Vendors / Hasura Records 8 All Threatist records
Exploited (KEV) 0 None in CISA KEV
CVSS critical 1
CVSS high 4
Exploited now Hasura records in CISA KEV No Hasura vulnerabilities are listed in CISA KEV.
Components Products in the NVD configurations · select one to filter the records Priority HIGH 81
Hasura GraphQL 1.3.3 contains a remote code execution vulnerability that allows attackers to execute arbitrary shell commands through SQL query manipulation.
CVSS 4.0 CRITICAL 9.3· Network · No auth · No interaction · EPSS 0.01131 · Published 2026-01-21 · No fix listed CWE-78
Priority HIGH 77
Hasura GraphQL 1.3.3 contains a denial of service vulnerability that allows attackers to overwhelm the service by crafting malicious GraphQL queries with excessive nested fields.
CVSS 4.0 HIGH 8.7· Network · No auth · No interaction · EPSS 0.00481 · Published 2025-12-22 · No fix listed CWE-770
Priority HIGH 70
Hasura GraphQL 1.3.3 contains a local file read vulnerability that allows attackers to access system files through SQL injection in the query endpoint.
CVSS 4.0 MEDIUM 6.9· Local · No auth · No interaction · EPSS 0.00217 · Published 2025-12-22 · No fix listed CWE-89
Priority MEDIUM 42
Hasura GraphQL Engine before 2.15.2 mishandles row-level authorization in the Update Many API for Postgres backends.
CVSS 3.1 HIGH 8.8· Network · Low privileges · No interaction · EPSS 0.00879 · Published 2022-12-08 · No fix listed CWE-863
Priority MEDIUM 41
Hasura is an open-source product that provides users GraphQL or REST APIs.
CVSS 3.1 HIGH 7.5· Network · No auth · No interaction · EPSS 0.01302 · Published 2023-03-14 · Fixed in 1.3.4, 2.11.5 +1 CWE-22
Priority LOW 37
Hasura GraphQL 1.3.3 contains a server-side request forgery vulnerability that allows attackers to inject arbitrary remote schema URLs through the add_remote_schema endpoint.
CVSS 4.0 MEDIUM 6.9· Network · No auth · No interaction · EPSS 0.00384 · Published 2025-12-22 · No fix listed CWE-918
Priority LOW 35
graphql-engine (aka Hasura GraphQL Engine) before 1.0.0-beta.3 mishandles the audience check while verifying JWT.
CVSS 3.0 HIGH 7.5· Network · No auth · No interaction · EPSS 0.0118 · Published 2019-07-29 · Fixed in 1.0.0-beta.3
Priority LOW 27
Hasura is an open-source product that provides users GraphQL or REST APIs.
CVSS 4.0 MEDIUM 6.0· Network · Low privileges · No interaction · EPSS 0.00275 · Published 2026-07-07 · Fixed in 2.49.2, 2.45.5 CWE-863
Open these records in search → All records by CVSS severity
1 4 3 0 0
THREATIST.IORead the docs