Core (Api-platform) - vulnerabilities (CVEs)

7 CVEs, 0 in the last 30 days, 101 known versions, newest CVE from 2026-07-01. Vendor: Api-platform.

CVEs of Core

• CVE-2026-49858 - CVSS 5.9 (medium), 2026-07-01: API Platform Core is a system to create hypermedia-driven REST and GraphQL APIs. In versions from 2.6.0 prior to 4.1.29, 4.2.26, and 4.3.12, a missing…
• CVE-2026-54164 - CVSS 6.5 (medium), 2026-07-01: API Platform Core is a system to create hypermedia-driven REST and GraphQL APIs. In versions prior to 4.1.30, 4.2.26 and 4.3.12, the serializer's…
• CVE-2025-31485 - CVSS 7.5 (high), 2025-04-03: API Platform Core is a system to create hypermedia-driven REST and GraphQL APIs. Prior to 4.0.22 and 3.4.17, a GraphQL grant on a property might be cached…
• CVE-2025-31481 - CVSS 7.5 (high), 2025-04-03: API Platform Core is a system to create hypermedia-driven REST and GraphQL APIs. Using the Relay special node type you can bypass the configured security on…
• CVE-2023-47639 - CVSS 5.3 (medium), 2025-04-03: API Platform Core is a system to create hypermedia-driven REST and GraphQL APIs. From 3.2.0 until 3.2.4, exception messages, that are not HTTP exceptions, are…
• CVE-2025-23204 - CVSS 4.4 (medium), 2025-03-24: API Platform Core is a system to create hypermedia-driven REST and GraphQL APIs. Starting in version 3.3.8, a security check that gets called after GraphQl…
• CVE-2023-25575 - CVSS 7.7 (high), 2023-02-28: API Platform Core is the server component of API Platform: hypermedia and GraphQL APIs. Resource properties secured with the `security` option of the…
• CVE-2019-1000011 - CVSS 6.5 (medium), 2019-02-04: API Platform version from 2.2.0 to 2.3.5 contains an Incorrect Access Control vulnerability in GraphQL delete mutations that can result in a user authorized…