https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2023-44401.htmlhttps://patchthecve.com/cve/CVE-2023-44401.htmlWed, 17 Jun 2026 06:27:34 +0000MEDIUM 5.3: The Silverstripe CMS GraphQL Server serves Silverstripe data as GraphQL representations. In versions 4.0.0 prior to 4.3.7 and 5.0.0 prior to 5.1.3, `canView` permission checks are bypassed for ORM data in paginated GraphQL query results where the total number of records is greater than the number ofhttps://patchthecve.com/cve/CVE-2023-40180.htmlhttps://patchthecve.com/cve/CVE-2023-40180.htmlWed, 17 Jun 2026 06:16:35 +0000HIGH 7.5: silverstripe-graphql is a package which serves Silverstripe data in GraphQL representations. An attacker could use a recursive graphql query to execute a Distributed Denial of Service attack (DDOS attack) against a website. This mostly affects websites with publicly exposed graphql schemas. If yourhttps://patchthecve.com/cve/CVE-2023-26144.htmlhttps://patchthecve.com/cve/CVE-2023-26144.htmlWed, 17 Jun 2026 05:42:46 +0000MEDIUM 5.3: Versions of the package graphql from 16.3.0 and before 16.8.1 are vulnerable to Denial of Service (DoS) due to insufficient checks in the OverlappingFieldsCanBeMergedRule.ts file when parsing large queries. This vulnerability allows an attacker to degrade system performance. **Note:** It was not prhttps://patchthecve.com/cve/CVE-2023-28104.htmlhttps://patchthecve.com/cve/CVE-2023-28104.htmlWed, 17 Jun 2026 05:46:52 +0000HIGH 7.5: `silverstripe/graphql` serves Silverstripe data as GraphQL representations. In versions 4.2.2 and 4.1.1, an attacker could use a specially crafted graphql query to execute a denial of service attack against a website which has a publicly exposed graphql endpoint. This mostly affects websites with pa