ST
Vendor
strawberry-graphql
8
CVEs
0
On KEV
2
New 30D
Products
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-107728 | ST strawberry strawberry-graphql | 7.5 | Oct 8 | Strawberry GraphQL: Synchronous permission checks can treat an awaitable authorization result as truthy |
| CVE-2026-107727 | ST strawberry strawberry-graphql | 3.7 | Oct 8 | Strawberry legacy graphql-ws retains naturally completed subscription slots |
| CVE-2026-47707 | ST strawberry strawberry-graphql | 5.3 | Jun 4 | Strawberry GraphQL's Bypass of MaxAliasesLimiter via Fragment Spreads leading to GraphQL Alias Amplification |
| CVE-2026-45739 | ST strawberry strawberry-graphql | 4.3 | Jun 4 | Strawberry GraphQL: Default GraphiQL may expose HTTP headers in URLs |
| CVE-2026-47706 | ST strawberry strawberry-graphql | 5.3 | Jun 4 | Strawberry GraphQL has a Circular Fragment Reference DOS |
| CVE-2026-35523 | ST strawberry strawberry-graphql | 7.5 | Apr 7 | Authentication bypass in strawberry-graphql via legacy graphql-ws WebSocket subprotocol |
| CVE-2026-35526 | ST strawberry strawberry-graphql | 7.5 | Apr 7 | Strawberry GraphQL affected by a Denial of Service via unbounded WebSocket subscriptions |
| CVE-2025-22151 | ST strawberry strawberry-graphql | 3.7 | Jan 9 | Strawberry GraphQL has a type resolution vulnerability |