Read the docs

api-platform

Records8All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical0CVSS 9.0–10.0
CVSS high3CVSS 7.0–8.9

Exploited now

api-platform records in CISA KEV

No api-platform vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records
Core 2 records LOW

Records

8 records

TI-2025-22662 CVE-2025-31481 · GHSA-cg3c-245w-728m

GraphQL query operations security can be bypassed

Priority HIGH 72

API Platform Core is a system to create hypermedia-driven REST and GraphQL APIs.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00475 Published 2025-04-03 Fixed in 4.0.22, 3.4.17 +1 CWE-863
TI-2025-16989 CVE-2025-23204 · GHSA-7mxx-3cgm-xxv3

GraphQl securityAfterResolver not called

Priority MEDIUM 54

API Platform Core is a system to create hypermedia-driven REST and GraphQL APIs.

CVSS 3.1MEDIUM 4.4 Network High privileges No interaction EPSS 0.00301 Published 2025-03-24 Fixed in 3.3.15 CWE-20
TI-2019-15828 CVE-2019-1000011 · GHSA-974j-wjxx-wggj

API Platform version from 2.2.0 to 2.3.5 contains an Incorrect Access Control…

Priority LOW 31

API Platform version from 2.2.0 to 2.3.5 contains an Incorrect Access Control vulnerability in GraphQL delete mutations that can result in a user authorized to delete a resource can delete any resource.

CVSS 3.0MEDIUM 6.5 Network Low privileges No interaction EPSS 0.01024 Published 2019-02-04 Fixed in 2.2.10, 2.3.6 CWE-284
Open these records in search →