api-platform core vulnerabilities

CVEs per yearBy the year they were published

1. 20231
2. 20254
3. 20262

Newest CVEs

• CVE-2026-49858

  API Platform Core: Cross-user attribute leak in JSON:API and HAL item normalizers due to missing isCacheKeySafe gate

  api-platform · core

  Medium5.9
• CVE-2026-54164

  API Platform Core: Missing IRI type check enables resource type confusion

  api-platform · core

  Medium6.5
• CVE-2025-31485

  GraphQL grant on a property might be cached with different objects

  api-platform · core

  High7.5
• CVE-2025-31481

  GraphQL query operations security can be bypassed

  api-platform · core

  High7.5
• CVE-2023-47639

  API Platform Core can leak exceptions message that may contain sensitive information

  api-platform · core

  Medium5.3
• CVE-2025-23204

  GraphQl securityAfterResolver not called

  api-platform · core

  Medium4.4
• CVE-2023-25575

  Secured properties in API Platform Core may be accessible within collections

  api-platform · core

  High7.7