Aardatan

Products

Exploited and recent CVEs

• CVE-2026-114604 High 8.4 GraphQL Tools: Prototype pollution in mergeIncrementalResult via non-primitive path segments 0.5%
• CVE-2026-118666 Medium 6.0 GraphQL Tools: Shared legacy executor routes one subscription's results to a different caller 0.3%
• CVE-2026-118665 High 8.2 GraphQL Tools: Per-request connection parameters persist into later users' WebSocket authentications 0.4%
• CVE-2026-104852 High 8.2 GraphQL Tools has prototype pollution in well-established utility function `mergeDeep` 0.5%
• CVE-2026-103921 High 7.4 GraphQL Tools: TLS Certificate Validation Disabled in Legacy GraphQL WebSocket Executor 0.3%
• CVE-2025-27097 Medium 5.1 Cache variables with the operations when transforms exist on the root level even if variables change in the further requests with the same operation 0.4%
• CVE-2025-27098 Medium 5.8 Unwanted access to the entire file system vulnerability due to a missing check in `staticFiles` HTTP handler in graphql-mesh 0.4%