities, XSS & Data Exposure

GitLab Security Update CVE-2025-7659 CVE-2024-5655 GitLab Vulnerabilities, XSS & Data Exposure

GitLab Patch Alert: High-Severity Web IDE Flaw Exposes Private Repos

Do Son February 11, 2026

GitLab fixes critical CVE-2025-7659 (CVSS 8.0). Unauthenticated attackers can steal tokens via Web IDE. Update to v18.8.4 now to secure your code.

SuiteCRM SQL Injection Flaws (CVE-2025-64492, CVE-2025-64493) Expose Customer Data SuiteCRM SQL Injection, GraphQL SQLi

SuiteCRM SQL Injection Flaws (CVE-2025-64492, CVE-2025-64493) Expose Customer Data

Do Son November 11, 2025

SuiteCRM released an urgent patch (v8.9.1) for two SQL Injection flaws. The time-based SQLi (CVSS 8.8) and GraphQL SQLi allow authenticated users to extract sensitive customer data from the backend database.

GitLab Patches Two High-Severity Flaws in GraphQL API Affecting Both CE and EE Editions GitLab security updates Duo AI flaw fixed GitLab Runner Hijack, DoS Fix GitLab GraphQL Flaws, CVE-2025-11340 CVE-2024-9693 GitLab vulnerability, XSS

GitLab security updates Duo AI flaw fixed GitLab Runner Hijack, DoS Fix GitLab GraphQL Flaws, CVE-2025-11340 CVE-2024-9693 GitLab vulnerability, XSS

GitLab Patches Two High-Severity Flaws in GraphQL API Affecting Both CE and EE Editions

Do Son October 9, 2025

GitLab patched two high-severity flaws: CVE-2025-11340 (Auth Bypass) allows API write access with read-only tokens, and CVE-2025-10004 permits unauthenticated DoS via GraphQL.

CVE-2025-27407 (CVSS 9.1): Critical GraphQL-Ruby Flaw Exposes Millions to RCE

Do Son March 16, 2025

Learn about CVE-2025-27407, a critical vulnerability in graphql-ruby that poses serious risks to applications using it.