Curated security research, vulnerabilities, advisories and tools for practitioners.

#graphql

Security coverage tagged graphql.

1.

CVE-2026-19478 GitLab GraphQL unauthenticated project deletion

vulnerability | Critical | 2026-08-27 06:30 | CVE-2026-19478 | github.com | original ↗ | #gitlab | #access-control | #authentication

2.

The Red Agent POV: Exploiting Broken Object-Level Authorization in an Airline GraphQL API

blog | 2026-06-29 09:31 | wiz.io | original ↗ | #data-exposure | #api-security | #graphql

3.

Dojo challenge #47 APICrash solution

blog | 2026-01-14 15:19 | yeswehack.com | original ↗ | #appsec | #ctf | #web-security

4.

blog | 2025-08-26 00:00 | caido.io | original ↗ | #caido | #graphql | #release-notes

5.

Hacking GraphQL endpoints with introspection, query, mutation, batching attacks

blog | 2025-04-08 13:31 | yeswehack.com | original ↗ | #bug-bounty | #burp-suite | #fuzzing

6.

How a GraphQL Bug Resulted in Authentication Bypass

vulnerability | 2024-07-29 21:00 | hackerone.com | original ↗ | #bug-bounty | #access-control | #authentication-bypass

7.

Refining your HTTP perspective, with bambdas

research | 2024-05-29 15:03 | portswigger.net | original ↗ | #burp-suite | #graphql | #tooling

8.

Secure your Apollo GraphQL server with Semgrep

blog | 2023-08-29 12:00 | blog.trailofbits.com | original ↗ | #graphql | #csrf | #static-analysis

9.

Find GraphQL API vulnerabilities, with Burp Suite Professional

blog | 2023-07-04 13:00 | portswigger.net | original ↗ | #api-security | #graphql | #burp-suite-professional

10.

KeystoneJS & GraphQL API Crash Course

blog | 2021-03-23 01:00 | hackerone.com | original ↗ | #cloud | #graphql | #tutorial

11.

Design Considerations for Secure GraphQL APIs

blog | 2020-09-28 00:00 | bishopfox.com | original ↗ | #appsec | #api-security | #graphql

12.

LevelUp 0x05 – Hacking Tricks & Treats

blog | 2019-10-16 00:00 | bugcrowd.com | original ↗ | #conference | #android | #graphql

13.

Join us October 5th for LevelUp 0x05!

blog | 2019-10-01 00:00 | bugcrowd.com | original ↗ | #conference | #android | #graphql

14.

GraphQL Week on The Hacker101 Capture the Flag Challenges

blog | 2019-07-17 15:00 | hackerone.com | original ↗ | #ctf | #api-security | #graphql

15.

The $30,000 Gem: Part 1

blog | 2017-06-08 14:00 | hackerone.com | original ↗ | #access-control | #api-security | #graphql