CVE-2026-10584

MediumCVSS 5.9/10Last modified Jul 22, 2026

Description

Proxy server in Graph Explorer before 3.0.1 falls back to HTTP when certificate files are missing, which might allow remote threat actors to obtain sensitive information via interception of requests intended to be sent over HTTPS.

To remediate this issue, users should upgrade to Graph Explorer v3.0.1 or later.

Metrics

CVSS 3.1 5.9/10CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-319

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

VendorProductVersions
AWSGraph Explorer>= 1.1.0, < 3.0.1

References

Timeline

Published
Jun 2, 2026
Last modified
Jul 22, 2026
NVD status
Awaiting Analysis

Related CVEs from 2026

CVE-2026-1058407.5lrzsz before 0.13.0 contains a path traversal vulnerability in the lrz receive utility's restricted mode that allows malicious ZMODEM senderCVE-2026-1058417.5lrzsz before 0.13.0 contains an OS command injection vulnerability in the lrz receive utility's pipe mode that allows remote senders to execCVE-2026-1058426.4lrzsz before 0.13.0 contains a heap-based buffer overflow vulnerability in procheader() of the lrz receive utility when copying overlong senCVE-2026-1058449.3Payload is a free and open source headless content management system. In versions from 3.0.0 before 3.88.0 and canary versions before 4.0.0-CVE-2026-1058459.8Payload is a free and open source headless content management system. In versions from 3.0.0 before 3.88.0 and canary versions before 4.0.0-CVE-2026-1058466.1Payload is a free and open source headless content management system. In versions from 3.40.0 before 3.88.0 and canary versions before 4.0.0CVE-2026-1058476.5Payload is a free and open source headless content management system. In versions from 3.0.0 before 3.90.0 and canary versions before 4.0.0-CVE-2026-1058489.6Payload is a free and open source headless content management system. In @payloadcms/plugin-stripe versions before 3.90.0 and canary versionCVE-2026-1058498.3Payload is a free and open source headless content management system. In versions from 3.0.0 before 3.90.0 and canary versions before 4.0.0-CVE-2026-105855.4A stored cross-site scripting vulnerability was identified in GitHub Enterprise Server that allowed an authenticated attacker to execute arbCVE-2026-1058508.2Payload is a free and open source headless content management system. In @payloadcms/plugin-ecommerce versions before 3.90.0 and canary versCVE-2026-1058518.1Payload is a free and open source headless content management system. In versions from 3.0.0 before 3.90.0 and canary versions before 4.0.0-
CVE-2026-10584: Medium severity, CVSS 5.9 | Vulnix