Skip to content
Ardatan vulnerabilities
Newest
-
@graphql-tools executor-legacy-ws, ardatan graphql-tools +1 more
GraphQL Tools: Shared legacy executor routes one subscription's results to a different caller
CVE-2026-118666
Fix available
6.0 Medium
-
@graphql-tools executor-legacy-ws, ardatan graphql-tools +1 more
GraphQL Tools: Per-request connection parameters persist into later users' WebSocket authentications
CVE-2026-118665
Fix available
8.2 High
-
ardatan graphql-tools
GraphQL Tools: Prototype pollution in mergeIncrementalResult via non-primitive path segments
CVE-2026-114604
Fix available
8.4 High
-
ardatan graphql-tools
GraphQL Tools has prototype pollution in well-established utility function `mergeDeep`
CVE-2026-104852
Fix available
8.2 High
-
@graphql-tools executor-legacy-ws, ardatan graphql-tools +1 more
GraphQL Tools: TLS Certificate Validation Disabled in Legacy GraphQL WebSocket Executor
CVE-2026-103921
Fix available
7.4 High
-
the-guild graphql mesh, ardatan graphql-mesh +1 more
Cache variables with the operations when transforms exist on the root level even if variables change in the further requests with the same operation
CVE-2025-27097
Fix available
5.1 Medium
-
ardatan graphql-mesh, the-guild graphql mesh cli, graphql mesh http +2 more
Unwanted access to the entire file system vulnerability due to a missing check in `staticFiles` HTTP handler in graphql-mesh
CVE-2025-27098
Fix available
5.8 Medium