Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
88 results · page 1 of 2
Jul 15, 2026Apollo is a reliable configuration management system suitable for microservice configuration management scenarios.CVE-2026-59955 · Other software · apolloconfig · reported by GitHubHigh 7.5
Apollo is a reliable configuration management system suitable for microservice configuration management scenarios. Prior to 2.5.2, Apollo ConfigService may allow unauthorized access to raw configuration data when AccessKey or management key authentication is enabled because requests under /configfiles/raw/{appId}/{clusterName}/{namespace} are parsed for authentication as appId raw instead of the actual path appId, causing ConfigService to look up AccessKey secrets for raw before verifying the request signature and potentially continue without signature verification for the target appId. This issue is fixed in version 2.5.2.
- Product
- apollo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 15, 2026Apollo is a reliable configuration management system suitable for microservice configuration management scenarios.CVE-2026-59954 · Other software · apolloconfig · reported by GitHubHigh 7.5
Apollo is a reliable configuration management system suitable for microservice configuration management scenarios. Prior to 2.5.2, Apollo ConfigService may allow unauthorized access to configuration data when AccessKey or management key authentication is enabled because ConfigService can accept a non-canonical appId variant during authentication while downstream request handling resolves it to the protected app, including accent variants under accent-insensitive collations or trailing-space variants under PAD SPACE collations on /configs and /configfiles endpoints. This issue is fixed in version 2.5.2.
- Product
- apollo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 15, 2026Apollo is a reliable configuration management system suitable for microservice configuration management scenarios.CVE-2025-32781 · Other software · apolloconfig · reported by GitHubMedium 6.5
Apollo is a reliable configuration management system suitable for microservice configuration management scenarios. Prior to 2.5.0, Apollo Portal does not verify application and namespace permissions when an authenticated user requests a release by ID through GET /envs/{env}/releases/{releaseId} while configView.memberOnly.envs is enabled, allowing a low-privileged Portal user who obtains or guesses a valid releaseId to read configuration data from other applications and namespaces without calling UserPermissionValidator.shouldHideConfigToCurrentUser(...). This issue is fixed in version 2.5.0.
- Product
- apollo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 18, 2026An attacker within BLE communication range can monopolize the device's only available BLE connection slot, preventing legitimate users or applications from esCVE-2026-52866 · Other software · Apollo Pharmacy · reported by ics-cert@hq.dhs.govHigh 7.1
An attacker within BLE communication range can monopolize the device's only available BLE connection slot, preventing legitimate users or applications from establishing a connection.
- Product
- Blood Glucose Monitoring System (Model No. APG-01 BT)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comapollopharmacy.in
Jun 18, 2026An attacker within BLE communication range can passively intercept wireless traffic and obtain sensitive health-related information, including glucose measureCVE-2026-50034 · Other software · Apollo Pharmacy · reported by ics-cert@hq.dhs.govHigh 7.1
An attacker within BLE communication range can passively intercept wireless traffic and obtain sensitive health-related information, including glucose measurement values.
- Product
- Blood Glucose Monitoring System (Model No. APG-01 BT)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comapollopharmacy.in
Apr 9, 2026Apollo MCP Server is a Model Context Protocol server that exposes GraphQL operations as MCP tools.CVE-2026-35577 · Other software · apollographql · reported by GitHubMedium 6.8
Apollo MCP Server is a Model Context Protocol server that exposes GraphQL operations as MCP tools. Prior to version 1.7.0, the Apollo MCP Server did not validate the Host header on incoming HTTP requests when using StreamableHTTP transport. In configurations where an HTTP-based MCP server is run on localhost without additional authentication or network-level controls, this could potentially allow a malicious website—visited by a user running the server locally—to use DNS rebinding techniques to bypass same-origin policy restrictions and issue requests to the local MCP server. If successfully exploited, this could allow an attacker to invoke tools or access resources exposed by the MCP server on behalf of the local user. This issue is limited to HTTP-based transport modes (StreamableHTTP). It does not affect servers using stdio transport. The practical risk is further reduced in deployments that use authentication, network-level access controls, or are not bound to localhost. This vulnerability is fixed in 1.7.0.
- Product
- apollo-mcp-server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 16, 2026Apollo Federation is an architecture for declaratively composing APIs into a unified graph.CVE-2026-32621 · Other software · @apollo · reported by GitHubCritical 9.9
Apollo Federation is an architecture for declaratively composing APIs into a unified graph. Prior to 2.9.6, 2.10.5, 2.11.6, 2.12.3, and 2.13.2, a vulnerability exists in query plan execution within the gateway that may allow pollution of Object.prototype in certain scenarios. A malicious client may be able to pollute Object.prototype in gateway directly by crafting operations with field aliases and/or variable names that target prototype-inheritable properties. Alternatively, if a subgraph were to be compromised by a malicious actor, they may be able to pollute Object.prototype in gateway by crafting JSON response payloads that target prototype-inheritable properties. This vulnerability is fixed in 2.9.6, 2.10.5, 2.11.6, 2.12.3, and 2.13.2.
- Product
- federation-internals
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 5, 2026Apollo | Night Club, DJ Event: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2026-27340 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in AncoraThemes Apollo | Night Club, DJ Event WordPress Theme apollo allows PHP Local File Inclusion.This issue affects Apollo | Night Club, DJ Event WordPress Theme: from n/a through <= 1.3.1.
- Product
- Apollo | Night Club, DJ Event
- Affected
- up to 1.3.1
- What to do
- Affects up to 1.3.1. Update Apollo | Night Club, DJ Event to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 19, 2026Apollo13 Framework Extensions: Stored Cross-Site ScriptingCVE-2025-13617 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Apollo13 Framework Extensions plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘a13_alt_link’ parameter in all versions up to, and including, 1.9.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Apollo13 Framework Extensions
- Affected
- up to 1.9.8
- What to do
- Affects up to 1.9.8. Update Apollo13 Framework Extensions to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Feb 4, 2026Apollo Server is an open-source, spec-compliant GraphQL server that's compatible with any GraphQL client, including Apollo Client.CVE-2026-23897 · Other software · apollographql · reported by GitHubHigh 7.5
Apollo Server is an open-source, spec-compliant GraphQL server that's compatible with any GraphQL client, including Apollo Client. In versions from 2.0.0 to 3.13.0, 4.2.0 to before 4.13.0, and 5.0.0 to before 5.4.0, the default configuration of startStandaloneServer from @apollo/server/standalone is vulnerable to denial of service (DoS) attacks through specially crafted request bodies with exotic character set encodings. This issue does not affect users that use @apollo/server as a dependency for integration packages, like @as-integrations/express5 or @as-integrations/next, only direct usage of startStandaloneServer.
- Product
- apollo-server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 22, 2026A vulnerability in Palantir's Aries service allowed unauthenticated access to log viewing and management functionality on Apollo instances using default configuCVE-2025-68609 · Other software · Palantir · reported by cve-coordination@palantir.comMedium 6.6
A vulnerability in Palantir's Aries service allowed unauthenticated access to log viewing and management functionality on Apollo instances using default configuration. The defect resulted in both authentication and authorization checks being bypassed, potentially allowing any network-accessible client to view system logs and perform operations without valid credentials. No evidence of exploitation was identified during the vulnerability window.
- Product
- com.palantir.aries:aries
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 13, 2025Apollo Federation is an architecture for declaratively composing APIs into a unified graph.CVE-2025-64530 · Other software · apollographql · reported by GitHubHigh 7.5
Apollo Federation is an architecture for declaratively composing APIs into a unified graph. A vulnerability in versions of Apollo Federation's composition logic prior to 2.9.5, 2.10.4, 2.11.5, and 2.12.1 allowed some queries to Apollo Router to improperly bypass access controls on types/fields. Apollo Federation incorrectly allowed user-defined access control directives on interface types/fields, which could be bypassed by instead querying the implementing object types/fields in Apollo Router via inline fragments, for example. A fix to versions 2.9.5, 2.10.4, 2.11.5, and 2.12.1 of composition logic in Federation now disallows interfaces types and fields to contain user-defined access control directives. Some workarounds are available. Users of Apollo Rover with an unpatched composition version or are using the Apollo Studio build pipeline with Federation version 2.8 or below should manually copy the access control requirements on interface types/fields to each implementing object type/field where appropriate. Do not remove those access control requirements from the interface types/fields, as unpatched Apollo Composition will not automatically generate them in the supergraph schema.
- Product
- federation
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 7, 2025Apollo Router Core is a configurable Rust graph router written to run a federated supergraph using Apollo Federation 2.CVE-2025-64347 · Other software · apollographql · reported by GitHubHigh 7.5
Apollo Router Core is a configurable Rust graph router written to run a federated supergraph using Apollo Federation 2. Versions 1.61.12-rc.0 and below and 2.8.1-rc.0 allow unauthorized access to protected data through schema elements with access control directives (@authenticated, @requiresScopes, and @policy) that were renamed via @link imports. Router did not enforce renamed access control directives on schema elements (e.g. fields and types), allowing queries to bypass those element-level access controls. This issue is fixed in versions 1.61.12 and 2.8.1.
- Product
- router
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 6, 2025Apollo Router Core is a configurable graph router written in Rust to run a federated supergraph using Apollo Federation 2.CVE-2025-64173 · Other software · apollographql · reported by GitHubHigh 7.5
Apollo Router Core is a configurable graph router written in Rust to run a federated supergraph using Apollo Federation 2. In versions 1.61.11 below, as well as 2.0.0-alpha.0 through 2.8.1-rc.0, a vulnerability allowed for unauthenticated queries to access data that required additional access controls. Router incorrectly handled access control directives on interface types/fields and their implementing object types/fields, applying them to interface types/fields while ignoring directives on their implementing object types/fields when all implementations had the same requirements. Apollo Router customers defining @authenticated, @requiresScopes, or @policy directives inconsistently on polymorphic types (i.e., object types that implement interface types) are impacted. This issue is fixed in versions 1.61.12 and 2.8.1.
- Product
- router
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 26, 2025Apollo Studio Embeddable Explorer & Embeddable Sandbox are website embeddable software solutions from Apollo GraphQL.CVE-2025-59845 · Other software · apollographql · reported by GitHubHigh 8.2
Apollo Studio Embeddable Explorer & Embeddable Sandbox are website embeddable software solutions from Apollo GraphQL. Prior to Apollo Sandbox version 2.7.2 and Apollo Explorer version 3.7.3, a cross-site request forgery (CSRF) vulnerability was identified. The vulnerability arises from missing origin validation in the client-side code that handles window.postMessage events. A malicious website can send forged messages to the embedding page, causing the victim’s browser to execute arbitrary GraphQL queries or mutations against their GraphQL server while authenticated with the victim’s cookies. This issue has been patched in Apollo Sandbox version 2.7.2 and Apollo Explorer version 3.7.3.
- Product
- embeddable-explorer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 20, 2025Apollo - Sticky Full Width HTML5 Audio Player: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-48168 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LambertGroup Apollo - Sticky Full Width HTML5 Audio Player lbg-audio5-html5-shoutcast-sticky allows Reflected XSS.This issue affects Apollo - Sticky Full Width HTML5 Audio Player: from n/a through <= 3.4.
- Product
- Apollo - Sticky Full Width HTML5 Audio Player
- Affected
- up to 3.4
- What to do
- Affects up to 3.4. Update Apollo - Sticky Full Width HTML5 Audio Player to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 8, 2025Absolute Path Traversal vulnerability in AP Page Builder versions prior to 4.0.0 could allow an unauthenticated remote user to modify the 'product_item_path' wiCVE-2024-6648 · Other software · Apollo Theme · reported by cve-coordination@incibe.esHigh 8.7
Absolute Path Traversal vulnerability in AP Page Builder versions prior to 4.0.0 could allow an unauthenticated remote user to modify the 'product_item_path' within the 'config' JSON file, allowing them to read any file on the system.
- Product
- AP Page Builder
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 29, 2025CWE-250: Execution with Unnecessary PrivilegesCVE-2025-23181 · Other software · Ribbon Communications · reported by cna@cyber.gov.ilHigh 8
CWE-250: Execution with Unnecessary Privileges
- Product
- Apollo 9608
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 29, 2025CWE-250: Execution with Unnecessary PrivilegesCVE-2025-23180 · Other software · Ribbon Communications · reported by cna@cyber.gov.ilHigh 8
CWE-250: Execution with Unnecessary Privileges
- Product
- Apollo 9608
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 29, 2025CWE-798: Use of Hard-coded CredentialsCVE-2025-23179 · Other software · Ribbon Communications · reported by cna@cyber.gov.ilMedium 5.5
CWE-798: Use of Hard-coded Credentials
- Product
- Apollo 9608
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 29, 2025CWE-923: Improper Restriction of Communication Channel to Intended EndpointsCVE-2025-23178 · Other software · Ribbon Communications · reported by cna@cyber.gov.ilHigh 7.6
CWE-923: Improper Restriction of Communication Channel to Intended Endpoints
- Product
- Apollo 9608
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 29, 2025CWE-427: Uncontrolled Search Path ElementCVE-2025-23177 · Other software · Ribbon Communications · reported by cna@cyber.gov.ilHigh 7.6
CWE-427: Uncontrolled Search Path Element
- Product
- Apollo 9608
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 9, 2025The Apollo Router Core is a configurable, high-performance graph router written in Rust to run a federated supergraph that uses Apollo Federation 2.CVE-2025-32380 · Other software · apollographql · reported by GitHubHigh 7.5
The Apollo Router Core is a configurable, high-performance graph router written in Rust to run a federated supergraph that uses Apollo Federation 2. A vulnerability in Apollo Router's usage of Apollo Compiler allowed queries with deeply nested and reused named fragments to be prohibitively expensive to validate. This could lead to excessive resource consumption and denial of service. Apollo Router's usage of Apollo Compiler has been updated so that validation logic processes each named fragment only once, preventing redundant traversal. This has been remediated in apollo-router versions 1.61.2 and 2.1.1.
- Product
- router
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 7, 2025The Apollo Router Core is a configurable, high-performance graph router written in Rust to run a federated supergraph that uses Apollo Federation 2.CVE-2025-32034 · Other software · apollographql · reported by GitHubHigh 7.5
The Apollo Router Core is a configurable, high-performance graph router written in Rust to run a federated supergraph that uses Apollo Federation 2. Prior to 1.61.2 and 2.1.1, a vulnerability in Apollo Router allowed queries with deeply nested and reused named fragments to be prohibitively expensive to query plan, specifically during named fragment expansion. Named fragments were being expanded once per fragment spread during query planning, leading to exponential resource usage when deeply nested and reused fragments were involved. This could lead to excessive resource consumption and denial of service. This has been remediated in apollo-router versions 1.61.2 and 2.1.1.
- Product
- router
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 7, 2025The Apollo Router Core is a configurable, high-performance graph router written in Rust to run a federated supergraph that uses Apollo Federation 2.CVE-2025-32033 · Other software · apollographql · reported by GitHubHigh 7.5
The Apollo Router Core is a configurable, high-performance graph router written in Rust to run a federated supergraph that uses Apollo Federation 2. Prior to 1.61.2 and 2.1.1, the operation limits plugin uses unsigned 32-bit integers to track limit counters (e.g. for a query's height). If a counter exceeded the maximum value for this data type (4,294,967,295), it wrapped around to 0, unintentionally allowing queries to bypass configured thresholds. This could occur for large queries if the payload limit were sufficiently increased, but could also occur for small queries with deeply nested and reused named fragments. This has been remediated in apollo-router versions 1.61.2 and 2.1.1.
- Product
- router
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 7, 2025The Apollo Router Core is a configurable, high-performance graph router written in Rust to run a federated supergraph that uses Apollo Federation 2.CVE-2025-32032 · Other software · apollographql · reported by GitHubHigh 7.5
The Apollo Router Core is a configurable, high-performance graph router written in Rust to run a federated supergraph that uses Apollo Federation 2. A vulnerability in Apollo Router allowed queries with deeply nested and reused named fragments to be prohibitively expensive to query plan, specifically due to internal optimizations being frequently bypassed. The query planner includes an optimization that significantly speeds up planning for applicable GraphQL selections. However, queries with deeply nested and reused named fragments can generate many selections where this optimization does not apply, leading to significantly longer planning times. Because the query planner does not enforce a timeout, a small number of such queries can exhaust router's thread pool, rendering it inoperable. This could lead to excessive resource consumption and denial of service. This has been remediated in apollo-router versions 1.61.2 and 2.1.1.
- Product
- router
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 7, 2025Apollo Gateway provides utilities for combining multiple GraphQL microservices into a single GraphQL endpoint.CVE-2025-32031 · Other software · apollographql · reported by GitHubHigh 7.5
Apollo Gateway provides utilities for combining multiple GraphQL microservices into a single GraphQL endpoint. Prior to 2.10.1, a vulnerability in Apollo Gateway allowed queries with deeply nested and reused named fragments to be prohibitively expensive to query plan, specifically due to internal optimizations being frequently bypassed. The query planner includes an optimization that significantly speeds up planning for applicable GraphQL selections. However, queries with deeply nested and reused named fragments can generate many selections where this optimization does not apply, leading to significantly longer planning times. Because the query planner does not enforce a timeout, a small number of such queries can render gateway inoperable. This could lead to excessive resource consumption and denial of service. This has been remediated in @apollo/gateway version 2.10.1.
- Product
- federation
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 7, 2025Apollo Gateway provides utilities for combining multiple GraphQL microservices into a single GraphQL endpoint.CVE-2025-32030 · Other software · apollographql · reported by GitHubHigh 7.5
Apollo Gateway provides utilities for combining multiple GraphQL microservices into a single GraphQL endpoint. Prior to 2.10.1, a vulnerability in Apollo Gateway allowed queries with deeply nested and reused named fragments to be prohibitively expensive to query plan, specifically during named fragment expansion. Named fragments were being expanded once per fragment spread during query planning, leading to exponential resource usage when deeply nested and reused fragments were involved. This could lead to excessive resource consumption and denial of service. This has been remediated in @apollo/gateway version 2.10.1.
- Product
- federation
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 7, 2025apollo-compiler is a query-based compiler for the GraphQL query language.CVE-2025-31496 · Other software · apollographql · reported by GitHubHigh 7.5
apollo-compiler is a query-based compiler for the GraphQL query language. Prior to 1.27.0, a vulnerability in Apollo Compiler allowed queries with deeply nested and reused named fragments to be prohibitively expensive to validate. Named fragments were being processed once per fragment spread in some cases during query validation, leading to exponential resource usage when deeply nested and reused fragments were involved. This could lead to excessive resource consumption and denial of service in applications. This vulnerability is fixed in 1.27.0.
- Product
- apollo-rs
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 4, 2025Certain functionality within GMOD Apollo does not require authentication when passed with an administrative usernameCVE-2025-24924 · Other software · GMOD · reported by ics-cert@hq.dhs.govCritical 9.3
Certain functionality within GMOD Apollo does not require authentication when passed with an administrative username
- Product
- Apollo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 4, 2025When uploading organism or sequence data via the web interface, GMOD Apollo will unzip and inspect the files and will not check for path traversal in suppoCVE-2025-23410 · Other software · GMOD · reported by ics-cert@hq.dhs.govCritical 9.3
When uploading organism or sequence data via the web interface, GMOD Apollo will unzip and inspect the files and will not check for path traversal in supported archive types.
- Product
- Apollo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 4, 2025GMOD Apollo does not have sufficient logical or access checks when updating a user's information.CVE-2025-21092 · Other software · GMOD · reported by ics-cert@hq.dhs.govHigh 7.1
GMOD Apollo does not have sufficient logical or access checks when updating a user's information. This could result in an attacker being able to escalate privileges for themselves or others.
- Product
- Apollo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 4, 2025After attempting to upload a file that does not meet prerequisites, GMOD Apollo will respond with local path information disclosureCVE-2025-20002 · Other software · GMOD · reported by ics-cert@hq.dhs.govMedium 6.9
After attempting to upload a file that does not meet prerequisites, GMOD Apollo will respond with local path information disclosure
- Product
- Apollo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 9, 2024Apollo13 Framework Extensions: Missing AuthorizationCVE-2023-25959 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Apollo13Themes Apollo13 Framework Extensions allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Apollo13 Framework Extensions: from n/a through 1.8.10.
- Product
- Apollo13 Framework Extensions
- Affected
- up to 1.8.10
- What to do
- Affects up to 1.8.10. Update Apollo13 Framework Extensions to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 27, 2024The Apollo Router Core is a configurable, high-performance graph router written in Rust to run a federated supergraph that uses Apollo Federation 2.CVE-2024-43783 · Other software · apollographql · reported by GitHubHigh 7.5
The Apollo Router Core is a configurable, high-performance graph router written in Rust to run a federated supergraph that uses Apollo Federation 2. Instances of the Apollo Router running versions >=1.21.0 and < 1.52.1 are impacted by a denial of service vulnerability if _all_ of the following are true: 1. The Apollo Router has been configured to support [External Coprocessing](https://www.apollographql.com/docs/router/customizations/coprocessor). 2. The Apollo Router has been configured to send request bodies to coprocessors. This is a non-default configuration and must be configured intentionally by administrators. Instances of the Apollo Router running versions >=1.7.0 and <1.52.1 are impacted by a denial-of-service vulnerability if all of the following are true: 1. Router has been configured to use a custom-developed Native Rust Plugin. 2. The plugin accesses Request.router_request in the RouterService layer. 3. You are accumulating the body from Request.router_request into memory. If using an impacted configuration, the Router will load entire HTTP request bodies into memory without respect to other HTTP request size-limiting configurations like limits.http_max_request_bytes.
- Product
- router
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 27, 2024Apollo Federation is an architecture for declaratively composing APIs into a unified graph.CVE-2024-43414 · Other software · apollographql · reported by GitHubHigh 7.5
Apollo Federation is an architecture for declaratively composing APIs into a unified graph. Each team can own their slice of the graph independently, empowering them to deliver autonomously and incrementally. Instances of @apollo/query-planner >=2.0.0 and <2.8.5 are impacted by a denial-of-service vulnerability. @apollo/gateway versions >=2.0.0 and < 2.8.5 and Apollo Router <1.52.1 are also impacted through their use of @apollo/query-panner. If @apollo/query-planner is asked to plan a sufficiently complex query, it may loop infinitely and never complete. This results in unbounded memory consumption and either a crash or out-of-memory (OOM) termination. This issue can be triggered if you have at least one non-@key field that can be resolved by multiple subgraphs. To identify these shared fields, the schema for each subgraph must be reviewed. The mechanism to identify shared fields varies based on the version of Federation your subgraphs are using. You can check if your subgraphs are using Federation 1 or Federation 2 by reviewing their schemas. Federation 2 subgraph schemas will contain a @link directive referencing the version of Federation being used while Federation 1 subgraphs w
- Product
- federation
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comapollographql.com
Aug 20, 2024Apollo is a configuration management system.CVE-2024-43397 · Other software · apolloconfig · reported by GitHubMedium 4.3
Apollo is a configuration management system. A vulnerability exists in the synchronization configuration feature that allows users to craft specific requests to bypass permission checks. This exploit enables them to modify a namespace without the necessary permissions. The issue was addressed with an input parameter check which was released in version 2.3.0.
- Product
- apollo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 20, 2024An issue in apollocongif apollo v.2.2.0 allows a remote attacker to obtain sensitive information via a crafted request.CVE-2024-42662 · Other software · Apolloconfig · reported by MITREHigh 7.5
An issue in apollocongif apollo v.2.2.0 allows a remote attacker to obtain sensitive information via a crafted request.
- Product
- Apollo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgithub.com
Jul 21, 2024Apollo13 Framework Extensions: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')CVE-2024-37480 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Apollo13Themes Apollo13 Framework Extensions apollo13-framework-extensions allows Stored XSS.This issue affects Apollo13 Framework Extensions: from n/a through 1.9.3.
- Product
- Apollo13 Framework Extensions
- Affected
- up to 1.9.3
- What to do
- Affects up to 1.9.3. Update Apollo13 Framework Extensions to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
May 2, 2024Apollo Router is a configurable, graph router written in Rust to run a federated supergraph that uses Apollo Federation 2.CVE-2024-32971 · Other software · apollographql · reported by GitHubCritical 9
Apollo Router is a configurable, graph router written in Rust to run a federated supergraph that uses Apollo Federation 2. The affected versions of Apollo Router contain a bug that in limited circumstances, could lead to unexpected operations being executed which can result in unintended data or effects. This only affects Router instances configured to use distributed query plan caching. The root cause of this defect is a bug in Apollo Router’s cache retrieval logic: When this defect is present and distributed query planning caching is enabled, asking the Router to execute an operation (whether it is a query, a mutation, or a subscription) may result in an unexpected variation of that operation being executed or the generation of unexpected errors. The issue stems from inadvertently executing a modified version of a previously executed operation, whose query plan is stored in the underlying cache (specifically, Redis). Depending on the type of the operation, the result may vary. For a query, results may be fetched that don’t match what was requested (e.g., rather than running `fetchUsers(type: ENTERPRISE)` the Router may run `fetchUsers(type: TRIAL)`. For a mutation, this may resul
- Product
- router
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 26, 2024An issue was discovered on WyreStorm Apollo VX20 devices before 1.3.58.CVE-2024-25736 · Other software · wyrestorm · reported by MITREHigh 7.5
An issue was discovered on WyreStorm Apollo VX20 devices before 1.3.58. Remote attackers can restart the device via a /device/reboot GET request.
- Product
- apollo_vx20
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comhyp3rlinx.altervista.org
Mar 26, 2024An issue was discovered on WyreStorm Apollo VX20 devices before 1.3.58.CVE-2024-25735 · Other software · wyrestorm · reported by MITRECritical 9.1
An issue was discovered on WyreStorm Apollo VX20 devices before 1.3.58. Remote attackers can discover cleartext passwords via a SoftAP /device/config GET request.
- Product
- apollo_vx20
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comhyp3rlinx.altervista.org
Mar 26, 2024An issue was discovered on WyreStorm Apollo VX20 devices before 1.3.58.CVE-2024-25734 · Other software · Wyrestorm · reported by MITREHigh 7.5
An issue was discovered on WyreStorm Apollo VX20 devices before 1.3.58. The TELNET service prompts for a password only after a valid username is entered, which might make it easier for remote attackers to enumerate user accounts.
- Product
- Apollo Vx20 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comhyp3rlinx.altervista.org
Mar 20, 2024The Apollo Router is a graph router written in Rust to run a federated supergraph that uses Apollo Federation.CVE-2024-28101 · Other software · apollographql · reported by GitHubHigh 7.5
The Apollo Router is a graph router written in Rust to run a federated supergraph that uses Apollo Federation. Versions 0.9.5 until 1.40.2 are subject to a Denial-of-Service (DoS) type vulnerability. When receiving compressed HTTP payloads, affected versions of the Router evaluate the `limits.http_max_request_bytes` configuration option after the entirety of the compressed payload is decompressed. If affected versions of the Router receive highly compressed payloads, this could result in significant memory consumption while the compressed payload is expanded. Router version 1.40.2 has a fix for the vulnerability. Those who are unable to upgrade may be able to implement mitigations at proxies or load balancers positioned in front of their Router fleet (e.g. Nginx, HAProxy, or cloud-native WAF services) by creating limits on HTTP body upload size.
- Product
- router
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 8, 2024Apollo13 Framework Extensions: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-24880 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Apollo13Themes Apollo13 Framework Extensions allows Stored XSS.This issue affects Apollo13 Framework Extensions: from n/a through 1.9.2.
- Product
- Apollo13 Framework Extensions
- Affected
- up to 1.9.2
- What to do
- Affects up to 1.9.2. Update Apollo13 Framework Extensions to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Jan 30, 2024apollo-client-nextjs is the Apollo Client support for the Next.js App Router.CVE-2024-23841 · Other software · apollographql · reported by GitHubHigh 8.2
apollo-client-nextjs is the Apollo Client support for the Next.js App Router. The @apollo/experimental-apollo-client-nextjs NPM package is vulnerable to a cross-site scripting vulnerability. To exploit this vulnerability, an attacker would need to either inject malicious input (e.g. by redirecting a user to a specifically-crafted link) or arrange to have malicious input be returned by a GraphQL server (e.g. by persisting it in a database). To fix this issue, please update to version 0.7.0 or later.
- Product
- apollo-client-nextjs
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 12, 2024A vulnerability was found in Apollo 2.0.0/2.0.1 and classified as problematic.CVE-2022-4962 · Other software · apolloconfig · reported by VulDBMedium 4.3
A vulnerability was found in Apollo 2.0.0/2.0.1 and classified as problematic. Affected by this issue is some unknown functionality of the file /users of the component Configuration Center. The manipulation leads to improper authorization. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The real existence of this vulnerability is still doubted at the moment. VDB-250430 is the identifier assigned to this vulnerability. NOTE: The maintainer explains that user data information like user id, name, and email are not sensitive.
- Product
- apollo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 5, 2024Apollo13 Framework Extensions: Cross-Site Request Forgery (CSRF)CVE-2023-51539 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in Apollo13Themes Apollo13 Framework Extensions.This issue affects Apollo13 Framework Extensions: from n/a through 1.9.1.
- Product
- Apollo13 Framework Extensions
- Affected
- up to 1.9.1
- What to do
- Affects up to 1.9.1. Update Apollo13 Framework Extensions to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Oct 18, 2023The Apollo Router is a configurable, high-performance graph router written in Rust to run a federated supergraph that uses Apollo Federation.CVE-2023-45812 · Other software · apollographql · reported by GitHubHigh 7.5
The Apollo Router is a configurable, high-performance graph router written in Rust to run a federated supergraph that uses Apollo Federation. Affected versions are subject to a Denial-of-Service (DoS) type vulnerability which causes the Router to panic and terminate when a multi-part response is sent. When users send queries to the router that uses the `@defer` or Subscriptions, the Router will panic. To be vulnerable, users of Router must have a coprocessor with `coprocessor.supergraph.response` configured in their `router.yaml` and also to support either `@defer` or Subscriptions. Apollo Router version 1.33.0 has a fix for this vulnerability which was introduced in PR #4014. Users are advised to upgrade. Users unable to upgrade should avoid using the coprocessor supergraph response or disable defer and subscriptions support and continue to use the coprocessor supergraph response.
- Product
- router
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 27, 2023In Apollo change requests, comments added by users could contain a javascript URI link that when rendered will result in an XSS that require user interaction.CVE-2023-30959 · Other software · Palantir · reported by cve-coordination@palantir.comMedium 4.1
In Apollo change requests, comments added by users could contain a javascript URI link that when rendered will result in an XSS that require user interaction.
- Product
- com.palantir.apollo:autopilot
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpalantir.safebase.uspalantir.safebase.us
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.