SF
Product
Spring For Graphql
9
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 1High 6Medium 2Low 0
Watch
Add Spring For Graphql to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-41699 | 9.8 | Jun 11 | Unsafe Deserialization in Spring GraphQL Affected: 1.3.0 before 1.3.9; 1.4.0 before 1.4.5.1; 2.0.0 before 2.0.3.1 |
| CVE-2026-59286 | 8.1 | Aug 27 | Spring for GraphQL loads Untrusted Resources in GraphiQL support Affected: 1.0.0 before 1.0.8; 1.1.0 before 1.3.10; 1.4.0 before 1.4.7; 2.0.0 before 2.0.4.1 |
| CVE-2026-59285 | 8.1 | Aug 27 | Spring for GraphQL Unsafe Deserialization in pagination support Affected: 2.0.0 before 2.0.4.1 |
| CVE-2026-41700 | 8.1 | Jun 11 | Cross-Site WebSocket Hijacking in Spring for GraphQL Affected: 1.0.0 before 1.0.7; 1.3.0 before 1.3.9; 1.4.0 before 1.4.5.1; 2.0.0 before 2.0.3.1 |
| CVE-2026-59289 | 7.5 | Aug 27 | Spring for GraphQL Denial of Service via pagination support Affected: 1.2.0 before 1.3.10; 1.4.0 before 1.4.7; 2.0.0 before 2.0.4.1 |
| CVE-2026-41856 | 7.5 | Jun 11 | Spring GraphQL Annotation Detection Vulnerability Affected: 1.0.0 before 1.0.7; 1.3.0 before 1.3.9; 1.4.0 before 1.4.5.1; 2.0.0 before 2.0.3.1 |
| CVE-2026-59288 | 7.4 | Aug 27 | Spring for GraphQL Information Exposure in GraphiQL support Affected: 1.0.0 before 1.0.8; 1.1.0 before 1.3.10; 1.4.0 before 1.4.7; 2.0.0 before 2.0.4.1 |
| CVE-2026-59287 | 5.9 | Aug 27 | Spring for GraphQL WebSocket Client Denial of Service Affected: 1.3.0 before 1.3.10; 1.4.0 before 1.4.7; 2.0.0 before 2.0.4.1 |
| CVE-2023-34047 | 4.3 | Sep 20 | A batch loader function in Spring for GraphQL versions 1.1.0 - 1.1.5 and 1.2.0 - 1.2.2 may be exposed to GraphQL context with values, including security context values, from a… Affected: 1.1.0 through 1.1.5; 1.2.0 through 1.2.2 |
Showing 9