Composer api-platform/core has 8 known advisories in the phpwarden feed. Feed 2026.10.28.3, updated 2026-10-28.
| CVE | Title | Severity | CVSS | Affected | Fixed in |
|---|---|---|---|---|---|
| CVE-2019-1000011 | Incorrect Access Control vulnerability in api-platform/core | medium | 6.5 | >=2.2.0 and <2.2.10 or >=2.3.0 and <2.3.6 | 2.2.10, 2.3.6 |
| CVE-2025-31485 | GraphQL grant on a property might be cached with different objects | high | 7.5 | >=4.0.0-alpha.1 and <4.0.22 or <3.4.17 or >=4.1.0-alpha.1 and <4.1.5 or >=4.0.0 and <4.0.22 or >=4.1.0 and <4.1.5 | 4.0.22, 3.4.17, 4.1.5 |
| CVE-2023-25575 | api-platform/core's secured properties may be accessible within collections | high | 7.7 | >=3.0.0 and <3.0.12 or >=3.1.0 and <3.1.3 or >=2.6.0 and <2.7.10 | 3.0.12, 3.1.3, 2.7.10 |
| CVE-2025-31481 | GraphQL query operations security can be bypassed | high | 7.5 | >=4.0.0-alpha.1 and <4.0.22 or <3.4.17 or >=4.1.0-alpha.1 and <4.1.5 or >=4.0.0 and <4.0.22 or >=4.1.0 and <4.1.5 | 4.0.22, 3.4.17, 4.1.5 |
| CVE-2023-47639 | API Platform Core can leak exceptions message that may contain sensitive information | medium | 5.3 | >=3.2.0 and <3.2.5 | 3.2.5 |
| CVE-2026-54164 | API Platform Core: Relation IRIs are not type-checked: a related resource can be denormalised as the wrong resource type (type confusion) | medium | 6.5 | <4.1.30 or >=4.2.0 and <4.2.26 or >=4.3.0 and <4.3.12 | 4.1.30, 4.2.26, 4.3.12 |
| CVE-2026-49858 | API Platform Core vulnerable to cross-user attribute leak in JSON:API and HAL item normalizers due to missing isCacheKeySafe gate | medium | 5.9 | >=2.6.0 and <4.1.29 or >=4.2.0 and <4.2.25 or >=4.3.0 and <4.3.8 | 4.1.29, 4.2.25, 4.3.8 |
| CVE-2025-23204 | API Platform Core does not call GraphQl securityAfterResolver | medium | 4.4 | >=3.3.8 and <3.3.15 | 3.3.15 |
Find out in one command. phpwarden checks your composer.lock against this advisory and 20,000+ others, ranked by real-world exploitation (CISA KEV + EPSS). Free, offline, open data.
# one-time install pip install phpwarden # then phpwarden deps composer.lock
Or keep it checked automatically: GitHub Action · pre-commit hook · GitLab CI · Laravel artisan command
Install docs How findings are ranked