api-platform/core
Healthy and suitable to depend on. It has a long, active release history, substantial recent development, clear project backing, tests, documentation, and security practices; maintenance is concentrated in one contributor but the organization and other active contributors reduce that risk.
94%
Total Score
100
100
100
90
Health Score Breakdown
One of five workflows uses pull_request_target, which warrants review because that trigger can expose privileged workflow behavior, but no untrusted checkouts or script-injection patterns were detected.
Vulnerabilities
| Title | Versions | Severity |
|---|---|---|
CVE-2026-54164 api-platform/core is vulnerable to Access of Resource Using Incompatible Type ('Type Confusion') in versions 0.0.0 - 4.1.30, 4.2.0 - 4.2.26 and 4.3.0 - 4.3.12. | 0.0.0 - 4.1.304.2.0 - 4.2.264.3.0 - 4.3.12 | Medium |
CVE-2026-49858 api-platform/core is vulnerable to Use of Cache Containing Sensitive Information in versions 2.6.0 - 4.1.29, 4.2.0 - 4.2.25 and 4.3.0 - 4.3.8. | 2.6.0 - 4.1.294.2.0 - 4.2.254.3.0 - 4.3.8 | Medium |
AIKIDO-2026-10459 Pre-CVE Found by Aikido Intel before public disclosure or CVE publication. api-platform/core is vulnerable to Improper Authorization in versions 4.3.0 - 4.3.0 and 4.2.0 - 4.2.21. | 4.2.0 - 4.2.214.3.0 - 4.3.0 | High |
AIKIDO-2026-10398 Pre-CVE Found by Aikido Intel before public disclosure or CVE publication. api-platform/core is vulnerable to Information Disclosure in versions 3.1.0 - 4.2.21. | 3.1.0 - 4.2.21 | Medium |
CVE-2023-47639 api-platform/core is vulnerable to Generation of Error Message Containing Sensitive Information in versions 3.2.0 - 3.2.5. | 3.2.0 - 3.2.5 | Medium |
Package versions
Maintainers
 Kévin Dunglas |
Direct Dependencies
| Dependency | Last Release | Score |
|---|---|---|
 psr/cache Version ^1.0 || ^2.0 || ^3.0 | — | — |
psr/container Version ^1.0 || ^2.0 | — | — |
symfony/asset Version ^7.4 || ^8.0 | — | — |
composer/semver Version ^3.4 | — | — |
symfony/web-link Version ^7.4 || ^8.0 | — | — |
Weekly Downloads
Info
- Last Published
- 4 days ago
- Created
- 11 years ago
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.