CVE-2026-28410
The Graph is an indexing protocol for querying networks like Ethereum, IPFS, Polygon, and other blockchains. Prior to version 3.0.0, a flaw in the token vesting contracts allows users to access tokens that should still be locked according to their vesting schedule. This issue has been patched in version 3.0.0.
Scoring
- Severity
- MEDIUM
- CVSS base score
- 5.3
- CVSS vector
- CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
- EPSS probability
- 0.23%
- CWE
- CWE-284, CWE-682
- Published
- 2026-03-05
- Last modified
- 2026-03-12
Affected products
- graphprotocol contracts
Weakness type
Related vulnerabilities
- CVE-2026-50165 — alf.io has Improper Access Control for Organization Owners that Exposes System Secrets
- CVE-2026-86774 — Snipe-IT before 8.7.0 Broken Access Control via AssetModelPolicy
- CVE-2026-19625 — IBM Enterprise Build of Quarkus is affected by multiple vulnerabilities
- CVE-2026-75998 — ColdFusion | Improper Access Control (CWE-284)
- CVE-2026-86672 — ningzichun Student Management System Backup example.7z information disclosure
- CVE-2026-81963 — Windows Update Stack Elevation of Privilege Vulnerability
- CVE-2026-77487 — SQL Server Elevation of Privilege Vulnerability
- CVE-2026-73028 — SQL Server Elevation of Privilege Vulnerability