CO
Product
core
8
CVEs
0
On KEV
7.5
Max CVSS
0
New 30D
Severity mix
Critical 0High 2Medium 6Low 0
Watch
Add core to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2025-31485 | 7.5 | Apr 3 | GraphQL grant on a property might be cached with different objects Affected: >= 4.0.0-alpha.1, < 4.0.22; < 3.4.17 |
| CVE-2025-31481 | 7.5 | Apr 3 | GraphQL query operations security can be bypassed Affected: >= 4.0.0, < 4.0.22; < 3.4.17 |
| CVE-2026-54164 | 6.5 | Jul 1 | API Platform Core: Missing IRI type check enables resource type confusion Affected: < 4.1.30; >= 4.2.0, < 4.2.26; >= 4.3.0, < 4.3.12 |
| CVE-2023-25575 | 6.5 | Feb 28 | API Platform Core is the server component of API Platform: hypermedia and GraphQL APIs Affected: 2.6.0 before 2.7.10; 3.0.0 before 3.0.12; 3.1.0 before 3.1.3 |
| CVE-2019-1000011 | 6.5 | Feb 4 | API Platform version from 2.2.0 to 2.3.5 contains an Incorrect Access Control vulnerability in GraphQL delete mutations that can result in a user authorized to delete a resource… Affected: 2.2.0 through 2.3.5 |
| CVE-2026-49858 | 5.9 | Jul 1 | API Platform Core: Cross-user attribute leak in JSON:API and HAL item normalizers due to missing isCacheKeySafe gate Affected: >= 2.6.0, < 4.1.29; >= 4.2.0, < 4.2.25; >= 4.3.0, < 4.3.8 |
| CVE-2023-47639 | 5.3 | Apr 3 | API Platform Core can leak exceptions message that may contain sensitive information Affected: >= 3.2.0, < 3.2.5 |
| CVE-2025-23204 | 4.4 | Mar 24 | GraphQl securityAfterResolver not called Affected: >= 3.3.8, < 3.3.15 |
Showing 8