What’s Vulnerable › Products

api-platform core vulnerabilities

8 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 6 published in the last 12 months.

Check whether your api-platform core version is affected

Latest api-platform core vulnerabilities

• CVE-2026-54164 — API Platform Core: Missing IRI type check enables resource type confusion (CVSS 6.5)
• CVE-2026-49858 — API Platform Core: Cross-user attribute leak in JSON:API and HAL item normalizers due to missing isCacheKeySafe gate (CVSS 5.9)
• CVE-2025-31485 — GraphQL grant on a property might be cached with different objects (CVSS 7.5)
• CVE-2025-31481 — GraphQL query operations security can be bypassed (CVSS 7.5)
• CVE-2023-47639 — API Platform Core can leak exceptions message that may contain sensitive information (CVSS 5.3)
• CVE-2025-23204 — GraphQl securityAfterResolver not called (CVSS 4.4)
• CVE-2023-25575 — Secured properties in API Platform Core may be accessible within collections (CVSS 6.5)
• CVE-2019-1000011 — (CVSS 6.5)