Search for packages
| purl | pkg:composer/api-platform/core@3.3.10 |
| Vulnerability | Summary | Fixed by |
|---|---|---|
|
VCID-1apf-t73g-nbc7
Aliases: CVE-2025-23204 GHSA-7mxx-3cgm-xxv3 |
API Platform Core is a system to create hypermedia-driven REST and GraphQL APIs. Starting in version 3.3.8, a security check that gets called after GraphQl resolvers is always replaced by another one as there's no break in a clause. As this falls back to `security`, the impact is there only when there's only a security after resolver and none inside security. Version 3.3.15 contains a patch for the issue. |
Affected by 2 other vulnerabilities. |
|
VCID-ezka-28sk-rbaz
Aliases: CVE-2025-31481 GHSA-cg3c-245w-728m |
API Platform Core is a system to create hypermedia-driven REST and GraphQL APIs. Using the Relay special node type you can bypass the configured security on an operation. This vulnerability is fixed in 4.0.22 and 3.4.17. |
Affected by 0 other vulnerabilities. Affected by 0 other vulnerabilities. Affected by 0 other vulnerabilities. |
|
VCID-h6xs-dtvv-mffa
Aliases: CVE-2025-31485 GHSA-428q-q3vv-3fq3 |
API Platform Core is a system to create hypermedia-driven REST and GraphQL APIs. Prior to 4.0.22 and 3.4.17, a GraphQL grant on a property might be cached with different objects. The ApiPlatform\GraphQl\Serializer\ItemNormalizer::isCacheKeySafe() method is meant to prevent the caching but the parent::normalize method that is called afterwards still creates the cache key and causes the issue. This vulnerability is fixed in 4.0.22 and 3.4.17. |
Affected by 0 other vulnerabilities. Affected by 0 other vulnerabilities. Affected by 0 other vulnerabilities. |
| Vulnerability | Summary | Aliases |
|---|---|---|
| This package is not known to fix vulnerabilities. | ||
| Date | Actor | Action | Vulnerability | Source | VulnerableCode Version |
|---|---|---|---|---|---|
| 2026-06-12T19:58:12.739679+00:00 | GitLab Importer | Affected by | VCID-h6xs-dtvv-mffa | https://gitlab.com/gitlab-org/advisories-community/-/blob/main/packagist/api-platform/core/CVE-2025-31485.yml | 38.6.0 |
| 2026-06-12T19:58:10.729294+00:00 | GitLab Importer | Affected by | VCID-ezka-28sk-rbaz | https://gitlab.com/gitlab-org/advisories-community/-/blob/main/packagist/api-platform/core/CVE-2025-31481.yml | 38.6.0 |
| 2026-06-12T19:57:06.095116+00:00 | GitLab Importer | Affected by | VCID-1apf-t73g-nbc7 | https://gitlab.com/gitlab-org/advisories-community/-/blob/main/packagist/api-platform/core/CVE-2025-23204.yml | 38.6.0 |