AP
Vendor
api-platform
10
CVEs
0
On KEV
0
New 30D
Products
CO7.5
core
api-platform
8 CVEs0 on KEV0 new
AP5.9
api-platform/hal
api-platform
1 CVEs0 on KEV0 new
AP5.9
api-platform/json-api
api-platform
1 CVEs0 on KEV0 new
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-49858 | AP api-platform/json-api api-platform | 5.9 | Jul 1 | API Platform Core: Cross-user attribute leak in JSON:API and HAL item normalizers due to missing isCacheKeySafe gate |
| CVE-2026-54164 | CO core api-platform | 6.5 | Jul 1 | API Platform Core: Missing IRI type check enables resource type confusion |
| CVE-2025-31485 | CO core api-platform | 7.5 | Apr 3 | GraphQL grant on a property might be cached with different objects |
| CVE-2025-31481 | CO core api-platform | 7.5 | Apr 3 | GraphQL query operations security can be bypassed |
| CVE-2023-47639 | CO core api-platform | 5.3 | Apr 3 | API Platform Core can leak exceptions message that may contain sensitive information |
| CVE-2025-23204 | CO core api-platform | 4.4 | Mar 24 | GraphQl securityAfterResolver not called |
| CVE-2023-25575 | CO Core Api-platform | 6.5 | Feb 28 | API Platform Core is the server component of API Platform: hypermedia and GraphQL APIs |
| CVE-2019-1000011 | CO Core Api-platform | 6.5 | Feb 4 | API Platform version from 2.2.0 to 2.3.5 contains an Incorrect Access Control vulnerability in GraphQL delete mutations that can result in a user authorized to delete a resource… |