Composer silverstripe/graphql has 9 known advisories in the phpwarden feed. Feed 2026.10.29.1, updated 2026-10-28.
| CVE | Title | Severity | CVSS | Affected | Fixed in |
|---|---|---|---|---|---|
| CVE-2020-26136 | Authentication bypass in SilverStripe GraphQL | medium | 6.5 | >=3.0.0 and <3.5.0 or >=4.0.0-alpha1 and <4.0.0-alpha2 | 3.5.0, 4.0.0-alpha2 |
| CVE-2023-40180 | Silverstripe GraphQL has DDOS Vulnerability due to lack of protection against recursive queries | high | 7.5 | >=3.0.0 and <3.8.2 or >=4.0.0 and <4.1.3 or >=4.2.0 and <4.2.5 or >=4.3.0 and <4.3.4 or >=5.0.0 and <5.0.3 | 3.8.2, 4.1.3, 4.2.5, 4.3.4 |
| CVE-2020-6165 | Silverstripe has Incorrect Default Permissions | medium | 5.3 | >=3.2.0 and <3.2.4 | 3.2.4 |
| CVE-2023-28104 | DDOS attack on graphql endpoints | high | 7.5 | >=4.1.1 and <4.1.2 or >=4.2.2 and <4.2.3 | 4.1.2, 4.2.3 |
| CVE-2021-28661 | SilverStripe GraphQL Server permission checker not inherited by query subclass. | medium | 4.3 | >=3.0.0 and <3.5.2 | 3.5.2 |
| CVE-2019-12437 | Silverstripe CSRF Protection Bypass via GraphQL | high | 8.8 | >=2.0.0 and <2.0.5 or >=3.1.0 and <3.1.2 or >=3.0.0 and <3.1.2 | 2.0.5, 3.1.2 |
| CVE-2023-44401 | View permissions are bypassed for paginated lists of ORM data | medium | 5.3 | >=4.0.0 and <4.3.7 or >=5.0.0 and <5.1.3 | 4.3.7, 5.1.3 |
| GHSA-wjg9-v8cf-f5q2 | silverstripe/graphql Cross-Site Request Forgery vulnerability | high | 7.3 | >=2.0.0 and <2.0.3 | 2.0.3 |
| SS-2018-007-1 | SS-2018-007: CSRF vulnerability in graphql | unknown | 0.0 | >=2.0.0 and <2.0.3 | 2.0.3 |
Find out in one command. phpwarden checks your composer.lock against this advisory and 20,000+ others, ranked by real-world exploitation (CISA KEV + EPSS). Free, offline, open data.
# one-time install pip install phpwarden # then phpwarden deps composer.lock
Or keep it checked automatically: GitHub Action · pre-commit hook · GitLab CI · Laravel artisan command
Install docs How findings are ranked