CVE-2026-73976

djehuty is a research data repository system developed by 4TU.ResearchData. Prior to version 26.3.2, An unauthenticated attacker can inject SPARQL into the search/listing queries through three separate parameters. Because the affected queries are read (SELECT) queries, this does not write to the store, but it allows: Cross-graph data exfiltration — e.g. UNION-ing in triples from graphs the request was never scoped to (drafts/private/internal data held in the RDF store); denial of service — expensive or malformed queries that tie up the SPARQL backend / web workers. No account or user interaction is required. This issue has been patched in version 26.3.2.

• CWE-943

• https://github.com/4TUResearchData/djehuty/releases/tag/v26.3.2
• https://github.com/4TUResearchData/djehuty/security/advisories/GHSA-7gp2-rxw9-vw6p
• https://github.com/4TUResearchData/djehuty/security/advisories/GHSA-7gp2-rxw9-vw6p

Published

Oct 1, 2026

Last Modified

Oct 2, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-73965Vulnerability in the Siebel CRM Deployment product of Oracle…6.8
• CVE-2026-73966Vulnerability in the Siebel Apps - Marketing product of Orac…7.2
• CVE-2026-7397A security flaw has been discovered in NousResearch hermes-a…4.4
• CVE-2026-73973Linuxfabrik Monitoring Plugins provides monitoring plugins f…5.5
• CVE-2026-73974linuxfabrik-lib provides Python modules for database access,…5.5
• CVE-2026-73975djehuty is a research data repository system developed by 4T…8.4
• CVE-2026-7398A weakness has been identified in florensiawidjaja BioinfoMC…7.3
• CVE-2026-7399Authorization bypass through User-Controlled key vulnerabili…8.1
• CVE-2026-73992Subscriber Remote Code Execution (RCE) in Query Wrangler <= …9.9
• CVE-2026-73993Unauthenticated PHP Object Injection in FundEngine <= 1.7.9 …9.8
• CVE-2026-73994Unauthenticated Broken Access Control in Charitable <= 1.8.1…7.5
• CVE-2026-73995Subscriber Broken Authentication in User Registration <= 5.2…5.4