Here is a tiny article we wrote at Escape (YC W23) to describe the most common vulnerabilities in GraphQL and how to identify & fix them.
Best, Antoine Cofounder & CTO @ Escape.tech