{"items":[{"id":"CVE-2026-119286","published":"2026-10-29T21:38:43.633Z","updated":"2026-10-30T15:58:44.342Z","title":"GraphQL-core: Denial of service via memory leak in aborted validations","severity":"HIGH","score":7.5,"vendor":"graphql-python","product":"graphql-core","kev":false,"epss":0.00421,"kevAdded":null,"exploit":false},{"id":"CVE-2026-75507","published":"2026-10-22T16:12:38.424Z","updated":"2026-10-23T21:08:40.217Z","title":"GraphQL-core: Denial of service via quadratic complexity in the OverlappingFieldsCanBeMerged validation rule","severity":"HIGH","score":7.5,"vendor":"graphql-python","product":"graphql-core","kev":false,"epss":0.006,"kevAdded":null,"exploit":false},{"id":"CVE-2026-75508","published":"2026-10-22T16:10:17.124Z","updated":"2026-10-29T11:47:15.190Z","title":"GraphQL-core: Denial of service via comment tokens bypassing the parser's max_tokens limit","severity":"HIGH","score":7.5,"vendor":"graphql-python","product":"graphql-core","kev":false,"epss":0.00573,"kevAdded":null,"exploit":true}]}